Strangers could break into 7 of every 10 websites. No password needed

Update, 22 October 2026: The FBI's Cyber Division named both flaws, CVE-2026-109618 and CVE-2026-109619, and told organisations to patch from php.net at once, take systems offline if they cannot, watch for PHP processes that launch shells or download files, and report any break-in to ic3.gov. The same day brought hacks at LiteLLM, Railway and more: see everything that broke on the internet's worst Wednesday.

Seven out of every ten websites on Earth run on one piece of free code called PHP. On 21 October 2026, the people who maintain it rushed out an emergency fix for two flaws so dangerous that governments switched off their own websites rather than leave them running for another hour.

PHP is the code that builds most web pages behind the scenes, the thing that pulls your bank balance or your news feed onto the screen the moment you load a page. Nearly 55 million websites use it. The two flaws, rated 9.2 out of 10 for danger, let a stranger with no password and no login send a web server a message and make it run their own commands.

Canada took some of its own federal websites offline to patch them. Cyber security agencies in the United States, Britain and the European Union told website owners to do the same until they were fixed. Parts of Wikipedia went dark. So did the bookmarking site Pinboard and the forums 4chan and Something Awful. Attacks on unpatched sites were already happening before most website owners even knew there was a problem, the same kind of silent exploitation that let South African banks lose R2.4 billion to fraud before anyone caught it.

Why did Wikipedia and a government just switch off their own websites?

Because staying online was the bigger risk. A flaw this size means anyone on the internet could take over the server, steal data, plant malware or deface the site, without ever typing a password. Wikipedia's operator, the Wikimedia Foundation, said it had deliberately taken several of its supporting systems offline until they could be safely patched. Pulling the plug for a few hours was safer than leaving the door open.

Read nextNovember petrol forecast: Now about R3.01 more a litre

4chan told its users the site was temporarily read-only "while we await an urgent PHP security update." Something Awful shut its forums for the same reason. These were not hacked yet. They switched themselves off first.

What actually broke, in plain words

Two separate bugs, now nicknamed "PHP2Shell" by security researchers, sit inside PHP's own plumbing. One happens when a server runs low on memory partway through handling a request, and the cleanup afterwards treats leftover, broken data as if it were still good. The other lets one visitor's leftover data get reused by mistake when the next visitor's request comes through the same worker. Chain the two together and a stranger can make the server run code it should never run.

Both flaws affect every version of PHP going back to PHP 5, released in 2004. The hole had been sitting there for more than twenty years before anyone found it.

The 21 to 22 October scramble, hour by hour

The four fixed versions, released 21 October: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anyone running an older, unsupported version needs a separate backported patch from their hosting provider.

What if you just run a small WordPress site?

WordPress runs on PHP, so this touches it too. The important part for an ordinary site owner is this: Updating WordPress itself, your theme or your plugins does not fix this. The fix has to go into PHP, which sits on the server underneath WordPress, and that is usually your hosting company's job, not yours.

Photo: Markus Spiske markusspiske / Wikimedia Commons, CC0

If you run a WordPress site, log into your hosting dashboard and check which PHP version it lists. If it already shows 8.5.12, 8.4.27, 8.3.36 or 8.2.35, you are covered. If it shows an older number and there is no "update available" notice, contact your host and ask directly whether they have patched the PHP2Shell flaws yet. Several large hosts had already rolled the fix out to every customer within a day of the patch going live, without anyone needing to click anything.

Did AI help find this, or cause it?

Both, depending on who you ask. According to the Irish broadcaster RTE, security researchers used AI tools to dig through PHP's code and turn up flaws that had sat unnoticed since 2004. Some of that work reportedly ran through a programme backed by OpenAI built to hunt for flaws in the software the whole internet runs on.

Trending nowScammers already know your account details before they call, and that is what makes them so convincing

That cuts two ways. The same AI tools that found this flaw before criminals did could just as easily find the next one for whoever gets there first. For now, the finding helped. The PHP team had a fix ready before the flaw became public knowledge, which is the outcome security researchers always hope for and rarely get.

Weak code reaching the public has already caused real damage this year. One coffee chain's own CEO leaked customer data through a dashboard built with barely any checking. A flaw sitting unnoticed inside a server's core code for twenty years is the same risk, just bigger and shared by millions of sites at once.

So is the internet safe again?

For patched sites, yes. For the estimated 1.3 million servers a security researcher believes are still exposed, the danger is live right now, and some of those sites are already under attack.

Photo: Kim Scarborough from Chicago, IL / Wikimedia Commons, CC BY-SA 2.0

The fix exists. The versions are out. The only question left is how many website owners, from a national government down to someone's small business site, actually install it before someone else finds the door still open.