Two Flaws, Millions of Websites: Inside the PHP Emergency and Why the Web Keeps Ending Up Here

On Wednesday, the website of the Netherlands' national cyber security center went dark. Nobody had broken in. The agency's own people pulled the plug, on purpose, as a precaution.

That same day, Finland's state IT agency shut down public web services. German federal IT teams took sites offline. France pulled down regional government pages. Across the Atlantic, the U.S. Cybersecurity and Infrastructure Security Agency told American organizations plainly: if you can't fix this right away, take your PHP websites offline until you can.

The cause was two flaws in PHP, a programming language most people have never heard of and use every day without knowing it. It quietly runs the bakery's online order form, the parish calendar, the town clerk's meeting notices and the shop that ships maple syrup around the country.

If you have a website in the North Country, this one is worth ten minutes of your day.

What broke on Wednesday

The PHP project, the open-source group that maintains the language, gave the world a one-day warning on Tuesday. On Wednesday, Oct. 21, it shipped fixes for two critical security holes. Both are rated 9.2 out of 10 in severity. Security researchers have nicknamed the pair "PHP2Shell."

The flaws can let an outsider run their own commands on a web server without a password. The PHP project says they affect all PHP installations serving web requests, including the most common server setups. In the riskiest setup, the project says, an attack can fire before any of the website's own code even runs. That means a well-built site can still be exposed if the PHP underneath it is out of date.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are no longer supported. The PHP team posted only bare-bones source patches for them, so most sites still running them need an upgrade or a fix from their hosting vendor.

Is anyone actually being attacked? The picture was still forming Wednesday. Cloudflare, which protects a large share of the world's websites, says it has seen attack traffic aimed at its customers. CISA said it had not observed exploitation when it published its alert. Either way, the PHP project's advice leaves little room for waiting.

How one language ended up under most of the web

PHP started small. In 1994, a programmer named Rasmus Lerdorf wrote a few tools to manage his own home page and called them "Personal Home Page Tools." He released the code in 1995. It was free, forgiving and easy to learn, and it grew up right alongside the web itself.

That ease changed who could have a website. A small business no longer needed a custom software team. A church could post its schedule. A town could put its meeting minutes online. WordPress, which is built on PHP, made it even simpler, and today it powers 39.6% of all websites, according to the web survey firm W3Techs.

W3Techs estimates PHP runs 69.3% of websites whose server-side language it can identify. That is the number you may see in alarming headlines, and it needs one important caveat: it does not mean 69% of websites are vulnerable today. Whether a site is exposed depends on which PHP version it runs, how its server is set up and whether its host has already patched.

The problem that keeps coming back

None of those emergencies happened because one company got careless. They happened because the modern internet is built from shared parts. One piece of free software ends up inside millions of websites, and when that piece cracks, everyone who depends on it has to act at once.

There is a second, quieter problem, and it is the one that hits small organizations hardest. Many websites are built once and then left alone. The developer moves on. The plugins pile up. The hosting plan never changes. Years later, the site is still running software that stopped getting security fixes long ago, and nobody remembers who has the password to the server.

Then the next warning arrives, and the question is not "What is PHP?" It is "Who is in charge of our website?"

Why this one moved faster

This emergency has a new ingredient. Wiz Research, one of the security teams credited with finding the flaws, says it used artificial intelligence tools to help uncover them. Wiz also credits OpenAI for help finding the flaws and checking the fixes.

That cuts both ways. The same kind of tools that help defenders find hidden bugs can help attackers study a published fix and hunt for servers that have not installed it. Lukasz Olejnik, a visiting senior research fellow at King's College London, warned that with artificial intelligence, exploitation "may happen instantly, on a large scale."

For website owners, the practical lesson is simple. You may not get weeks to react anymore. Updates need a plan and a person responsible, not a hope that someone notices.

Who actually has to do the fixing

Here is the part that confuses people: this is not a WordPress update. WordPress itself says no WordPress update is required for these flaws. The fix lives one layer down, in the PHP software on the server, which is usually your hosting company's job or your developer's.

Some big platforms moved quickly. Automattic, the company behind WordPress.com, says its hosting platforms are already protected. Cloudflare says customers using its free or paid web application firewall have been shielded by default since late Tuesday night, hours before the fixes came out, but it also tells them plainly to patch anyway.

If your site sits on a typical shared hosting plan, a virtual server or a machine in someone's back office, do not assume. Ask, and get the answer in writing.

Is there a safer way to build a website?

For some organizations, yes, but it takes an honest look. Modern tools such as Next.js can build many pages ahead of time, so a visitor is served a finished page instead of having a program assemble it on the fly. Fewer moving parts on the live server can mean fewer things that need emergency patching.

But no technology is magic. Next.js sites were hit by serious flaws in 2025, including React2Shell, a React bug that scored a perfect 10 for severity. A neglected Next.js site can be just as risky as a neglected PHP site.

What actually makes a website safer is less glamorous: choosing a setup that fits what the site really does, cutting software it does not need, applying updates on a schedule, keeping backups and knowing who to call. A simple informational site might do well as mostly static pages. A business with customer accounts and online payments needs a fuller plan. And for plenty of owners, a well-maintained WordPress site is still the sensible choice.

The North Country question

Up here, websites carry a lot of weight. They connect residents with town services, patients with providers, shoppers with Main Street and families with churches, schools and community groups. Most of the people who depend on those sites have no idea what software is running behind them, and they should not have to.

Local governments have extra reason to pay attention. Since 2025, New York law requires cities, towns, villages and counties to report cyber incidents to the state's Division of Homeland Security and Emergency Services within 72 hours, and any ransom payment within 24 hours. The state's Cyber Incident Response Team helps local governments that are hit.

For businesses and nonprofits, the first step is the same everywhere: know who is responsible for your website's updates, backups and recovery. If you do not have that person, Webit365, a website development company that works with businesses and organizations across the North Country, offers website reviews, maintenance, upgrades and modern Next.js builds. A good review looks at your software, hosting, update status and what your site actually needs. Sometimes the answer is a quick update. Sometimes it is a rebuild. Either way, it should be a decision, not a surprise.

The warning behind the warning

The most unsettling part of Wednesday was not that two dangerous bugs were found. Bugs are always being found. It was watching government agencies, the people whose job is cybersecurity, decide the safest move was to switch their own websites off.

Nobody can promise a world without software flaws. What any business, church or town office can do is make sure that when the next one arrives, and it will, someone already knows what to do.

The question is not whether there will be another emergency. It is whether your website will be ready before it starts.

Common questions

What is the PHP security emergency of October 2026?

On Oct. 21, 2026, the PHP project released fixes for two critical flaws, nicknamed PHP2Shell, that can let an outsider run commands on a web server without a password. Both are rated 9.2 out of 10 in severity. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Is my WordPress website affected?

WordPress runs on PHP, so the server underneath your site may need the PHP update. WordPress itself says no WordPress update is required. Ask your hosting company or developer whether the Oct. 21 PHP security releases are installed on your server.

Are 70% of websites vulnerable?

No. W3Techs estimates PHP runs 69.3% of websites whose server-side language it can identify, but whether a site is exposed depends on its PHP version, server setup and whether its host has already patched.

What should I do if my site can't be updated right away?

CISA advises organizations that cannot update immediately, or that run PHP 8.1 or older, to take PHP-based systems offline until they can be patched. A web application firewall may provide some protection in the meantime, but it is not a replacement for the update.

Is Next.js safer than PHP?

Not automatically. Next.js can serve many pages that are built ahead of time, which can mean fewer moving parts on a live server, but it has had serious flaws of its own, including a 10-out-of-10 vulnerability in 2025. Safety comes from maintenance, updates, backups and the right setup for the job.

What should a North Country town or village do?

Confirm with your IT provider that any PHP-based sites are patched or offline. Under New York law since 2025, municipalities must report cyber incidents to the state Division of Homeland Security and Emergency Services within 72 hours, and its Cyber Incident Response Team helps local governments.