loader image

The great PHP scare of October 2026, in plain English

Posted on by William Jeffree

If you caught the headlines this week, you may have spent part of Wednesday wondering whether your website was about to be taken over by robots. A few of you emailed to ask, which was exactly the right thing to do.

The short version: every site we host was protected on Wednesday evening and patched by Thursday morning. There was nothing you needed to do, and our host has found no evidence of any break-ins.

What actually happened

PHP is the programming language that runs WordPress, and with it a huge share of the web. The security firm Wiz puts it at around 70% of the world’s websites. This week two serious flaws in PHP itself were made public under the catchy name PHP2Shell (officially CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 for severity).

In plain English: on an unpatched server, an attacker could potentially run their own code without needing to log in. The flaws had been sitting in PHP’s engine for more than a decade, so even well-built, well-kept sites were exposed. This was not a case of someone forgetting to update a plugin.

Things moved quickly:

  • In August, researchers at Wiz and Calif found the flaws, using the latest AI models to help them dig.
  • On 17th October, while the details were still meant to be under wraps, Amazon’s security traps logged someone trying to exploit them.
  • On Tuesday 20th, details leaked online, and PHP put out an advance warning that evening.
  • On Wednesday afternoon PHP released the fixes. Within the hour, attack attempts were in the tens of thousands.

Security agencies, including the UK’s National Cyber Security Centre, told organisations that couldn’t patch straight away to consider taking their sites offline. Plenty did. Government websites in Finland, the Czech Republic and the Netherlands went dark, along with Dutch hospital sites, the City of Edinburgh’s web services, some BBC web portals and some of the systems behind Wikipedia. In the UK, 32 government digital services were unavailable and the NCSC sent out around 50,000 warnings.

What it meant for sites we look after

We host 69 websites on Kinsta, a managed WordPress host. At about 8pm on Wednesday, Kinsta put extra firewall protection in front of every site and started rolling out patched versions of PHP. Through the night every version was patched, older ones included, and at about half past nine on Thursday morning Kinsta confirmed the update was in place across its whole platform, with no evidence of any breaches.

Almost all of our sites run on current versions of PHP. Two older ones were patched as well, and we’re moving them up to a current version anyway as routine maintenance. Nobody had to take their site offline or miss a day of enquiries.

Was the panic justified?

Partly. These were serious flaws and attackers piled in fast. Attempts climbed into the millions by Thursday morning, some trying to plant malicious files on servers or recruit them into a botnet. If you couldn’t patch, unplugging was the sensible call.

As I write, the researchers tracking the attacks have not reported a confirmed successful break-in. But more than 34 million PHP services are still unpatched, so it isn’t over for everyone.

For a site on a good managed host running a supported version of PHP, though, this was dealt with overnight. That’s the real lesson: hosting and maintenance matter more than headlines.

AI found it. AI didn’t hack it.

The headlines blurred an important point. This started as an “AI helped researchers find a bug” story, not an “AI hacked PHP” story. AI spotting problems that humans missed for over ten years is good news for the people defending websites.

The catch is that the gap between a flaw being found and being attacked is shrinking, and I’d expect more stories like this one. Some will deserve your attention and some will be clickbait. If one lands in your inbox and you’re not sure which it is, just ask us. That’s what we’re here for.

Next up: two-factor logins for WordPress, keeping PHP and plugins current, and what managed hosting actually does for you.

Sources