Critical PHP flaws prompt global rush to patch websites
Archived — this story has rotated out of today’s deck. It is kept here in full.
The gist
Two critical PHP flaws affecting up to 70% of websites got patches after an embargo leak.
Governments and firms took sites offline as a precaution; exploitation reports remain unclear.
Background
PHP is a widely used scripting language that supports much of the internet, used by as much as 70 percent of websites. The two flaws, nicknamed PHP2Shell, stem from how PHP handles fatal errors such as running out of memory, and both scored 9.2 out of 10 on the industry severity scale, placing them in the "critical" category. The vulnerabilities remained hidden in the PHP codebase for more than a decade and were uncovered with the help of artificial intelligence. The PHP Foundation, which maintains the language and issued the patches, said the flaws were leaked before the intended release date through a mixture of mistaken and intentional breaches.
How it unfolded
- Aug 11, 2026Calif, working with OpenAI, reported the first of the two PHP flaws.
- Aug 24, 2026Wiz, a cloud security company owned by Google, reported the second flaw.
- Oct 20, 2026Someone posted to a public forum that two major security flaws had been found in PHP.
- Oct 21, 2026The PHP Foundation released patches, and cyber agencies in the U.S., Europe, Australia, Canada and elsewhere urged organizations to take websites offline immediately.
- Oct 21, 2026Government and private websites went down, including the Dutch and Belgian cyber agencies, several Finnish and Dutch government sites, a French domain name organization and the main page of the French tax portal; Pinboard and parts of Wikipedia were briefly down.
- Oct 22, 2026France's Ministry of the Interior placed all its websites into preventive maintenance, and Belgium's foreign affairs department took its sites offline after reports of attacks exploiting the flaws.
- Oct 22, 2026South Korea raised its private-sector cybersecurity alert level and issued guidance to about 28,000 companies and 5,900 members of a government information-sharing network.
- Oct 22, 2026The Dutch cybersecurity agency, the Port of Rotterdam, Overheid.nl, the KNVB, the websites of the country's five largest political parties and several hospital sites went offline; Finland's state IT provider Valtori and Wikipedia's operator also took systems down.
Who’s saying what
- Official
- Germany's BSI Vice President Thomas Caspers said attackers could carry out massive campaigns and that short-term, large-scale exploitation was likely.
- Official
- The NSA said the flaws often provide a direct path to a server's file system or database, and urged organizations unable to update immediately to take systems offline.
- Analysts
- Ciaran Martin, former head of the British cyber agency, called the issue "very, very bad and requires urgent attention."
- Expert
- Anthropic deputy security chief Jason Clinton warned a "vulnerability tsunami" is coming and said things will get worse before they get better.
- Caution
- Belgium's cybersecurity centre said it had not recorded any attacks on Belgian websites, and CISA said it has not observed exploitation.
Still unverified
Patchstack said it had received "reports of active exploitation," while Belgium's cybersecurity centre said it had not recorded any attacks on Belgian websites and CISA said it has not observed exploitation; how badly hackers are exploiting the flaw remains unclear.