Browsing the internet yesterday, you might have noticed a fair few websites were ‘under maintenance’ or offline altogether.
PHP is a programming language – the digital version of bricks and concrete – that about 70% of websites use.
The PHP Foundation, a non-profit that makes it, announced Tuesday that it was rolling out an update to patch ‘critical’ issues the following day.
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
— The PHP Foundation (@ThePHPF) October 20, 2026
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
Security agencies worldwide, from the UK and the US to China and Japan, called on websites to go dark if they can’t update, fearing cyber-attacks.
The worry, experts tell Metro, is that hackers could easily reverse engineer the patches to steal people’s personal information before they update.
But do regular people scrolling on social media or reading their work emails actually have anything to worry about?
What is PHP?
PHP, short for ‘Personal Home Page’, is a programming language anyone can use that’s been around since the 2000s,
When you open a website like, say, Wikipedia, PHP brings all the digital nuts and bolts together so you can actually see the website.
Millions of websites use it, including the content management systems WordPress and Drupal, the work messaging service Slack and the bulk of news outlets, shopping sites and government web portals.
This is why any hole, big or small, in the code is a big deal, says Chris Yule, senior director of threat research at the security software company Sophos.
‘It’s like if every house in town bought the same lock for their front door, and then it turned out the lock was faulty and anyone with the right knowledge could open it,’ he says.
PHP is growing unpopular, though, according to Shodan, which tracks what tech companies use, as website providers turn to sturdier codes.
What is the PHP vulnerability?
There were two, and neither has a catchy name: CVE-2026-109618, which made PHP’s memory handling shoddy and CVE-2026-109619, an error that made the software confuse its requests.
Together, the flaws could let anyone run dodgy code, malware, on a server without even logging in to steal data or deface sites. Cyber pros are calling the pair ‘PHP2Shell’.
Calif, an American company that tests state-of-the-art AI models to see if they can identify cyberattacks, discovered the bugs.
OpenAI, which is behind ChatGPT, said in a blog post that the bugs are ‘one of the most impactful security issues in recent memory’.
Wiz, a Google-owned security company that also found the holes, described them as ‘severe’.
Cybersecurity researchers say they’ve spotted ’millions’ of hackers in the wild trying to jimmy open websites that haven’t updated yet.
The Internet Archive, a tech nonprofit, said it was ‘attacked’ yesterday but is now up and running again.
Which websites use PHP?
- WordPress
- Drupal
- Joomla
- Magento
- MediaWiki
- Roundcube
- phpMyAdmin
- Nextcloud
- Laravel
- Symfony
- WHMCS.
What websites were down due to PHP?
Quite a few websites and video games either scaled their services back or pulled the plug altogether.
Here are some of the major ones:
- Some ‘limited’ UK government services
- 4Chan
- Wikimedia, which is behind Wikipedia
- DeviantArt
- The Dutch Parliament
- Dutch football association KNVB
- The Dutch National Cyber Security Centre
- Port of Rotterdam
- Belgian foreign ministry websites
- Belgian primary school platform, Smartschool
- Finnish public web services
- French government web portals
- The French government
- OpenStreetMap’s wiki
- Umamusume: Pretty Derby
- Fur Affinity, an art community
- Pinboard, a bookmarking service
- Miraheze, a wiki hosting service.
Should we be worried?
Kind of – there’s a lot of ‘what ifs’ at the moment.
While the PHP update dropped yesterday afternoon, websites can be slow to adopt new patches, leaving some still unprotected.
And just because most websites use PHP doesn’t mean they’re all at risk.
‘You can’t catch this bug by browsing,’ says Shahak Shalev, global head of scam and AI research at the cyber firm Malwarebytes.
‘The danger is that attackers get to hide behind sites you already trust.’
The check-out page of a hacked shopping website, for example, could be edited to skim credit card information, Shalev adds.
But there’s still no definite proof these PHP holes have been exploited, sats Voldemaras Kadys, head of security and platform engineering at the digital media house, Mediatech.
‘There’s no reason to stop browsing or shopping online,’ Kadys says.
‘But users should still be extra cautious about suspicious messages because we don’t know what kind of data hackers may have stolen through this vulnerability, and from which websites.’
If it’s any reassurance, there’s not much a regular web surfer can do, says Julie Nicholson, director of cyber resilience at the IT company Advania UK.
‘There’s no need to panic and nothing to install yourself,’ she says. ‘The job sits with the organisations running the sites.’
Still, Nicholson says that big cyber moments like this one are good reminders to have unique passwords, use two-factor authentication and be wary of spam emails and texts.
Get in touch with our news team by emailing us at webnews@metro.co.uk.
For more stories like this, check our news page.