PHP2Shell: What Happened and Which Sites Were at Risk?

If you own a website, no doubt you’ve read or heard some of the alarming headlines over the past 24 hours. Critical security vulnerabilities, millions of websites potentially exposed, emergency patches and organisations taking their websites offline.

All because of something called PHP.

And if you’ve never heard of PHP, you certainly won’t be the only one. Plenty of people who own and operate websites have no idea what it is, despite depending on it every day.

So, what exactly happened, how serious was it, and what does the response tell us about how well businesses understand and manage their websites?

First, what is PHP and why does it matter?

PHP is a programming language that works behind the scenes on websites. It handles tasks such as retrieving information from databases, processing forms, managing user accounts and generating web pages.

Visitors don’t normally see PHP working, but millions of websites depend on it.

According to W3Techs, PHP is used by approximately 70% of websites whose server-side programming language can be identified.

Although PHP is closely associated with WordPress, it is by no means exclusive to it.

Which website platforms use PHP?

WordPress is probably the best-known PHP-based platform, but many others use the same programming language.

• WordPress: Business websites, blogs, news websites and online shops.
• Drupal: Government, corporate and institutional websites.
• Joomla: Business websites, community organisations and online publications.
• Magento and Adobe Commerce: Online retail and e-commerce.
• WooCommerce: Online shops built using WordPress.
• Moodle: Educational websites and online learning platforms.
• MediaWiki: Collaborative information websites, including Wikipedia.
• PrestaShop: Online shopping platforms.
• Laravel: A PHP framework used to build custom websites and applications.
• Nextcloud: File sharing and online collaboration services.

PHP is also used in countless custom-built websites, booking systems, customer portals and internal business applications.

Not every website uses PHP. Other websites are built using technologies such as Python, JavaScript, Ruby, Java and .NET.

Nevertheless, the sheer number of websites relying on PHP means a serious vulnerability in the language itself can have consequences far beyond any single website platform.

What did artificial intelligence discover?

Security researchers using artificial intelligence identified two critical vulnerabilities in PHP, collectively referred to as PHP2Shell.

The vulnerabilities were assigned the identifiers CVE-2026-109618 and CVE-2026-109619, each receiving a critical severity score of 9.2 out of 10.

Both involved weaknesses in the way PHP manages computer memory.

Put simply, under certain circumstances, PHP could incorrectly handle information stored in memory, potentially allowing an attacker to access information or interfere with the way the software operates.

The underlying weaknesses had existed for years, but AI-assisted research helped investigators establish how they could be exploited.

Researchers demonstrated successful exploitation against affected installations of WordPress, Drupal and Joomla without needing an administrator’s username or password.

That is an important distinction. These were vulnerabilities in PHP itself, rather than weaknesses confined to a particular WordPress plugin, theme or content management system.

A fully updated WordPress website could therefore still have been exposed if the PHP software running on its server remained vulnerable.

What could hackers have exploited?

The potential consequences were serious.

Depending on the configuration of the affected server and the permissions available, successful exploitation could have allowed attackers to:

• Execute malicious commands on a vulnerable server.
• Access sensitive information held in server memory.
• Obtain passwords, authentication tokens or other confidential data.
• Access website files or databases.
• Alter website content or insert malicious links.
• Install malicious software or establish persistent access.
• Disrupt websites and associated online services.

Some attacks could potentially be attempted remotely without requiring a valid website login.

However, these are possible consequences of successful exploitation. They do not establish that every vulnerable website suffered an attack or that all these outcomes occurred.

How many websites were actually hacked?

This is where some of the reporting needs careful interpretation.

Security researchers identified potentially exposed systems on a very large scale. Palo Alto Networks reported more than 22.6 million exposed instances that could potentially be vulnerable.

That figure does not mean 22.6 million websites were hacked.

There are three different situations to distinguish:

• A vulnerable website: A website running affected software that could potentially be exploited.
• An attempted attack: Somebody tries to exploit the vulnerability, but the attempt may or may not succeed.
• A successful compromise: An attacker exploits the vulnerability and gains unauthorised access or achieves another malicious objective.

Security companies, including Cloudflare and Patchstack, reported early exploitation activity following the disclosure.

However, as of 21 October 2026, there was no independently verified worldwide total of websites successfully compromised through PHP2Shell.

It would therefore be inaccurate to suggest that millions of websites had been hacked, just as it would be premature to conclude that no successful attacks had occurred.

Why did organisations take their websites offline?

Following the disclosure, reports emerged of websites and online services being temporarily taken offline as a precaution.

These included government services, public-sector organisations and commercial websites.

The UK’s National Cyber Security Centre issued an urgent advisory recommending that affected organisations apply the security patches and consider taking vulnerable services offline where immediate remediation was not possible.

Temporarily shutting down an affected service can be a sensible precaution when a serious vulnerability has been identified but cannot immediately be fixed.

However, simply displaying a maintenance page does not necessarily protect a website.

If the vulnerable PHP application remains accessible behind that page, an attacker may still be able to reach it.

Properly disabling access to the affected application, restricting access at server or network level, or shutting down the vulnerable service can prevent attacks through that route while the system is offline.

Taking a website offline does not, however, reverse an earlier compromise or protect other vulnerable services that remain accessible.

How many companies took their websites offline?

Reports indicated that hundreds of websites and online services were temporarily taken offline, although no independently verified worldwide total of affected organisations was available.

Some reported disruptions involved Dutch government services, including the House of Representatives and DigiD, alongside commercial and public-sector websites.

It is important to distinguish between the number of websites affected and the number of companies involved.

A single organisation might operate numerous websites, while another might deliver several online services through one website.

Nor does taking a website offline establish that it was compromised. In many cases, shutdowns were precautionary measures intended to reduce the risk of an attack.

Did taking websites offline prevent attacks?

Where vulnerable applications were genuinely made inaccessible to potential attackers, taking them offline could prevent exploitation through those exposed services.

But the effectiveness of that action depended on how the shutdown was implemented.

For example, a website displaying a maintenance notice while continuing to process requests through vulnerable PHP software might remain exposed.

By contrast, a website whose vulnerable application was completely inaccessible from the internet would not be exposed to attacks through that public route during the shutdown.

Once the relevant patches had been installed and tested, services could be restored.

Of course, a website remaining online throughout the incident did not necessarily mean it was vulnerable. Its hosting provider might already have applied the necessary fixes or confirmed that its configuration was not affected.

What does this incident reveal about businesses and their websites?

The number of websites temporarily taken offline raises an interesting question about how well organisations understand the technology they rely upon.

Many businesses know which content management system their website uses, particularly if it is WordPress, but may have little knowledge of the underlying server software.

They may not know which PHP version is installed, whether it is supported or who is responsible for applying security patches.

That is not necessarily surprising. Businesses frequently outsource website development, hosting and maintenance to specialist providers.

The difficulty arises when responsibilities are unclear, systems become outdated or organisations assume that somebody else is managing security.

Yet the shutdown figures alone cannot establish how knowledgeable or competent those organisations are.

Consider two businesses.

The first identifies that its website could be vulnerable, temporarily restricts access, installs the necessary security updates and restores normal service.

The second keeps its website running, but nobody checks whether the underlying PHP software is affected.

From the outside, the first business appears to have suffered disruption while the second continues operating normally.

In reality, the first may have demonstrated considerably better security management.

A website being taken offline does not necessarily indicate poor management, and a website remaining online does not automatically mean it is secure.

What about websites running outdated PHP versions?

One of the more significant concerns arising from PHP2Shell is the number of websites and applications still running older PHP versions.

Official security fixes were released on 21 October 2026 for supported PHP branches, while some hosting and operating system providers may distribute their own security-patched versions.

Older PHP installations can be particularly difficult to maintain where websites depend on outdated plugins, themes or custom applications that are incompatible with newer software.

Organisations may consequently delay upgrades because they fear disrupting essential services.

That can leave systems dependent on software that no longer receives routine security support.

Ultimately, the number of websites taken offline during the initial emergency may tell us relatively little about the quality of website management.

A more meaningful measure will be how many vulnerable systems remain unpatched after the fixes have become available, how long organisations take to respond and how many successful compromises could have been prevented.