Skip to main content

The internet is freaking out over a global PHP security crisis.

A major flaw found in the PHP coding language that powers an untold number of websites across the internet has seen scores of sites taken offline as they attempt to patch out the severe vulnerability.

If you've found your favorite website has been unavailable over the last few days, there's a chance it's related to this security incident.

Here, I have put together a list of as many affected websites as we can find, along with reasoning given by the sites where possible.

India

The India-specific exposure figure makes the issue more than a routine software update. The report identifies over 50,000 facing assets running PHP in the country, with 159 belonging to government entities. These figures indicate the scale of the digital footprint that may need to be examined. These are potential exposure figures, not confirmed hacks. For security reasons, I cannot disclose the names of the affected websites, as they are currently undergoing security patching.

CERT-In, India's cyber security agency, issued a warning advising organizations to update vulnerable PHP installations.


Global sites (USA based)

  1. Wikimedia / Wikipedia
    The Wikimedia Foundation said it had taken some services offline to patch the PHP security vulnerability.
    The group runs popular websites like Wikipedia and said in a blog post that "You may see outages for our wikis as we work on this, and we have deliberately taken many of our supporting services offline until they can be safely patched."
  2. Internet Archive
    The Internet Archive, which backs up pages across the internet, was offline on October 21. The organization posted on X to say that "Archive.org is currently offline. We are working to restore service now," although this was not definitively linked to the PHP incident.
  3. Orange Telecom
    The telecommunications giant Orange has announced thats it's "temporarily" suspended access to several of its websites and apps that use PHP.
    That move affects dozens of countries, mostly in Europe but also Africa and the Middle East. Orange called it a "precautionary" measure and that each country would communicate which sites have been affected locally. 

UK sites

A UK minister has revealed that 32 government services are currently offline due to the PHP security threat, while a spokesperson added: "Our work has begun with OpenAI and NCSC to fix vulnerabilities in government systems".

Europe

  • Belgium: The Foreign Ministry
  • Czechia: The national government website
  • Denmark: Municipal IT company Kombit
  • Finland: Public government service websites
  • France: Local government (prefecture) websites run by the Interior Ministry
  • Germany: The federal IT service provider ITZBund
  • Netherlands: The National Cyber Security Centre
  • Netherlands: The Port of Rotterdam
  • Netherlands: Government website Overheid.nl
  • Netherlands: National football association KNVB
  • Netherlands: The websites of the five largest political parties
  • Netherlands: The websites of many national hospitals.

Technical overview: what php2shell actually breaks?

Unauthenticated RCE on the PHP web runtime

The latest critical PHP vulnerabilities, collectively tracked as php2shell, allow unauthenticated remote code execution (RCE) and memory corruption across web servers running PHP. "Unauthenticated" means the attacker does not need a valid application session, WordPress cookie or admin password for the serious cases described by the PHP security team and major cloud vendors.

Affected web-serving installations include common SAPIs and stacks such as:

  • Apache with mod_php (called out as highest risk in PHP's guidance)
  • PHP-FPM behind Nginx or Apache
  • php-cgi
  • FrankenPHP
  • LiteSpeed PHP handlers

On the highest-risk paths, a mal

Which PHP versions are safe?

As of the 21 October 2026 emergency release, move to one of these fixed versions (or newer on the same line):

  • PHP 8.5.12
  • PHP 8.4.27
  • PHP 8.3.36
  • PHP 8.2.35

How to check your website in 2 minutes

  1. Log in to WordPress admin.
  2. Go to Tools → Site Health → Info → Server.
  3. Find PHP version (and note the SAPI if shown: fpm-fcgi, apache2handler, and so on).
  4. Compare it with the safe list above.

How to fix it (step by step)

Option A: You use shared or managed WordPress hosting

  1. Open a support ticket today.
  2. Ask: "Are we on PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or your patched package for php2shell / CVE-2026-109618 and CVE-2026-109619)?"
  3. Ask them to confirm the version after restart.
  4. If they mention only a firewall (WAF), thank them then still insist on the PHP upgrade. A firewall is temporary cover, not the full fix.
  5. When they reply, re-check Site Health yourself.

Option B: You or your developer manage a VPS / cloud server

  1. Upgrade PHP packages to a fixed release from your OS vendor or trusted PHP packages.
  2. Restart PHP-FPM / Apache / LiteSpeed workers so old processes die.
  3. Verify the live web PHP version (not only php -v on CLI).
  4. Smoke-test the homepage, login, forms and checkout.
  5. If you use Docker or Kubernetes, rebuild and redeploy images do not assume old containers updated themselves.

Option C: You cannot patch immediately

  1. Prioritise any site open to the public internet.
  2. Keep host/WAF protections on.
  3. If you are stuck on very old PHP and cannot upgrade today, seriously consider taking that site offline until it is fixed that is the advice several cyber agencies are repeating.
  4. Technical teams may also apply vendor-documented compensating controls (WAF body limits, disabling risky ini features, more aggressive worker recycling). Treat every one of those as partial. Patch remains mandatory.  
Labels:

Popular posts from this blog

Instagram Security Risk

Recently, attackers took over high-profile Instagram accounts, including the official Obama’s White House account and a United States Space Force chief officer. The attacker didn't break any Instagram code or crack passwords. They convinced Meta's own AI support chatbot to hand over the accounts. Meta uses an AI-powered support chatbot to help users recover locked accounts, change recovery emails, and handle account issues. The chatbot is trained to verify identity through questions and decide whether a request looks legitimate. Attackers figured out how to manipulate that decision making process. Video Credit-  x.com/chetaslua The attack consists of four main steps. Step 1: The attacker contacts Meta's AI support chatbot claiming to be the legitimate owner of a target account. They simply use Instagram's help interface and start an account recovery conversation. For high-profile targets, attackers use publicly available information such as display names, profile bios, ...
Read more

LinkedIn Rolls Out AI Slop Reporting button

                                         LinkedIn is trying to get a handle on the massive amounts of AI slop on the platform. To do that, the company is testing a new reporting tool that let users flag potential slop and removing the "rewrite with AI" button it once promoted on every post. With the new reporting tool, users will have the ability to flag posts as "seems like AI slop." Doing so will "privately flag" via the site's analytics dashboard that others "feel your post may have come off as inauthentic or heavy use of AI," LinkedIn's Chief Product Officer Hari Srinivasan wrote in an update. The move follows an earlier update that aimed to reduce the reach of AI-generated posts on the platform. The company has since done further work to improve its detection systems, Srinivasan said, which should lead to people seeing fewer AI-generated posts recommended in their feeds. Pos...
Read more

A Simple PDF Tool Outpaced Giants by doing the basics faster, cleaner, and better than anyone else.

  I am going to break down the story of a tool that I'm willing to bet you've used, but whose incredible business journey you probably know nothing about. Honestly, this is a master class for any founder looking to build something valuable from scratch. I am calling it the Bootstrapper’s Playbook. A Wild Reality Check Let’s just start with a wild fact. There's a website out there, a deceptively simple one, that in places like India pulls in more traffic than Amazon. I'm serious. Millions and millions of people rely on it every single day. Any guesses? It's iLovePDF. If you've ever needed to quickly merge, split, or compress a PDF file, you've almost definitely landed on this site. But what most people have no idea about is how this massive global platform was built. And that is where the real story begins. Born from Frustration So, let's go all the way back to the beginning. Because this whole thing wasn't born from some grand business plan or a fanc...
Read more