If you were on the internet today, you certainly saw the panic: a critical vulnerability threatens to compromise practically every website on the planet.

Finland began shutting down government websites on Wednesday, the NSA is recommending that all organisations using PHP take their sites offline, and the Netherlands and France did the same. And no, it was not a cyberwar.

The culprit was PHP, a programming language most people have never heard of. But you almost certainly used it today: it powers around 70% of all websites whose server-side language is known, according to W3Techs.

PHP is the software that runs behind the scenes on a website's server — the computer that stores the site and builds every page you request. Every WordPress site, for instance, is hosted on a PHP server, according to WordPress security firm Wordfence.

Incidentally, Wordfence itself is also offline.

Two recently discovered flaws in PHP itself let a stranger run their own commands on the server without needing to log in. Security experts call this unauthenticated remote code execution. For everyone else, it is as if someone else were "in control."

If that server stores your account, your address or your order history, well, that becomes theirs too. Hosting company GoDaddy warned that the flaws could let attackers steal data, deface websites or take full control of servers.

"A flaw like this could allow an attacker to run their own code on an internet-facing affected server, which could lead to data theft, website defacement or full takeover," GoDaddy said.

What PHP announced

The PHP Foundation, the non-profit that funds development of the language, issued the alert on Tuesday. In a statement shared on X, the PHP security team said: "The PHP security team is giving advance notice: the next security release will go out on Wednesday, 21 October 2026, at 14:00 UTC, fixing two critical vulnerabilities, both rated 9.2 on CVSSv4. PHP users are advised to prepare to update. The release will be brought forward if details become public or there is evidence of active exploitation."

The 9.2 rating comes from CVSS, the Common Vulnerability Scoring System, which rates how dangerous a vulnerability is based on factors such as how easily it can be exploited over the internet and the damage it can cause. The scale runs from 0 to 10, and anything above 9.0 is considered critical — so these two vulnerabilities are extremely severe, close to the maximum score of 10.

The fix was rolled out at around 13:35 UTC on Wednesday, a few minutes ahead of schedule, for PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The security advisory did not try to be subtle: "All PHP users are strongly encouraged to update immediately."

But shipping a fix and getting everyone to deploy it are not the same thing, so caution is advised.

How the bugs work

The first bug, CVE-2026-109618, occurs when PHP runs out of memory midway through processing a request and later treats that partially processed data as if it were complete. The second, CVE-2026-109619, allows leftover data from a visitor's request to remain in memory after it should have been discarded, which can cause problems on the next request.

Picture a cook who reads orders from slips that have already been thrown in the bin. Slip a fake order into the bin and the cook prepares whatever you wrote on it. In this case, the "order" is the attacker's code, and the server executes it.

PHP said the risk is greatest on servers using a common Apache configuration called mod_php, where a demonstrated vulnerability works "even before any application code runs." In other words, the site's own defences, such as login screens and WordPress security plugins, are never even triggered.

Researchers at the PHP Foundation pointed to PHP's upload progress feature, which tracks how much of a file has been uploaded, as one confirmed way in. It has been enabled by default for more than a decade, and few sites actually use it.

A leak, followed by attacks

None of this was supposed to be public yet. On Tuesday, someone posted on the Hacker News forum that two PHP flaws would be disclosed that Thursday, admitting they had "no evidence beyond 'source: trust me, bro.'"

It turned out the poster was right. Security firm watchTowr confirmed the bugs were real and under embargo — an agreement to keep details secret until a fix is ready — and PHP moved its release forward by a day.

"We're seeing initial attacks emerge and are updating mitigations as new vectors appear," wrote Dane Knecht, Cloudflare's CTO, on X on Wednesday morning, nearly six hours before the update's release. Cloudflare rolled out emergency firewall rules, filters that block known attack patterns, for all customers, but Knecht described them as "only a stopgap."

Governments shut things down

Finland's state IT centre, Valtori, began disabling public web services as a precaution, public broadcaster Yle reported, while the Dutch national cybersecurity agency took its own website offline.

France's Interior Ministry said prefecture websites had been "temporarily taken offline until a security update is released by the framework's publisher."

CERT-EU, the EU's cyber emergency response team, advised organisations that could not apply the update to "consider isolating internet-facing applications from public networks until a fix is available." In other words, "unplug everything." Agencies in Australia, Japan and the UK said much the same, according to Reuters.

What the viral posts got wrong

Viral threads on X claimed that PHP versions "dating back to 2004" were vulnerable. That stemmed from early estimates that everything since PHP 5 was affected, which CERT-EU admitted was based on social media posts.

E-commerce security firm Sansec says the issue affects versions from PHP 5.4 onward — so 2012, not 2004, though still a very old release.

PHP only ships official updates for versions 8.2 and later, which makes the claim that "there's no fix for old versions" only partly true. Given how severe this vulnerability is, its security team also published basic source-code patches for versions 7.4, 8.0 and 8.1, and Linux distributions are rolling out their own backported fixes.

Security firm Mallory counted roughly 884,000 internet-exposed hosting servers advertising PHP 8.1 or earlier on 20 October, representing 59% of the roughly 1.5 million that publicly display a version. A single shared hosting server can host many websites, so the number of sites behind them is even higher.

Some threads also dragged in Node.js, a different web technology that happened to schedule its own unrelated security update for the same day. Terrible timing.

Even patched versions will not reach every server at once. "If you rely on the volunteer-run repository https://rpms.remirepo.net, we recommend switching to your distribution's packages or compiling from source now, so you can apply the updates immediately. The repository will not have updates today," the PHP Foundation said in its statement, referring to a popular source of PHP packages for Red Hat-style Linux servers, maintained by volunteers.

Should you be worried?

You should not panic, but you should not ignore it either. A hacked website, for instance, does not need to touch a blockchain to empty your wallet. In 2024, attackers redirected the interfaces of the DeFi protocols Compound and Celer to pages that drained connected wallets, and Curve Finance suffered a similar attack in 2025.

Those were DNS hijacking attacks, not PHP bugs, but the trick is the same: the site looks right, the URL looks right, and the "approve" button sends your tokens somewhere else. A compromised server can display exactly that kind of page.

Hackers can be very creative and very fast when it comes to zero-day exploits.

Bugs like these are also becoming easier to find, with cutting-edge AI models increasingly used to hunt for software vulnerabilities, and experts told Decrypt in June that many more such vulnerabilities could surface as these tools spread.

What happens now, and what to do

Once a fix is published, attackers can compare the old and new code to see exactly what was patched, and the forensics team at cybersecurity firm Sansec said it expects "mass attacks to begin within 15 minutes of release." When a different PHP flaw was disclosed in June 2024, Akamai saw exploitation attempts against its honeypot servers within 24 hours.

So should the average person panic? Not exactly. Your phone, browser and laptop do not need a PHP patch; the work falls on whoever runs the sites you use.

If you run a website, ask your hosting provider whether PHP has been updated, and do not count on WordPress to do it for you: Wordfence warned that automatic updates will not apply this fix, and advised site owners to find out who is responsible for updating PHP on their servers. Anyone running version 8.1 or earlier needs to plan an upgrade.

"The only thing I can say is that the only fix is to patch/update PHP," said Gina Peter Banyard, a PHP core developer, on Mastodon. "Unfortunately, I know too much."

And if you are running PHP 8.2, the fix you just received is one of the last ones: that version reaches end of life on 31 December 2026, after which it will no longer receive security patches.

* Translated and edited with permission from Decrypt.

Your gateway to bitcoin, the world's largest cryptocurrency, is MB. It's simple, secure and transparent. Stop putting off an investment with huge potential. Invest in just a few clicks!