TLDR
- A flaw called PHP2Shell, found in the PHP programming language, was disclosed on Wednesday and affects versions released over the last decade.
- PHP powers about 70% of the world’s websites, according to Wiz.
- Cloudflare saw millions of exploit attempts after the announcement.
- The NSA, CISA and the UK’s NCSC urged fast patching, or taking systems offline if patching is not possible.
- CISA said it has not identified any successful attacks linked to the flaw.
A serious security flaw in the PHP programming language has led governments and companies around the world to act. The flaw, called PHP2Shell, was disclosed on Wednesday. Some organizations took their websites offline.
⚠️ALERT: Python warns unpatched apps could trust FAKE WEBSITES after 8 certificate keys were EXPOSED.
Attackers could intercept connections, including to Python's own sites, python(.)org and PyPI.
Each secret key was a number below 256, per Python core developer Christian… https://t.co/CThO6KTWQY pic.twitter.com/mNyVrtTe36
— Coin Bureau (@coinbureau) October 22, 2026
PHP is a back-end language that runs on web servers. Wiz says it powers 70% of the world’s websites, including Wikipedia and WordPress.
What the flaw does
Researchers at Wiz and Calif found two vulnerabilities inside PHP itself. Versions released over the last decade are affected.
Wiz said hackers could take control of affected web servers and steal data under the right conditions. Ryan Austin, a Calif researcher, said it was the most serious vulnerability he has found.
AI tools helped find the flaws. Wiz called them the most severe ever detected by AI. OpenAI, whose technology was used, called the find one of the most impactful security issues in recent memory.
Salil Kanhere of UNSW Sydney said the bugs were not new. He said the change was the ability to find them.
Details leaked online this week. That forced the PHP Foundation to rush out its announcement.
Cloudflare chief executive Matthew Prince said the company saw thousands of exploit attempts in the 10 hours before the announcement. He said that rose to tens of thousands within 45 minutes, hundreds of thousands within two hours, and millions since.
Amazon said it was targeted in multiple attempts days before the disclosure. It said its websites were operating as normal.
How governments and companies responded
The PHP Foundation released patches on Wednesday and urged all users to update right away. Experts say updating WordPress or its plugins does not fix the problem, because the flaws sit in PHP itself.
The US National Security Agency told organizations to take systems offline if they could not patch immediately. The UK’s National Cyber Security Centre gave similar advice and asked organizations to check for backdoors. CISA urged patching internet-facing apps first.
Sites went offline in several countries. The Finnish government, Edinburgh council, the BBC and the Dutch cyber-security agency took down pages. Wikimedia pulled some systems, as did the University of Geneva and several Scottish councils and health boards.
Japanese Prime Minister Sanae Takaichi asked people to check whether their public websites run on PHP. She said suspending sites can reduce risk if a patch cannot be applied quickly.
Security experts say the fix is hard for large companies. John Gallagher of Viakoo said the window of vulnerability could last several months. Many firms do not know where PHP runs in their systems.
Downtime also carries a cost. Some estimates put unplanned outages at large companies at up to $15,000 a minute. Jason Soroko of Sectigo said companies should also replace server passwords and certificates after patching.
Most everyday users do not need to act. Kanhere advised people to watch for password change requests from affected services and to be careful with phishing messages that use the news.
CISA said it has not identified any successful attacks linked to the flaw. Kanhere said more attempts are likely in the coming weeks now that the technical details are public.
Stop guessing and start investing with confidence. KnockoutStocks gives you the AI insights, market intelligence, and stock research you need to spot opportunities, cut through the noise, and make smarter investment decisions — all in one powerful platform.
Sign up today and get 50% OFF full access to our premium stock picks.
Simply use coupon code SPECIAL50 at checkout to claim your exclusive discount.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
