October 2026 proved to be quite a rollercoaster for cybersecurity professionals. Multiple zero-days and vulnerabilities surfaced simultaneously, but none captured industry headlines quite like the flaws uncovered in PHP, collectively dubbed “php2shell.”
PHP remains one of the oldest and most critical pillars supporting the modern web. According to the BBC, industry estimates show that roughly 70% of all websites still rely on PHP today, meaning vulnerabilities like php2shell are no laughing matter.
How PHP Became the Backbone of the Web
Created in 1995, PHP was originally built to work alongside HTML to power dynamic web applications. Over the years, it evolved into a versatile general-purpose scripting language.
In modern web architecture, PHP acts as the primary bridge between the browser and the web server. As a back-end language, it processes requests, tells the server what data to fetch or calculate, and sends the rendered output back to the user’s browser or application.
To illustrate how this works, the BBC compared back-end languages to restaurant waitstaff: the web server is the kitchen chef preparing your order, while the language acts as the waiter who takes your specific request, relays it to the kitchen, and delivers the finished dish back to your table.
While countless modern languages and runtimes have emerged over the last three decades to challenge it, PHP remains dominant. Its gentle learning curve, continuous modernization, and massive global community, which guarantees extensive documentation and ecosystem support, keep it firmly anchored as a cornerstone of the back-end web.
What Happened to PHP in October 2026?
Earlier this year, researchers from two independent cybersecurity firms — Calif and Wiz (the latter being an Alphabet subsidiary) — separately identified severe security flaws in PHP, with the initial discoveries taking place back in August.
PHP core maintainers were notified privately under coordinated disclosure, giving the team sufficient runway to engineer and validate patches. During the investigation, researchers determined that the flaws impacted multiple versions of PHP stretching as far back as 2012, effectively touching almost every production deployment on the web.
On October 20, both Calif and Wiz coordinated the public disclosure of the vulnerability. Notably, both teams revealed that artificial intelligence models—specifically tools powered by OpenAI—played a direct role in uncovering the underlying exploit vectors.
Wiz researchers coined the term “php2shell,” highlighting the flaw’s ability to achieve remote shellcode execution (malicious, executable code injected and run on a target server without the host's consent and/or knowledge).
On the Common Vulnerability Scoring System (CVSS), which rates vulnerability severity on a scale from 0 to 10, the PHP core team assigned the issue a critical score of 9.2, while cybersecurity firm watchTowr designated it a maximum 10.0, underscoring the severity of the threat.
Who Was Impacted?
While estimates suggest around 70% of the web felt the ripple effects, several high-profile targets illustrated the scope of the incident:
Government Portals: According to Reuters, several national government websites across Europe,including France, Denmark, the Netherlands, and Finland,briefly went offline to apply security patches immediately after PHP developers released updates on October 21, as did Brazil.
Wikimedia Foundation: High-traffic informational pillars including Wikipedia, Wikimedia Commons, and adjacent Wikimedia infrastructure were also momentarily taken down, also according to Reuters.
Global CMS & E-Commerce Platforms: The vulnerability extended across major content management systems and e-commerce platforms, including WordPress, Drupal, Joomla, and Magento. All self-hosted instances running on these engines were exposed regardless of standard platform configurations.
Importantly, there is currently no evidence suggesting that threat actors actively weaponized the flaw against Wikimedia or the government portals mentioned above; the brief service interruptions were entirely precautionary downtime to deploy security patches.
Should You Be Worried?
It comes down to your web stack. If your website depends on PHP in any capacity, yes—action is required. You should update your PHP runtime immediately, even if it requires scheduled maintenance downtime.
Here is how you should handle your environment:
Managed WordPress (Automattic/WordPress.com): If your site is hosted on Automattic’s fully managed infrastructure, updates were deployed upstream automatically, requiring no direct action on your part.
Self-Hosted WordPress (or third-party hosts): If you run WordPress via custom servers, VPS, or standard shared hosting, you must verify that your host has patched the underlying PHP runtime. Simply running the WordPress CMS dashboard update is not enough to patch the host server's PHP engine.
HubSpot Customers: If you are an EPIC client, there is a strong chance your website runs on HubSpot CMS. In this case, you are safe: HubSpot’s proprietary infrastructure does not run on PHP, leaving sites built on its platform unaffected by default.
Regardless of which CMS or provider you use, take this opportunity to audit third-party integrations, microservices, and connected web apps to ensure no secondary PHP dependencies are running unpatched.