The PHP Security Threat Explained | Why Are Websites Going Down?

Government websites, online services and even parts of the BBC have been taken offline following the discovery of two critical PHP security vulnerabilities. But have websites actually been hacked? And what should your business be doing about it?

In this article:

What is PHP?
What is the PHP security vulnerability?
Which websites have gone offline?
Have any websites actually been hacked?
How many websites could be affected?
What are businesses doing about it?
How First Internet is responding
Why website maintenance matters
The importance of website support retainers
What does this mean for WordPress websites?
What should you do if your website is affected?

This is a fast moving news story, information is accurate as of publishing | 22 October 2026

If you’ve noticed some familiar websites suddenly disappearing this week, you’re not imagining things. From government services to major online platforms, websites across the world have been taken offline following the discovery of a serious security vulnerability.

And while the headlines might sound a little alarming, there’s a lot more to the story than websites simply being hacked.

The issue centres around PHP, a programming language that powers a huge proportion of the internet. Two newly discovered vulnerabilities, collectively known as PHP2Shell, have prompted emergency security updates and left development teams working around the clock to keep websites protected.

Here at First Internet, our own developers have been working late into the night helping clients navigate the situation. So, what’s actually happened, which websites have been affected and what does it mean for your business?

Let’s break it down.

First things first, what is PHP?

Unless you work in web development, PHP probably isn’t something you spend much time thinking about. And why would you? You just want your website to work!

PHP stands for PHP: Hypertext Preprocessor. It’s a programming language that helps websites function behind the scenes, powering everything from contact forms and online shopping baskets to booking systems, customer accounts and all those other clever features that make websites more than just a collection of pretty pages.

It’s also a core part of popular website platforms such as WordPress, Drupal and Joomla. And it’s everywhere. According to W3Techs, as of 22 October 2026, 69.3% of websites with an identifiable server-side programming language use PHP.

That’s a pretty substantial chunk of the internet. So, when a major security vulnerability is discovered in PHP, you can imagine why website developers start paying attention.

What exactly is the PHP2Shell vulnerability?

On 21 October 2026, the PHP development team released emergency security updates to address two critical flaws:

CVE-2026-109618: A vulnerability involving how PHP handles certain memory errors.
CVE-2026-109619: A vulnerability involving internal data remaining accessible after its memory has been released.

Both have received a critical severity score of 9.2 out of 10. But what does that actually mean for your website?

Essentially, the vulnerabilities could allow someone to send specially crafted requests to an affected website and potentially trick its server into running malicious code. In cybersecurity, that’s called remote code execution, and it’s particularly concerning because an attacker may not need a username or password to attempt it.

Depending on the server and its permissions, successful exploitation could potentially allow hackers to access sensitive data, interfere with website files, install malicious software or disrupt services. The vulnerabilities were discovered with the help of advanced artificial intelligence tools, demonstrating how AI is changing the way security weaknesses are identified.

According to the official PHP security advisory, affected organisations should update immediately. There isn’t a complete alternative workaround that provides the same protection.

Not sure whether your website is vulnerable? Our web development team can help you understand your setup and identify what needs updating.

Which websites have actually gone offline?

This is where the story gets particularly interesting. According to BBC News, organisations around the world have been responding to the vulnerabilities by temporarily disabling websites and online services.

Finnish government websites

Finland temporarily shut down government public web services in response to the security threat. Rather than leave potentially vulnerable systems exposed, authorities took preventative action while the situation was addressed.

Government services in the Netherlands

The Netherlands’ national cybersecurity agency confirmed it was taking its own website offline. Other Dutch public sector websites, including the National Institute for Public Health and the Environment, were also reported to have become unavailable.

Wikipedia and Wikimedia services

The Wikimedia Foundation confirmed that it had temporarily taken down several systems while applying security updates. This resulted in some users being unable to access parts of Wikipedia on Wednesday 21 October.

Edinburgh Council and BBC programme websites

Edinburgh Council’s website and pages associated with popular BBC programmes, including Doctor Who and The Traitors, were reported as inaccessible during the incident. However, an important point: the BBC had not confirmed that these particular outages were directly caused by the PHP vulnerabilities.

While the incident has clearly caused genuine disruption, not every website outage can automatically be attributed to PHP2Shell. And there’s another important distinction worth making: a website being taken offline doesn’t necessarily mean it has been hacked. In several reported cases, organisations deliberately shut down services as a security precaution.

Have any websites actually been hacked?

Here’s where things have developed since the initial announcement. Hackers have been actively attempting to exploit the PHP vulnerabilities, but confirmed attack attempts aren’t the same as confirmed successful breaches of real-world websites.

According to Amazon Web Services (AWS), its threat intelligence team detected an exploitation attempt dating back to 17 October 2026. That’s four days before the emergency security updates were officially released.

The attempt was identified through AWS’s security monitoring systems, which include deliberately vulnerable test environments designed to detect malicious activity. Further exploitation attempts were observed on 21 October, with different attack methods and sources suggesting multiple actors were involved.

AWS has warned that PHP2Shell is now being widely exploited in real-world attack activity. That’s understandably worrying, but AWS also noted that it wasn’t clear whether the attacks it observed would have succeeded against real production systems.

As of 22 October, there isn’t a reliable, verified global figure showing how many public websites have actually been compromised through PHP2Shell. We know hackers are trying to take advantage of the vulnerabilities, and we know organisations have been taking websites offline to protect themselves. But we shouldn’t assume that every affected website has been successfully attacked or that customer data has been stolen.

The important thing is to act quickly, rather than waiting for a confirmed breach.

How many websites could be affected?

You’ve probably seen headlines suggesting that around 70% of the internet could be affected. That’s a pretty terrifying statistic at first glance, but there’s a little more to it.

The figure comes from the widespread use of PHP, which powers approximately 69.3% of websites whose server-side programming language can be identified, according to W3Techs. It does not mean that 70% of websites have been hacked, or even that 70% are currently vulnerable.

A website’s exposure depends on factors including its PHP version, whether security patches have been installed and how the server is configured. What the figure does demonstrate is just how widely PHP is used and why a security vulnerability in such a fundamental technology can have consequences across so many industries.

From small business websites and online shops to government portals and major international platforms, there’s a lot potentially at stake.

What are businesses doing about the PHP vulnerability?

Right now, website developers, hosting providers and cybersecurity teams are focusing on a few key priorities.

Identifying vulnerable websites

Organisations are checking which websites and applications use PHP, what versions they’re running and whether their server environments are affected.

Installing emergency security updates

The PHP project released the following patched versions on 21 October:

PHP version	Patched release
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35

Websites running older unsupported PHP versions require particular attention because these versions no longer receive normal security updates.

Checking for evidence of an attack

Because exploitation attempts have already been detected, developers are also reviewing suspicious activity, server logs and potential signs of compromise. Simply updating a website doesn’t automatically tell you whether somebody tried to exploit it beforehand.

Taking websites offline when necessary

For websites that can’t immediately be secured, temporarily restricting access may be the safest option. Not great for business, we know, but sometimes a short period of planned downtime is preferable to exposing sensitive systems to a serious security threat.

Hosting and infrastructure providers are also introducing additional protections to help reduce the risks. For example, Cloudflare has deployed web application firewall rules designed to help block exploitation attempts. However, these extra protections don’t replace the need for the official PHP updates.

Is your website running an affected version of PHP? If you’re unsure, it’s worth getting it checked. Our proactive website maintenance team can help businesses stay on top of essential updates, security checks and ongoing technical maintenance.

Behind the scenes: Our developers have been working late into the night

When incidents like this hit the headlines, it’s easy to focus on which websites have gone offline. But what you don’t always see is the work happening behind the scenes.

For website developers, critical security vulnerabilities aren’t exactly something you can ignore until next week’s to-do list. And our team at First Internet knows that better than most.

Over the past 48 hours, our developers have been working late into the night responding to the PHP vulnerabilities and helping protect the websites our clients rely on. Because behind every website is a business. There are customers trying to place orders, enquiries waiting to come through and important services that need to stay available.

Responding properly means understanding which environments may be affected, reviewing the relevant updates, making necessary technical changes and ensuring websites continue to function as expected. It’s not always a straightforward process, either. Changing PHP versions can introduce compatibility issues, particularly on websites with older code or complex functionality.

Alongside addressing security risks, developers also need to make sure important features don’t unexpectedly stop working. It’s the kind of careful technical work that most website visitors will never see, and that’s exactly the point.

When everything is running smoothly, the work happening behind the scenes can be easy to overlook. But we’re incredibly proud of the dedication our developers have shown, putting in those extra hours when our clients need them most.

Why this highlights the importance of ongoing website maintenance

Here’s something worth thinking about. If a critical security vulnerability affected your website tomorrow, would you know who to call? Would you even know which version of PHP your website is running?

For plenty of business owners, the answer is probably no. And that’s understandable. You’ve got a business to run!

But that’s also why ongoing website maintenance is so important. A website shouldn’t be treated as something you build once and then forget about. Software changes, new vulnerabilities emerge and technologies that were perfectly secure when your website launched can require attention years later.

At First Internet, our proactive website maintenance services are designed to help businesses stay ahead of those changes. That means keeping on top of updates, monitoring website performance, identifying technical issues and making sure somebody is responsible for the ongoing health of your website.

No maintenance plan can promise you’ll never experience a problem, but having regular checks and an experienced team supporting your website can make responding to an unexpected security incident much more manageable. And as PHP2Shell has demonstrated, those incidents don’t always arrive at a convenient time.

Why having a website support retainer really matters

Imagine discovering that your website needs an urgent security update. But you don’t have a development team, your original developer is unavailable, you’re unsure who manages your hosting and you’re suddenly trying to find somebody who can help. Not exactly an ideal situation.

Now imagine you already have a trusted development partner who understands your website, knows how it’s built and can help you respond. That’s the value of an ongoing support relationship.

Our website support and development retainers give businesses access to ongoing technical expertise, website improvements and development support. Rather than starting from scratch every time something needs attention, you’ve got a team that already understands your website and its requirements.

And it’s not just about cybersecurity emergencies. Whether you need improvements to functionality, technical troubleshooting, performance optimisation or new website features, having consistent development support makes life a whole lot easier.

The PHP incident is a particularly good reminder that the value of website support isn’t always obvious until something unexpected happens.

Don’t wait until your website has a problem to think about support. Explore our website development retainers and see how having a dedicated technical team could benefit your business.

What does PHP2Shell mean for WordPress websites?

If your website runs on WordPress, this is definitely something worth paying attention to. WordPress is built using PHP, which means its functionality relies on the underlying PHP software installed on your web server.

And that creates an important distinction. PHP2Shell isn’t simply a vulnerability in WordPress itself. It’s a problem with PHP, the technology underneath it.

While updating your WordPress plugins, themes and core software is always good practice, those updates alone won’t necessarily address these PHP vulnerabilities. Your server’s PHP installation also needs to be checked and patched.

That’s why WordPress security goes beyond simply clicking the update button every now and then. Our WordPress agency in Manchester helps businesses with WordPress development, technical support and ongoing website improvements.

Whether you’re unsure about your current setup or need help maintaining your website properly, we’re here to help.

Worried your website has been affected? Here’s what to do

If all this has left you wondering whether your website is safe, there are a few practical steps you can take.

Contact your website developer or hosting provider. Ask whether your website uses an affected PHP version and whether the official security patches have been applied.
Check your PHP version. If you’re using an older unsupported version, discuss upgrading to a supported release.
Don’t rely on plugin updates alone. If you use WordPress or another PHP-based platform, the underlying server software needs attention too.
Ask about suspicious activity. Given the confirmed exploitation attempts, your technical team should consider reviewing relevant server activity from at least 17 October.
Put ongoing support in place. Make sure somebody is responsible for future security updates, maintenance and technical issues.

And if you don’t know where to begin, that’s absolutely fine. You don’t need to become a PHP expert overnight. You just need someone who understands what to look for.

The internet doesn’t stop at 5pm. Neither do security threats.

If there’s one thing the PHP2Shell incident has highlighted, it’s just how much businesses depend on the technology working quietly behind their websites. One vulnerability can trigger emergency updates, government warnings, temporary website shutdowns and a race against attackers.

But it’s also shown just how important the people looking after that technology really are. Our developers have been working late into the night helping clients respond to this latest threat. And while we hope the next major vulnerability is a long way off, the reality is that website security requires ongoing attention.

Great web development isn’t just about launching something that looks brilliant. It’s about having the right people and processes in place to look after it long after launch day.

Concerned about your website? Let’s chat.

Whether you’ve been affected by PHP2Shell, you’re unsure if your website is running the latest security updates or you’d simply like a more dependable team looking after your site, we’re here to help.

Our team can help you understand your website’s technical requirements and discuss the right next steps.

Get in touch with First Internet and let’s talk about keeping your website in good shape.

Sources and further reading

The information in this article reflects reporting available on 22 October 2026. As investigations continue, the number of confirmed incidents and the impact on individual organisations may change.

What’s Happening to Websites Around the World? The PHP Security Threat Explained