On October 21, 2026, a big chunk of the internet went dark. Wikipedia's supporting services, the Internet Archive, BBC pages, Nintendo, Duolingo, government websites across Germany, France, Belgium, Finland, and the Netherlands — all offline within hours.
The cause wasn't a single hack. It was two critical vulnerabilities in PHP itself, dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), carrying a severity score of 9.2 out of 10.
What PHP2Shell actually is
In plain words: a flaw in PHP that could let an attacker run malicious code on a web server without needing to log in. No password guessing, no phishing — just a crafted request, and the attacker potentially owns the server.
That's the nightmare scenario for server security, because PHP powers roughly 70% of websites with a known server-side language — WordPress, Drupal, Joomla, Laravel apps, and countless custom sites.
The vulnerabilities were discovered with the help of AI-assisted security research (reported by Wiz) — which tells you something about where both attack and defense are heading.
Why did so many sites go offline?
Here's the part most headlines skip: most of those sites weren't hacked. They were taken offline deliberately by their own operators as a precaution.
When a 9.2-severity unauthenticated RCE drops, responsible teams do exactly what Wikimedia, Orange, and those governments did — pull the plug first, patch, then come back. An offline site is embarrassing for a day. A compromised server is a catastrophe for months.
Cloudflare and Amazon reported millions of exploit attempts within days. The precaution was justified.
How to protect your PHP site (do this today)
1. Update PHP to a patched version. The PHP team released emergency fixes on October 21:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
If your host lets you pick the PHP version (Hostinger, cPanel, etc.), switch to the patched release in your series right now. A patch release (8.3.35 → 8.3.36) carries effectively zero breakage risk — it's security fixes only.
2. Don't wait for your host. Some shared hosts roll out patches fast; others don't. Check your actual running version — if your host hasn't patched yet, ask their support directly.
3. Check for signs of compromise. If your site was running an unpatched PHP version between disclosure and patching, look for unfamiliar files, new admin users, or unexpected outbound traffic. When in doubt, restore from a known-clean backup and rotate secrets.
4. Backups before patches. Always. A full backup before any PHP version change takes five minutes and saves you from the one time something goes sideways.
5. Laravel/WordPress-specific: keep your framework and CMS core updated too. The PHP fix closes the language-level hole, but outdated plugins and packages are still the most common way PHP sites actually get breached.
The bigger lesson
PHP2Shell is a reminder of something the industry keeps relearning: the most dangerous vulnerabilities aren't in your code — they're in the layers underneath it. You can write perfect Laravel code and still get owned by the runtime.
That doesn't mean panic. It means process: patch fast, monitor, back up, and treat “it works, don't touch it” as the risk it is.
I run a Laravel + PHP shop and patched everything the same day. If you need a second pair of eyes on your server setup, get in touch.