Website blackouts: 5 reasons the PHP2Shell bug is your problem, too

TWO major flaws have emerged in PHP, the scripting language behind much of the web. 

Upon its discovery – by AI, no less – the incident forced hundreds of sites offline this week. 

Dubbed PHP2Shell, both are rated 9.2 out of 10 for severity. It's serious enough that both the FBI and the US National Security Agency issued emergency warnings.

Tech media pointed to "serious vulnerabilities", though emergency patches are now on the way, as per Techzine Global.

Wired explained that the pair of critical, remote-code execution vulnerabilities in PHP — collectively dubbed by security researchers (including Google-owned Wiz) as PHP2Shell — sit in “core memory management” and “error-handling” parts of PHP.

Nearly every web request touches PHP2Shell. 

If left unpatched, they open doors for hackers and cyber-thieves, Wired warns.

For one, they allow unauthenticated attackers to execute arbitrary code.

Worse, the gap would allow them to read sensitive server memory (such as passwords, API keys, and auth tokens) – and even gain a direct path to the file system or database.

This has set the tech world bonkers, sparking a global emergency and mass scrambling to patch or take down millions of websites. 

• Date discovered: PHP announced the security release on October 20 and shipped fixes on October 21, after details leaked early. 

• Severity & Score: Both flaws were rated a critical 9.2 out of 10 on the Common Vulnerability Scoring System (CVSS).

• Discovery via AI: The flaws were uncovered using artificial intelligence tools—specifically Wiz Atlas alongside models like Google Gemini and OpenAI's GPT—marking one of the first times AI-uncovered software flaws caused a massive, worldwide infrastructure scramble. (Source: Wired)

• Why did sites go offline? Details leaked before the planned fix, so administrators shut sites down as a precaution until they could update. (Source: Huntress)

• What now? PHP released patched versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Site owners must install them. Users can’t fix it, but should watch for breach notices and use strong, unique passwords. (Source: Qualys)

Here are the 5 reasons ordinary internet users are affected:

PHP is a programming language that quietly runs a huge share of the websites you visit. Some reports estimate it powers around 70% of the internet. It works behind the scenes, so most people never see it. But it’s there when you shop online, post in a forum, or log into a government portal.

Popular website-building tools like WordPress, Drupal, Magento, Joomla and Laravel are all built on PHP. Think of PHP as the engine and these tools as the cars built around it. If the engine has a known defect, every car using that version is at risk.

That’s the concern here: a website running an outdated or flawed version of PHP could be vulnerable to attackers, even if its owner did everything else right.

You can’t fix this yourself, but you can use unique passwords, turn on two-factor authentication, and be cautious about sharing sensitive details with sites that seem neglected.

Normally, to break into a website’s server, an attacker would need a login. These PHP bugs skip that step. Anyone on the internet could, in theory, send the server a specially-crafted request and trick it into running the attacker’s own commands, without ever signing in. This is called “remote code execution,” and it’s one of the most serious kinds of security flaws.

The second risk is a data leak. A server keeps information it’s currently working with, such as passwords, in its temporary memory. One of these bugs could let attackers peek at that memory.

Both problems come from sloppy housekeeping inside PHP. One involves how it reacts when a server runs low on memory. The other involves how it handles leftover data from earlier requests, like a waiter forgetting to clear the previous customer’s order from the table.

For everyday users, the fix lies with website owners, who need to update PHP promptly.

When a serious security hole is found in software that much of the internet depends on, a patch isn’t always ready right away. Until it is, the safest short-term move for some organisations is to switch their services off.

That’s what happened here. In the Netherlands, DigiD (the national login system for government services) and MijnOverheid (a portal for personal government records) went offline. Nintendo and other companies pulled services too. Sites in France, Germany, Belgium, Finland and the Czech Republic were also taken down, many only as a precaution before a fix was available.

Even the NSA, the US signals intelligence agency, told organisations to update or disconnect. Think of it like a manufacturer recalling a car over a brake fault. Owners park the car until the repair is ready, because driving it is riskier than being inconvenienced.

For you, outages are annoying but a good sign: it means someone is protecting your data.

PHP shipped fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, yet experts fear millions of sites run ancient versions that likely cannot be updated. Support for PHP 8.1 and earlier has ended, though emergency backports exist for 7.4, 8.0 and 8.1.

One estimate counts more than 22 million exposed servers.

Normally, when researchers find a serious software flaw, they tell the maker privately. The maker builds a fix, and details are published only once the fix is ready. That gives defenders a head start.

Here, that plan broke down. Details leaked before the planned announcement, and “proof-of-concept exploits” (working demonstration code showing how to abuse the flaw) are now circulating. Anyone with bad intentions can copy and adapt them.

Reports about actual attacks currently disagree. 

Security firm watchTowr says attacks are already happening “in the wild,” meaning against real websites. CISA, the US cybersecurity agency, said it hadn’t seen any when it issued its alert. 

Both can be true: the situation moves quickly, and different groups see different things.

Think of it like a burglar’s lockpicking guide being posted online before the lock company has shipped a replacement. Until it’s clear nobody is using it, the sensible assumption is that someone is.

For website owners, that means updating PHP immediately. And Until that is settled, treat the risk as “live”. 

PHP sits beneath a huge share of websites, so one flaw touches banks, shops, schools and government portals alike. Unauthenticated code execution can mean stolen credentials, defaced pages or ransomware, while precautionary shutdowns show how a single bug can interrupt public services.

It also shows AI speeding up both bug discovery and attack timelines. Because many operators patch slowly, exposure can outlast the headlines and leave users vulnerable far longer.

Expect continued patching and scanning as attackers probe unpatched servers. Operators should update to the fixed versions, apply temporary mitigations if they can’t, and retire unsupported PHP.

Watch for advisories, confirmation of active exploitation, breach disclosures from affected sites, and debate over coordinated disclosure after the leak. Hosts and security vendors roll out server-level protections for customers unable to patch.

You can’t patch PHP yourself, so focus on what you control.

Expect some sites to be briefly unavailable, and be wary of phishing that exploits the news.

Change passwords on important accounts, especially if a site you use announces a breach.

Enable two-factor authentication, and check statements for odd activity.

A password manager also helps. Site owners should use the fixed versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or ask their host about protections, and not rely on configuration changes alone, according to Wired.