PHP-ocalypse: How two critical web bugs almost broke the internet
News Source
β’Sat, 24 Oct 2026 15:30:00 +0000
π° What Happened
Two serious bugs in PHP, the software that runs a large share of the web, forced companies around the world to take sites offline this week. Researchers named the flaws PHP2Shell. They let an attacker break into a server without a password.
The PHP Foundation released fixes on Wednesday. Banks, shops, hospitals, gaming sites and some government agencies shut down servers while they patched. So far there is no report of mass attacks.
π The Backstory
PHP has been used for decades to build websites and sits behind tools like WordPress. The flaws had gone unnoticed for years until researchers found a way to use them. Big hosts and internet companies got weeks of private warning before the public announcement.
Experts warn that many systems are still unpatched. Old software that is never updated remains an easy target for criminals.
π― Why It Matters
If you run a website or use online services, this is a reminder to install updates fast. Unpatched sites can leak passwords and card details.
Two serious bugs in PHP, the software that runs a large share of the web, forced companies around the world to take sites offline this week. Researchers named the flaws PHP2Shell. They let an attacker break into a server without a password.
The PHP Foundation released fixes on Wednesday. Banks, shops, hospitals, gaming sites and some government agencies shut down servers while they patched. So far there is no report of mass attacks.
PHP has been used for decades to build websites and sits behind tools like WordPress. The flaws had gone unnoticed for years until researchers found a way to use them. Big hosts and internet companies got weeks of private warning before the public announcement.
Experts warn that many systems are still unpatched. Old software that is never updated remains an easy target for criminals.
If you run a website or use online services, this is a reminder to install updates fast. Unpatched sites can leak passwords and card details.