Last week, the language that runs most of the web turned out to have a hole in it. Two, actually, both rated critical. On October 20, we made the difficult decision to temporarily take client websites offline as a precaution, while a patch was being developed.
That's not a call we make lightly. Here's why we made it, and what it means if you run a website.
What happened
PHP is the language that sits on the server and builds a web page before it reaches your browser. WordPress runs on it. Drupal runs on it. Statamic, the CMS we build on, runs on it too. Wiz, one of the research firms behind the discovery, estimates the flaws touch roughly 70% of the internet.
On October 21, the PHP project released emergency patches for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, now known as PHP2Shell. Both score 9.2 out of 10 on the CVSS severity scale. Both let an attacker run their own code on a web server without logging in. Every PHP version released in the last decade is affected by at least one of them, going back to version 5.4.
In plain terms, an attacker sends a deliberately oversized file upload that pushes PHP to run out of memory mid-request. PHP cleans up, but keeps a pointer to memory it has already thrown away. The attacker fills that space with something of their own, and PHP trusts it. From there, they can read passwords and API keys belonging to other visitors, change data, or take over the server entirely.
Found by AI, leaked before the fix
These bugs aren't new. They've sat in PHP's code for years. What's new is that researchers used frontier AI models to comb through millions of lines of code and chain several small weaknesses into one working attack. No human team had managed it.
The plan was a quiet, coordinated fix: patch first, announce second. It didn't hold. Exploit details leaked online on October 20, a day before the patch, and security firm watchTowr saw attacks in the wild by October 21. That changed the calculation. A critical flaw with a fix is a maintenance task. A critical flaw with a public exploit and no fix is an open door.
The same technology now works for both sides. AI found these flaws for the defenders. It will find the next ones for whoever looks first.
Why the web went dark
On October 21, websites around the world went offline on purpose. In the Netherlands, the National Cyber Security Centre took its own site down as a precaution. The Tweede Kamer, the lower house of parliament, followed, along with the DigiD login service, the MijnOverheid government portal, the Port of Rotterdam and several hospitals. Government agencies in Finland did the same.
They chose downtime over exposure, and so did we. A few hours of downtime is an inconvenience. A compromised server is a different problem entirely. It can mean stolen customer data, defaced pages, or hidden code that waits months before it does anything.
With no patch available yet, going offline was the only option that removed the risk completely. Cybersecurity agencies in Europe, Australia, Japan and the UK gave the same advice: update immediately, or take sites down until you can. In the US, CISA still recommends it for anyone who can't patch.
If you run a PHP website
Start with your PHP version. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Versions 8.1 and older are past end of life, and PHP has only published source patches for 7.4 through 8.1. If you're on one of those, this is the push to upgrade properly.
If you can't patch yet, take the site offline until you can. Keep session upload progress turned off, as PHP's October 23 follow-up advisory recommends. And if your site was exposed between October 20 and the day you patched, check it for signs of compromise. Patching closes the hole. It doesn't remove anyone who already got in.
Not sure which version you're running, or who's responsible for updating it? That's the first thing to find out.
For the full technical picture, these are worth reading:
Critical PHP vulnerabilities alert from the Canadian Centre for Cyber Security
Critical vulnerabilities in PHP require immediate patching from CISA
PHP2Shell: AI uncovers critical RCE vulnerabilities from Wiz Research
PHP2Shell: leaked critical PHP vulnerabilities from Huntress
Security is maintenance
Nobody notices good security until the day it matters. It isn't a feature you ship at launch. It's updates, monitoring, and sometimes making an uncomfortable call before anyone asks you to.
That's what our support and maintenance work is for. If you want a team that watches for this so you don't have to, let's talk.