PHP2Shell: What the Critical PHP Flaw Means for Your Site
Two critical PHP vulnerabilities, reportedly found with AI help, forced sites offline and put roughly 20 years of PHP versions at risk. Here is what site owners, marketers and ecommerce teams should do now.
Rajesh Kumar · 22 Oct 2026 · 3 min read
- Two critical PHP flaws, rated 9.2 out of 10, can allow remote code execution and affect PHP versions going back roughly 20 years.
- 4chan, DeviantArt and the Internet Archive went offline temporarily, and Cloudflare reported millions of exploit attempts.
- The NSA Cybersecurity account and the UK's NCSC advised taking systems offline if patching is not immediately possible.
- Downtime or compromise can damage Google rankings, AI search citations, ad performance and ecommerce trust.
- Check your PHP version now, patch, and audit forgotten or unsupported sites.
What happened
Two critical vulnerabilities in PHP, the language behind a huge share of the web, were disclosed this week. According to The Verge's live coverage, some accounts say up to 70 percent of websites use PHP in some capacity. That includes WordPress, Drupal and Wikipedia.
The PHP developers rated the flaws 9.2 out of 10. Security firm watchTowr described them as Remote Code Execution bugs, meaning an attacker could run their own code on a vulnerable server. That can mean altering a site, stealing data and more. Patches were released at 10AM ET on the day of the advisory.
The damage was immediate. 4chan and DeviantArt were temporarily shut down. The Internet Archive went briefly offline before its ops team patched and restored it. Some Dutch and Finnish government agencies pulled sites as a precaution, and Pokémon Home and Pokémon Champions were reportedly taken offline too.
Cloudflare CEO Matthew Prince said the company saw thousands of exploit attempts in the 10 hours before the public announcement. That rose to hundreds of thousands in the two hours after, and millions by the following night.
Why this one is different
The bug is not new. It has reportedly existed in PHP for roughly 20 years. Wiz said exploiting it once required a chain of steps at the edge of what human researchers could practically achieve. Powerful AI models have made it much easier to turn obscure bugs like this into real attacks.
OpenAI says a researcher at Calif used GPT-5.6 Sol to find the exploits before attackers did. Wiz co-founder Ami Luttwak called it the most severe AI vulnerability ever found.
The other problem is age. The flaw affects every PHP version going back about two decades, and many of those versions are no longer supported. Two older Japanese mobile games, World Quest and Save My Demonic World, are shutting down because their developers say the underlying tech cannot be updated.
What it means for visibility and revenue
A compromised or offline site hurts every channel at once.
- Google: Extended downtime and hacked pages can cause crawl problems, lost rankings and security warnings. I would not assume a quick recovery.
- AI search: Tools like ChatGPT, Perplexity and AI Overviews cite sources they can reach. If your site is down or serving injected content, you are less likely to be cited.
- Ecommerce: Checkout, customer data and payment trust all sit on your stack. A WooCommerce or custom PHP store is exposed if the server runs a vulnerable version.
- Social and ads: Paid traffic sent to a broken or flagged site is wasted spend.
Practical actions
- Find out your PHP version today. Ask your host or developer, or check your hosting panel. OpenAI has shared a tool that lets developers check whether they run a potentially vulnerable PHP version.
- Patch immediately. The advisory urged users to upgrade as soon as the release is available. Managed hosts may do this for you, but confirm it in writing.
- If you cannot patch, consider going offline. The NSA Cybersecurity account and the UK's National Cyber Security Centre both recommended taking systems offline if an immediate update is not feasible. For a small business, a maintenance page beats a breach.
- Audit forgotten sites. Old microsites, campaign pages, staging servers and abandoned blogs often run unsupported PHP. Upgrade, migrate or retire them.
- Check for signs of compromise. Look for unfamiliar files, new admin users, odd redirects and unexpected traffic spikes. Review Search Console for security issues.
- Put a plan in place for downtime. Have backups, a status message and a contact route for customers.
The bigger lesson
AI is shortening the time between a hidden bug existing and someone exploiting it. Maintenance is now a marketing issue, not just an IT task. Neglected sites will carry more risk, and some old corners of the web may disappear because the cost of fixing them is too high.
The Verge's coverage of PHP2Shell is still being updated, so expect more details and affected services to emerge.
Raj's takeI have seen plenty of security scares, but this one matters because it hits the plumbing most small business sites run on. Many owners treat hosting as set-and-forget, and that habit is now expensive. Patch first, then ask your host and developer what else is running on old versions.
Want this applied to your business?
Related
Hungarian Film ‘Be My Dad’ to Screen at TK Park Bangkok on September 20
Hungarian comedy Be My Dad will be screened at TK Park, centralwOrld, Bangkok on September 20, 2026. Bangkok’s 2026 Contemporary World Film Series continues this September with the Hungarian comedy Be My Dad, a warm and thought-provoking story exploring family, imagination, creativity and unexpected parenthood. The film will be screened at TK Park […]
Elnaaz Norouzi on the Green Carpet — IIFA 2018 Bangkok
Day three of the IIFA Awards 2018 weekend at Siam Niramit, Bangkok kept delivering — and Elnaaz Norouzi made sure of it. Poised, striking, and completely owning the moment, the actress brought her own brand of effortless glamour to the Green Carpet. Every frame told the story — she was made for this. A stunning […]
Kriti Sanon Interview on the Green Carpet — IIFA 2018 Bangkok
The IIFA Awards 2018 Green Carpet at Siam Niramit, Bangkok was buzzing by day three — and Kriti Sanon was right at the centre of it. Pausing for a Green Carpet interview, the Bollywood actress was effortlessly composed — stylish, articulate, and completely in her element. The kind of presence that makes every frame count. […]