Yesterday afternoon, a warning went out that most people will never hear about. By this morning, governments were unplugging their own websites.
The problem is a pair of security holes in PHP. Most people have never heard of this programming language, but they use it every day. Roughly 7 out of 10 websites run on it. That includes most online stores, a huge number of government and school sites, and every WordPress site on the planet, this one included.
Security researchers are calling the bug PHP2Shell. It lets an attacker take over a web server from anywhere in the world without a password. The details leaked before a fix was ready.
We write a lot about the grid, the food supply and the banking system on this site, and this story belongs right next to those. It’s a real-world look at what happens when one piece of the system everybody depends on cracks.
How This Went Down
On Tuesday, October 20, the PHP security team put out an unusual advance notice. It announced two critical flaws, both rated 9.2 out of 10, with a fix coming the next morning at 14:00 UTC (7 a.m. Pacific). It gave no details. The idea was to give site owners a day to get ready before the bad guys knew what to look for.
That lasted a few hours. Details leaked online Tuesday afternoon, along with a video that appeared to show someone running an exploit tool against WordPress, Drupal, Magento, Joomla and other popular platforms. The security firm watchTowr confirmed the bugs were real. They’re tracked as CVE-2026-109618 and CVE-2026-109619.
By early Wednesday morning, the security company Patchstack said it had confirmed multiple attacks in the wild, and Cloudflare’s CTO said they were already seeing attempts. The patch landed at 13:52 UTC Wednesday, a few minutes ahead of schedule. The security firm Sansec had predicted mass attacks would start within 15 minutes of the release.
This isn’t a bug in one plugin or one app. It sits in the PHP engine underneath all of them. According to Wiz Research, which found the bugs, every PHP version going back to 5.4 is affected by at least one of the two. Researchers also showed the flaws can be used to read a server’s memory, which is often where passwords, login tokens and API keys are sitting.
Governments Pulled the Plug on Their Own Websites
This is the part that should get your attention. Before the patch came out, cybersecurity agencies were telling organizations that if they couldn’t fix their servers fast, they should take them off the internet.
CERT-EU, the team that protects the European Union’s own institutions, put out an advisory Tuesday night. It told organizations that couldn’t patch quickly to consider taking their websites offline. The Australian Cyber Security Centre gave similar guidance. One of PHP’s own core developers said going offline was the most sensible move until the fix was out. Even now, Patchstack is telling high-risk sites that can’t update to shut down or switch to maintenance mode.
Plenty of them listened.
- In the Netherlands, several sites went dark. DigiD went down, which is the login people use for taxes, healthcare and other government services. So did the MijnOverheid citizen portal and the House of Representatives website. Even the Dutch National Cyber Security Centre’s own site went offline.
- In Finland, Valtori started pulling public-sector sites offline. Valtori is the state IT center that runs web services for much of the government. The agency said there had been no breach. It just decided the risk was too high.
- In Austria, agencies and universities took sites down, and webmail in Vienna went offline along with them.
- Nintendo and several major Japanese platforms took services offline.
- Universities, online stores and public forums shut off their public-facing sites rather than take the chance.
Warnings went out from the EU, Germany, Japan, Australia, the U.K. and the Netherlands. In the U.S., the Cybersecurity and Infrastructure Security Agency (CISA) raised the alarm too.
Think about what that means. Nobody hacked DigiD. The Dutch government shut it off themselves because leaving it running was more dangerous. For a stretch of hours, people across an entire country couldn’t log into their own government’s services, and that was the safe option.
That’s what the system looks like under stress. There’s no backup plan. There’s an off switch.
Why One Bug Can Hit So Much of the Web
When people think about the internet, they picture Google, Amazon and Facebook. Underneath millions of ordinary websites, though, sits PHP, doing the work every time a page loads.
The web-tracking company W3Techs says PHP runs about 70% of all websites where the server language can be identified. That number has stayed somewhere between 70% and 80% for the last decade, and nothing else comes close.
Here’s some of what’s built on it:
- WordPress, which runs roughly 4 in 10 websites by itself
- Online stores running WooCommerce and Magento
- Drupal and Joomla sites, which are all over government, schools and nonprofits
- Countless small-business sites, church sites, local news outlets, booking systems and member logins
That’s a single point of failure. One free, open-source building block sits under a huge share of the web. When it breaks, it doesn’t break for one company. It breaks for everybody at once.
Does This Affect You If You Don’t Run a Website?
Yes. You may never touch a server, but you use hundreds of them. A bug like this can reach regular people in several ways.
Your passwords and accounts. Researchers showed this flaw can pull passwords and login tokens straight out of a server’s memory. If a site you use gets hit, your login for that site could be stolen. If you reuse that password, every account that shares it is exposed too.
Your credit card. Hackers who take over an online store can quietly plant code on the checkout page that copies card numbers as people type them in. Lots of small online shops run on PHP platforms like WooCommerce and Magento. Many of the people running those shops have no idea what version of PHP they’re on.
Malware from sites you trust. A hijacked website can be turned against its own visitors, pushing malware or fake login pages. You could visit the same local news site or church page you always do, and it won’t be the same site anymore.
Services that just disappear. Ask anyone in the Netherlands who tried to log into DigiD this morning. When sites go offline to protect themselves, you lose access to whatever was behind them. That could be your benefits, your records or your bill pay.
Breaches you won’t hear about for months. Break-ins often aren’t discovered or reported until long after they happen. Some of the servers hit this week might not show up in a breach notice until next year.
If you’re a regular user, a few habits help. Use a different password for every important account and turn on two-factor authentication. Watch your bank and card statements closely for the next few weeks. Be extra suspicious of any email about “security updates” or “problems with your account.” Scammers love a news story like this one.
The Servers That Will Never Get Fixed
Everyone is saying “just update,” but the patch only exists for PHP 8.2, 8.3, 8.4 and 8.5. Older versions aren’t getting one.
There’s a lot of older PHP out there. On October 20, security company Mallory counted about 884,000 internet-facing servers that openly report PHP 8.1 or older. That’s 59% of the roughly 1.5 million servers that list a PHP version publicly at all. W3Techs numbers from earlier this year show that PHP 5 still runs about 6.6% of all websites, even though it stopped getting updates years ago. Even PHP 8.2, one of the versions that did get the fix, hits end of support on December 31.
Think about who runs those old machines. There’s the small-town water district’s billing page and the county records portal. There’s the local clinic’s patient login, and the mom-and-pop shop whose web guy retired in 2019. Nobody is watching those systems, which is exactly why attackers go after them.
The fix came out today. The hole will stay open on hundreds of thousands of forgotten servers for years.
We Built a Dependency That Will Eventually Bring Us Down
PHP2Shell probably won’t take down the internet this week. Most big hosting companies will patch fast.
But look at what just happened. One bug in one piece of software put most of the web at risk overnight. The people responsible had about a day of warning, and even that got cut short by the leak. For a lot of them, the best option was to turn their own systems off. Next time there might not be a patch ready at all.
Over the last 25 years, we’ve moved nearly everything onto systems we don’t own, can’t see and can’t fix. Our money lives in online accounts. Medical records, tax forms, deeds and insurance policies sit on someone else’s server. How many people do you know who could purify water or find their way home without pulling out a phone? Our communications run through cell towers, apps and logins that trace back to servers like the ones exposed this week.
We’ve been warning about this for a while. Earlier this month, hackers took control of refrigeration systems in hundreds of French supermarkets and destroyed the food inside. A few days before that, AI insiders told Axios they expect a cyberattack on banks, power or water within 12 months. PHP2Shell is the same story from a different direction. Everything is connected, the weak spots are shared, and when one link snaps, the damage spreads fast.
We traded resilience for convenience a long time ago, and days like today are when the bill shows up.
What You Can Do Right Now
You can’t patch the internet. You can make sure your household isn’t helpless when it goes down.
- Build your own offline knowledge hub. Load a small, low-power computer with offline Wikipedia, medical references, maps and your own documents, and it keeps working when the web doesn’t. We walk through the whole setup in Offline Knowledge Hubs: Building Your Own Digital Survival Library.
- Download what you’d need before you need it. A repair guide or medical manual doesn’t help you if it lives on a website that just went offline. Start with our list of survival eBooks and survival tablets, and keep paper copies of the most important ones from our best survival books list.
- Get your records off the cloud. Print or save offline copies of IDs, insurance policies, prescriptions, deeds and account numbers. Keep them on an encrypted USB drive and in a waterproof folder.
- Keep cash on hand. When payment systems and banking sites go down, cash still works. Our job loss survival plan covers how to build that cushion.
- Have a way to communicate that doesn’t need the internet. A ham radio license is one of the best upgrades you can make. Start with Ham Radio for Emergency Communications and Prepper Radio: The No-BS Ham Radio Technician Exam Prep Guide. Then put together a Plan B RF book so you can still get news when the websites are dark. There’s more in Situational Intel: Knowledge Is Power During a Crisis.
- Know your backup internet options. If you have to get online during a disruption, have more than one way in. See OFF-GRID Internet: How to Get Internet Access When Living Off the Grid.
- Power it yourself. None of this works without electricity. Check out real solar setups under $1,000 and our roundup of solar generators and power packs.
- Learn to get around without GPS. Nobody can hack a paper map and a compass. Our emergency navigation gear guide covers what to keep in the truck.
If you run a website, check your PHP version today. You want 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer. If you’re on 8.1 or older, talk to your host about upgrading or getting a backported fix. If your host can’t tell you what version you’re running, that tells you something too.
The Bottom Line
This week it was PHP. Next time it’ll be something else most of us have never heard of. The pattern doesn’t change. A system everyone depends on turns out to have a crack in it, and millions of people find out at the same moment that they don’t have a backup.
The grid, the banks, the supply chain and the internet are all built this way now. They’re centralized, connected and fragile. Sooner or later, one of these cracks won’t get patched in time.
When that day comes, the people who are okay will be the ones who set up their own backups ahead of time. Start on yours today. If you’re new to all this, our Prepper 101 guide is a good place to begin.
Read the full article here