On October 22, SEPTA riders in Philadelphia opened their transit app and found the real-time tracking gone. Government websites in the Netherlands, Finland, Denmark, France, and Australia also went dark. They pulled themselves offline on purpose to patch a critical flaw in PHP, the code running behind nearly 70% of all websites.
If you have a website, there’s a good chance this affects you. And it’s the clearest example in years of why website maintenance isn’t a nice-to-have. It’s the thing that decides whether a headline like this is a quick fix for you or a crisis.
What Happened With the PHP Vulnerability?
Two critical flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, let an attacker run their own code on a web server without logging in. Security researchers have nicknamed the exploit “PHP2Shell,” and both flaws are rated 9.2 out of 10 for severity.
In plain terms, someone could take control of the server your website lives on. No password needed.
The PHP Foundation credited researchers including OpenAI, Calif, and Wiz for finding and reporting the flaws. Several of them said they used AI models in the research. Patched versions of PHP were released on October 21, according to ABC News and a detailed FAQ from Tenable.
Who Has Been Affected So Far?
Organizations around the world took sites offline rather than risk running unpatched. ABC Australia reported outages on Australian government sites, including the Australian Signals Directorate’s cyber.gov.au. Agencies in the Netherlands, Finland, Denmark, and France took services down as a precaution. Wikipedia is applying the fix without going offline.
Closer to home, SEPTA’s real-time tracking tools went down while the agency installed the security patches.
The urgency is real. The FBI urged organizations to update affected PHP installations immediately, or take systems offline until they can. CISA “strongly urges organizations to immediately patch.” Amazon’s threat intelligence team spotted an attack attempt on October 17, four days before the public announcement. It now describes PHP2Shell as “broadly exploited in the wild.”
Does the PHP Vulnerability Affect My Website?
If your website runs on WordPress, Drupal, or any other platform built with PHP, it’s very likely affected until the server is updated. WordPress alone powers more than 40% of websites, and all of it runs on PHP.
Here’s the part most site owners don’t expect. WordPress.org says no WordPress update is needed or planned for this. The fix isn’t a plugin update you click in your dashboard. It’s an update to PHP itself, on the server, and that’s a job for whoever manages your hosting.
What Website Owners Should Do Right Now
The fixed PHP versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Anything older on those branches is affected. Here’s where to start:
- Check your PHP version. In WordPress, go to Tools, then Site Health, then the Info tab, and open the Server section.
- Ask your host directly. Some Linux systems apply the patch without changing the version number, so the number alone may not tell you. Ask whether the October 21 fix has been applied.
- Know if you’re on an old version. PHP 8.1 and older don’t get an official fix. The real solution is moving to a supported version, 8.2 or newer.
- Back up before you upgrade. Older themes and plugins can break on a newer version of PHP. Test the upgrade on a staging copy first.
- Don’t treat workarounds as a fix. The PHP team says temporary settings changes only reduce exposure. Updating is the only complete fix.
If you manage your own server, Amazon recommends reviewing your logs for suspicious activity back to October 17, not just from the announcement date.
Why This Is a Website Maintenance Problem
The sites in the most danger this week aren’t the ones with the best security budgets. They’re the ones nobody is watching. The site built five years ago, running an old PHP version, with a developer who moved on and a hosting account on autopilot.
For those sites, “just update PHP” isn’t one click. An old theme or plugin might break the moment PHP changes. Someone has to test the upgrade, fix what breaks, and keep a backup ready in case it goes sideways. All of that has to happen in hours, not weeks, because attackers are already trying the exploit.
That’s what real website maintenance is. It’s someone who already knows what version of PHP you’re running, already has a recent backup, and already knows which plugins will complain. When a flaw like this lands, they’re patching while everyone else is still figuring out who to call.
How SiteCare Keeps Your Site Off the Outage List
Our SiteCare plans cover hosting, security, backups, and monthly change hours. That means someone is always accountable for the parts of your site you never see. Plans start at $199 a month, and you can compare all three tiers on our pricing page.
If your site is on SiteCare, it’s already running a patched version of PHP. You don’t need to do anything.
Not on SiteCare and not sure what your site is running? We’ll check your PHP version and tell you what it needs, whether we built the site or not. If you’re due for a rebuild anyway, our custom WordPress websites are built on current, supported versions from day one.
FAQ
What is PHP2Shell? PHP2Shell is the nickname for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619. They let an attacker run code on a web server without logging in, and both are rated 9.2 out of 10 for severity.
Which PHP versions fix the vulnerability? PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 contain the fix. PHP 8.1 and older don’t receive an official release, so those sites need to upgrade to a supported version.
Do I need to update WordPress? No. WordPress.org says no WordPress update is required for this issue. The fix is updating PHP on your server, which your host or website maintenance team handles.
Can I fix this myself? On shared or managed hosting, your host controls PHP, so the best step is confirming with them that the patch is applied. On an older site, upgrading PHP can break themes or plugins, so a backup and a staging test come first.
Is my site safe if my host says I’m protected? It’s a good sign, but confirm your site is running a patched version. If you’re on PHP 8.1 or older, a newer PHP version is still needed, even if your host has added temporary protections.