What Happened?
A global security alert involving PHP, one of the most widely used server-side programming languages, prompted governments, companies and public institutions to temporarily take selected websites offline on October 21, 2026. Developers released urgent security fixes for two critical vulnerabilities collectively dubbed PHP2Shell, while cybersecurity agencies warned that some vulnerable installations could allow an attacker to execute code remotely without signing in.
The story is serious, but it needs precise language. The existence of widespread exposure, malicious scanning and precautionary outages does not establish that every affected website was hacked. Reuters reported that numerous organisations shut down services to reduce risk, including some that said they had no evidence of a breach. For readers and website operators, the immediate issue is whether the underlying PHP installation has received a verified security update.
The Two CVEs Behind PHP2Shell
The vulnerabilities are CVE-2026-109618 and CVE-2026-109619. Official PHP security releases on October 21 identified both as critical. NHS England Digital warned that successful exploitation could enable unauthenticated remote code execution or access to sensitive memory, while JFrog Security Research described flaws in core PHP request handling rather than a problem limited to a particular WordPress theme or plugin.
An unauthenticated attack does not mean every installation is necessarily exploitable under every configuration. The technical conditions, server integration and deployed versions matter. Nevertheless, defenders should treat the advisories urgently: the PHP team specifically warned that complete mitigations were unavailable and upgrading was the safe course of action.
What Is PHP and Why Does This Affect So Many Websites?
PHP runs server-side code that produces web pages, handles requests and supports many content-management systems. WordPress, Drupal and Joomla are common examples of software built with PHP. Even visitors who never see PHP code may use services powered by it every day.
PHP’s extensive adoption is why a flaw in its core deserves global attention. However, statistics about the percentage of websites using PHP measure technology adoption, not the number of compromised sites. A website can use PHP yet remain protected if it has been patched correctly, while the risk of an unpatched installation also depends on its deployment.
Why Governments and Companies Took Websites Offline
Reuters reported temporary website suspensions across parts of Europe, Asia and North America after the security warnings. The Netherlands, Germany, France, Belgium, Finland and the Czech Republic were among countries where public online services were affected. In some places, organisations restricted website access before attackers could exploit their systems. Examples mentioned in Reuters reporting included Dutch institutions and the Wikimedia Foundation, along with some major corporate services in Japan.
A precautionary shutdown is not the same thing as a confirmed data theft. Taking a vulnerable service offline may be a responsible emergency defence when an update cannot be installed and tested immediately. The action can still inconvenience people relying on public portals, business systems and customer services.
What an Attacker Could Potentially Do
A remote-code-execution vulnerability may let a malicious outsider make a server run instructions it should not accept. Depending on the account privileges and other protections, a successful incident could interfere with website availability, tamper with data or provide a starting point for additional compromise. Memory-disclosure weaknesses can also expose data that should remain private.
These are potential consequences, not findings that all occurred during the October incident. Specific claims about stolen databases, financial losses or a hacked government agency require a separate incident investigation or official confirmation. Reporting should distinguish a successful exploit, an attempted attack and a security alert.
Official PHP Security Updates Released October 21
The PHP project published security releases on October 21, 2026. The relevant patched branches were PHP 8.2.35, PHP 8.3.36, PHP 8.4.27 and PHP 8.5.12. Plesk’s advisory also supplied updated packaged versions for installations managed through its hosting environment. Older, unsupported PHP branches require particular care and a supported upgrade strategy.
Administrators should identify the actual PHP runtime serving each website rather than assuming that the command-line version, dashboard label or WordPress plugin list describes the whole setup. Hosting vendors sometimes distribute fixes as part of vendor-specific packages, so owners should consult their provider’s security bulletin and confirm the update is installed.
Does Updating WordPress Alone Solve PHP2Shell?
Not necessarily. WordPress themes and plugins may have vulnerabilities of their own, but PHP2Shell affects the PHP engine beneath many applications. Updating WordPress core or installing a general-purpose security plugin does not automatically replace a vulnerable PHP runtime.
For a managed WordPress site, the hosting provider may control PHP upgrades. Administrators should ask whether all web-serving PHP instances have been patched, whether the site has been tested following the change, and whether monitoring shows suspicious requests. Backups and normal CMS maintenance remain important, but they are complementary safeguards rather than substitutes for this emergency fix.
What Website Owners Should Do Now
First, establish which PHP version and build are actually running on the production web server. Second, apply the vendor-supported fixed build for the relevant branch as soon as possible. Third, review security logs and abnormal behaviour, including unexpected administrative changes or suspicious server requests, and involve the hosting provider if anything appears compromised.
Maintain reliable off-site backups and test them. If an affected application cannot be patched safely at once, consider restricting access or temporarily disabling the service under the guidance of a qualified administrator. Because PHP’s developers say there is no complete alternative mitigation, a firewall alone should not be described as equivalent to upgrading.
Where Artificial Intelligence Fits Into the Story
AI-based tools can help defenders examine code, triage alerts and prioritise security work; attackers may also use automated tools to accelerate discovery or scale their activity. Some commentary surrounding the event has highlighted that dual-use concern.
However, the reliable primary documentation establishes the PHP vulnerabilities and the required fixes. It does not establish that ‘AI hacked the entire internet’, and there is no verified single AI actor responsible for every reported attack attempt. Mukhbir should describe the incident as a PHP security emergency and identify AI-related claims only when tied to a specific documented source.
Are Millions of Websites Confirmed Hacked?
No. Threat analysts can observe large numbers of internet scans or attempted exploit requests, but one request is not equivalent to one successful compromise, and repeated requests may target the same server. Estimates about PHP adoption are also not statistics for hacked websites.
Newsroom copy should avoid statements such as ‘70% of the internet was hacked’ or ‘millions of sites were breached’ without independent evidence. The confirmed global story is critical PHP flaws, urgent security advisories and widespread defensive action. Any total of verified breaches would require a consistent methodology and a dated authoritative source.
Impact on Pakistan and South Asia
The issue is relevant to Pakistan because domestic news sites, small businesses, online stores, university portals and agencies can use PHP-backed software. A local administrator who operates a vulnerable version could be exposed to the same general technical risk as an administrator elsewhere. That makes this story useful even if no Pakistani nationwide outage is established.
As of this report, the sources reviewed do not verify that Mukhbir’s own website, or Pakistani government websites as a group, suffered confirmed compromises because of PHP2Shell. No such allegation should appear in a headline. Operators in Pakistan should contact their hosting teams for build-level confirmation and a documented patch status.
Why Some Websites Returned Faster Than Others
Organisations differ in their hosting arrangements, number of applications, change-control requirements and ability to test emergency updates. A provider managing many similar installations may be able to deploy a vendor patch centrally, while a customised enterprise system may need additional compatibility testing and recovery planning. Temporary service restrictions can therefore vary significantly in duration.
The fact that a website comes back online also does not automatically prove it underwent a full forensic investigation. Reopening a service, confirming a successful patch and investigating any possible compromise are related but distinct operational steps. Public reporting should follow each organisation’s own statements.
What Businesses Should Learn from PHP2Shell
This incident shows why software inventory and patch response are fundamental business needs rather than purely technical tasks. Managers should know who is accountable for operating-system updates, PHP runtimes, web applications, external vendors and incident communication. Organisations can reduce avoidable downtime by rehearsing emergency maintenance procedures and ensuring recoverable backups.
It also underlines the importance of clear communications with customers. Explaining that a website has been paused for precautionary security maintenance is better than allowing unsupported rumours of a successful attack to define the story. Where a breach is actually confirmed, the organisation should issue accurate notices in line with applicable law and its response plan.
What Happens Next?
Security teams will continue to assess patches, review exposure and investigate any suspicious traffic. Hosting control panels, managed-service providers and enterprise software distributors may publish additional deployment instructions tailored to their platforms. Researchers may also clarify how different configurations affect exploitation.
Readers should follow official PHP announcements, their operating-system or hosting supplier’s bulletins and relevant national cybersecurity agencies. Any future claim that a named website was compromised should be evaluated against confirmed incident disclosures rather than screenshots of outages or speculative social-media posts.
Conclusion
The PHP2Shell crisis is a genuine global cybersecurity story. Two critical PHP vulnerabilities disclosed in October 2026 led developers to issue urgent fixes and prompted public and private organisations to temporarily restrict online services while they assessed exposure. The issue can threaten the confidentiality and integrity of vulnerable servers, but not every website that went offline was successfully attacked.
For Mukhbir’s readers, the practical takeaway is clear: verify the PHP build installed on web-serving infrastructure, apply the relevant supported fixes and investigate suspicious activity. Accurate coverage must distinguish an at-risk website from a confirmed victim, and a defensive shutdown from evidence of data theft.
Frequently Asked Questions
What is PHP2Shell?
PHP2Shell is the public name associated with two critical PHP vulnerabilities disclosed in October 2026.
Which CVE numbers are involved?
CVE-2026-109618 and CVE-2026-109619.
When were emergency PHP updates released?
The PHP project issued security updates on October 21, 2026.
Which PHP versions contain the fixes?
The listed patched releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12; hosting vendors may package fixes differently.
Were all PHP websites hacked?
No. Using PHP does not establish a breach, and precautionary shutdowns do not necessarily indicate successful exploitation.
Can WordPress websites be affected?
Yes, because WordPress depends on PHP. Website owners should verify the underlying server runtime has been patched.
Does a WordPress security plugin fix PHP2Shell?
Not by itself. The PHP engine must receive an appropriate vendor-supported security update.
Was Mukhbir or Pakistan’s entire web infrastructure hacked?
No verified evidence of such a nationwide or site-specific compromise was established in the reviewed sources.
About The Author
