This week a piece of software almost nobody thinks about was patched in a hurry, and for a few hours parts of the internet went quiet instead. The software is called PHP, it runs behind most of the websites you visit, and the holes in it were serious enough that security agencies in Europe and the United States told companies to update immediately — or switch their sites off until they could.
What actually happened
Researchers found two flaws in the core of PHP. Both let a stranger run their own code on a web server without a username or a password — the kind of access that normally takes a break-in. The PHP project rated each one 9.2 out of 10 for severity and shipped fixes on Wednesday, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
These are not plugin bugs. They sit in the engine that handles memory and errors, so nearly every request a site receives passes close to them. On the most common setup, the PHP project says, an ordinary request from the internet can trigger the problem before the website’s own code even starts running.
Why this one is different
Most frightening security news is about one company’s mistake. This is about the foundation. PHP sits under WordPress, shop systems, school portals and a long list of other tools people build sites with, so a single hole is repeated across millions of servers at once.
It was also found with help from machine-assisted audits. An external security audit in 2024 first noticed something wrong in the way PHP behaves when it runs out of memory. This year, AI-assisted scanning programmes at several security firms, plus an OpenAI-funded audit, reported the same root cause together with working attack paths. The PHP Foundation has said publicly that its own decision process was too slow and called the delay a structural failure.
And it had already been tested. Amazon’s threat intelligence team says it saw an exploitation attempt on 17 October, four days before the patches existed, and the European Union’s CERT-EU advisory notes that proof-of-concept code began circulating within hours of the release.
What it means for you
If you use websites, the direct effect is small but real. Some services were taken offline on purpose while their owners updated. A page that would not load this week may have been protected rather than broken.
The bigger risk arrives afterwards. Whenever a flaw like this becomes public, criminals borrow its name. Expect messages saying your bank, your web host or a shop account was ‘affected by the PHP vulnerability’ and asking you to confirm your password. Real providers do not ask for passwords by email, and they do not ask you to ‘verify’ a card through a link.
What you can actually do
- Do not rush to update anything on your phone or laptop. This flaw lives on the servers websites run on, not on your devices.
- Treat every ‘your account was affected’ email as suspicious. Type the service’s address yourself instead of clicking the link in the message.
- Turn on two-step verification wherever it is offered. It is the single change that stops most account theft, including theft that follows a breach.
- Use a different password for each site. A password manager makes that easy, and reuse is what turns one leaked list into ten broken accounts.
- If you run a website, even a small one, ask your host one plain question: is PHP on my plan at 8.2.35, 8.3.36, 8.4.27 or 8.5.12? A host that cannot answer that today is a host worth leaving.
Three things people are getting wrong
It only affects big companies
The flaw is in the software, not in the size of the company. A sports club site, a bakery’s shop and a personal blog run on the same engine, and those are updated far less often than a bank’s.
If the site loads again, the problem is over
A site can be switched back on and still be unpatched. The thing to look for is not whether it loads, but whether the owner says it was updated.
Nobody would want my data
Attackers rarely target one person. They take whatever a server holds — names, addresses, order histories, scrambled passwords — and sell or reuse the whole pile. Your value is in the heap, not on its own.
What to watch in the coming weeks
Expect a wave of scanning: automated tools testing every server on the internet for unpatched versions. That is normal after a disclosure and usually harmless on a patched host. Expect, too, breach notifications from services that were caught out.
The honest open question is coverage. Fixes exist for the versions above, and the project published backports for the older branches it no longer supports, but nobody can measure how many servers were switched on again without them.
The one thing to remember
Most of the internet rests on a handful of pieces of software that almost nobody looks at. When one of them cracks, the repair is quick, and the follow-up — fake warnings, leaked lists, reused passwords — is what actually reaches you. Two-step verification and a separate password per site still decide whether a bad week for the internet becomes a bad week for you.
Sources: php.net security advisory of 21 October 2026, CISA alert of 21 October 2026, CERT-EU advisory 2026-018, the PHP Foundation’s post-mortem of the same day, and Tenable’s public FAQ on the two CVEs.