On October 21, 2026, the makers of PHP, the free programming language that runs most websites, released emergency fixes for two critical flaws. The flaws can let a stranger take over a website's computer without any password.
Security firms saw early attacks, and some services, including Dutch government websites, went offline as a precaution (source).
What does this mean for people like the readers of this page: people who use websites every day, people who run a small business or a shop online, and people who build or look after websites? What is likely to happen in the coming days and weeks, and what should each of them do now?
In plain words: PHP — free programming language running most websites; Patchstack — a company that tracks website security flaws; Cloudflare — US company that protects websites from attacks; CISA — the US government's cyber defense agency; CVE — official ID number for a security flaw; Wiz — security company owned by Google that found flaws; BleepingComputer — a website reporting on computer security news; Le Monde — France's main daily newspaper
What to do
Ask your host today: «Which PHP version runs my site?» Fixed ones: 8.2.35, 8.3.36, 8.4.27, 8.5.12.
Your shop's PHP version, not its plugins, decides if you are safe — one email to your host settles it today.
Who should do what
Shop owners and site builders: Today, October 22, get written proof from the host that a fixed PHP is live; after that, change admin passwords and keys the site stores.
Everyday web users: Change a password only if a site announces a breach, then change its reused twins too; keep two-step login on and ignore «your site was hacked» emails.
What not to do: Don't trust «WordPress is up to date» as proof, and don't install unofficial fix plugins.
Updating WordPress or plugins does not close this hole. The flaw is in PHP, the engine under the shop, so even a perfectly kept site can be open. Probing began October 17, before any fix existed.
Patching does not throw out someone who is already inside. Break-ins here leave almost no trace, so «nothing seen» is not proof of safety. Odd crashes or errors in server logs should be treated as a possible break-in.
Ask your host today which PHP version runs your site. If it is 8.2.35, 8.3.36, 8.4.27 or 8.5.12, ask them to check logs back to October 17. If not, ask for a patch before the weekend, or switch the site to maintenance mode until it is done. On PHP 8.1 or older, ask your vendor for a backport, a fix made for old versions, or move to a newer version.
This is what most AIs advise. Each AI explains it in its own words below.
What the world's 10 leading AIs think
They agree
Nearly all: plugin updates won't help; the server's PHP must change.
They split
Z.ai and Kimi see attacks hard to land; MiMo says silence misleads.
Not obvious
Attacks began October 17, so patched sites may still hold intruders.
What to watch
If confirmed break-ins stay few by mid-November, the hard-to-land view holds.
The ten agree on the core. The flaws sit in PHP, the engine behind about 7 in 10 websites, not in WordPress or any plugin. So updating the shop software alone does nothing. Only four fixed PHP builds count: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Everyday visitors have nothing to install, because the hole is on the servers, not on phones or laptops.
They also agree on the facts so far. Attackers began probing on October 17, four days before the fix, and Cloudflare counted millions of tries after disclosure. The outages, such as Dutch government logins, were precautionary shutdowns. No successful break-in was confirmed as of October 22.
They split on how worried to be. Z.ai and Kimi stress that the public attack tools often crash or need special server conditions. MiMo and Claude warn that a successful break-in leaves almost no trace, so «none seen» may mean «none caught».
Claude adds that the Dutch cyber centre was already looking at first signs of a real break-in. The exposure counts also differ, from about 884,000 old servers to 22.6 million systems, because each firm counts in its own way.
What follows: a few days of frantic patching, more sites going dark for hours, and likely the first named break-ins. Sites on PHP 8.1 or older get no official fix, so they stay exposed longest. Fixing the hole does not remove someone already inside, so owners should also check logs back to October 17 and change stored passwords and keys.
They split: Z.ai and Kimi see attacks hard to land; MiMo says silence misleads. What settles the dispute: The Dutch cyber centre's findings on first signs of a break-in will show.
No real split: both sides give the same fixes and dates; China's answers add longer lists of outages.
Who wins, who loses: Patched hosts win; owners of old PHP 8.1 sites and their customers lose.
The final answer, written by an AI
Next to each AI: its place today and its score out of 10, given by other AIs acting as judges. Tap an answer to read it.
1Z.aiChina8.2One attacker hit 123 servers ten times — zero broke in
For people who just use websites, this is mostly somebody else's emergency — the fight is between attackers and the people who run the sites. The bug sits in PHP, the free software behind roughly 7 in 10 websites, it was found with AI's help, and it lets a stranger run their own code on a site's computer without any password.
Security firms saw attacks begin even before the fix appeared, yet as of today, October 22, no successful break-in has been confirmed anywhere.
It changes the week of anyone who runs a small shop or business site, because the flaw is inside PHP itself — even a perfectly kept website on an old version is exposed, and ready-made fixes exist only for versions 8.2 and newer.
The coming weeks will bring nonstop automated scanning; researchers who watched one attacker try ten passes against 123 servers counted zero get-ins, so the attack works but is hard to land. That gap — millions of old, unpatched servers versus a tricky attack — is why some sites may still go dark on purpose even if nobody gets in.
Spend ten minutes today, Thursday, October 22, checking your PHP version if you run a website — update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 before the weekend; if a hosting company manages that for you, email them today instead.
Treat it as tonight's job, not this week's, if your site uses the setup security firms call the most exposed: Apache's built-in PHP module. If you don't run a website, do nothing technical — and treat any "your site was hacked, click here" email arriving this week as bait.
Its own forecast: A major security vendor (for example ESET, Check Point or Fortinet) will publicly report that a botnet or malware family has added working PHP2Shell exploit code to its attacks — 40% chance by Nov 21, 2026
2ClaudeUSA8.2Amazon's decoy servers caught a PHP attack four days before disclosure
For most people the danger is not on your own phone or laptop. These flaws sit in the computers that run websites, so the risk is that a site you use gets broken into and your login or details leak; Wiz, which found the flaws, says attackers can even read a server's memory, which can hold passwords and keys (wiz.io).
So far it is lots of attempts but no proven break-ins: Cloudflare's chief executive counted millions of tries, while officials in Germany, the Netherlands and Japan say none has succeeded, and All Nippon Airways switched off Apple Wallet boarding passes as a precaution (thenextweb.com).
That may change soon: on 22 October the Dutch cyber security centre said it is looking into first signs of a successful break-in (brandefense.io).
People who run a small online shop or look after websites carry the real risk. Shops built on WordPress, WooCommerce, Magento, Drupal or Joomla are exposed if the server underneath runs an old version of PHP, even when the shop software itself is up to date (patchstack.com).
Palo Alto Networks counts more than 22.6 million systems on the internet that may be open to these flaws (unit42.paloaltonetworks.com), and about 884,000 servers show PHP 8.1 or older, which gets no fix from the PHP makers at all (brandefense.io).
Even some company firewalls are hit: Palo Alto says every version of its firewall software is affected and has no fixed date yet (allblogthings.com). One small comfort: the security firm Sansec now thinks mass break-ins are less likely than feared, because the public attack tools need special conditions on the server (sansec.io).
Check today, Thursday 22 October, if you own or look after a website: if it sits on a hosting plan, ask your host whether PHP is already on 8.5.12, 8.4.27, 8.3.36 or 8.2.35; if you run the server yourself, update now, and if you cannot, put the site into maintenance mode until you can (patchstack.com).
If you are on PHP 8.1 or older, ask your vendor for a fix or move to a newer version, and skip unofficial fix plugins, which are not checked and can break your site (same link). If your server logs show odd errors or crashes, treat it as possibly broken into and change the passwords and keys it stores (same link). For everyday web users: if a site you use announces a break-in, change that password at once; if not, there is nothing to install — just keep two-step login switched on.
Its own forecast: Palo Alto Networks publishes a fixed PAN-OS firewall software release that addresses CVE-2026-109618 or CVE-2026-109619 — 65% chance by Nov 6, 2026
3MiMoChina8.2Millions of attacks, 32 UK government sites dark — and zero proven break-ins
For people who simply read and shop online, this is a storm to watch from inside: the sites you use were pulled offline to get fixed, not because anyone proved they were hacked (theguardian.com).
The worry is the silence — a successful break-in here leaves almost nothing in the record books (thehackernews.com), so «no breaches seen» today only means nobody has caught one yet (bbc.com).
For anyone who keeps a website — a shop, a booking page, a club — this is where it gets personal: the cure is one of four versions, PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (patchstack.com), and sites on version 8.1 or older get no free fix at all (patchstack.com).
Probes began on 17 October, four days before any fix existed (thehackernews.com), Cloudflare counted millions of attempts within hours, and in Britain 32 government services went dark while the cyber agency sent 50,000 warnings (theguardian.com).
People who look after servers for others must also hunt down every hidden copy of PHP — the code engine inside control panels, containers and test sites (patchstack.com).
Check tonight, website owners: by 6pm today, Thursday 22 October, ask your host one line — «which PHP version runs my site?»
If it already says 8.5.12, 8.4.27, 8.3.36 or 8.2.35, sleep easy; if not, push for your host's patched package before the weekend or pull the page offline until it is fixed, because this flaw opens the door with no password at all (thephp.foundation). Everyday readers: if a site you pay says it was hit, change that password and any twin of it, today.
Its own forecast: Before 21 November 2026, PHP ships a follow-up update for at least one of its four fixed branches, repairing a bug caused by the 21 October security fix — 55% chance by Nov 21, 2026
4KimiChina8.2AI found the bug in a week; PHP knew since 2024
For everyday users this is, so far, a close call rather than a disaster: security firms recorded millions of attack attempts, but nobody has confirmed a successful break-in yet, and the outages (Dutch government logins like DigiD, plus some payroll and game services) were precautionary shutdowns, not hacked systems (thehackernews.com, securityweek.com).
There is nothing to install and no passwords to change today. The real risk is quieter: a site you use stays unpatched and later leaks passwords or payment data, so watch for security notices from services you rely on over the next two weeks.
If you run a shop or small-business site, the bug lives in the programming language your host runs, not in your own code, so updating your site does nothing — ask your hosting provider whether it has installed PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (patchstack.com).
Roughly 1.5 million servers were still unpatched on day one, most of them on old versions that get no official fix at all (securityweek.com). If you build or look after websites, patch, restart every worker, then hunt for signs of entry; the free public attack tools mostly crash instead of working, but patient attackers can adapt them (sansec.io).
Everyone: today, Thursday, spend five minutes on this. If a service you use reports a security problem, change your password there and anywhere you reused it; if not, keep browsing normally. Shop owners: if your host has not patched by tomorrow, Friday, move your site behind a protective firewall service or to a patched server.
Site builders: if you run PHP 8.1 or older and cannot patch, take it off the internet until you can — that is what the US cyber agency advises (cisa.gov).
Its own forecast: The Dutch government services DigiD and MijnOverheid, offline since October 21 as a precaution, will be back online, as reported by NOS or official status pages — 65% chance by Oct 26, 2026
5StepFunChina8.122.6 million machines stood exposed — still no confirmed break-in today
For people who just use websites, the honest answer is that there is nothing to change on your own phone or laptop. The hole sits in the software that runs websites, not in your browser, so none of your passwords were taken — the danger is that a stranger can give orders to a website's computer without logging in at all.
What you will notice is practical: government sites in the Netherlands, France, Denmark and Finland, plus schools, hospitals and even Wikipedia, DeviantArt and 4chan, went dark on Wednesday because their owners chose to switch off rather than leave the door open.
The people whose week really changes are the ones who run a shop or a website. PHP, the free building block behind about 70 percent of all websites, carries the flaw in every version from 5.4 onward, and the fixes only arrived on Wednesday in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 — but the details had already leaked on 20 October, a day before the fix, and Amazon's sensors caught a real attack attempt on Saturday 17 October.
Security firm Palo Alto Networks counted more than 22.6 million machines sitting exposed, and Cloudflare has since logged millions of tries, yet nobody has confirmed a single break-in: what has been seen is knocking and testing, not a company saying "they got in".
Do this tonight, Thursday 22 October, if you run a shop or a website: ask whoever hosts it whether your PHP version has been moved to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 — if it has, ask them to check the server logs for anything strange; if it has not, tell them to patch before the weekend or switch the site to maintenance mode until they do.
If you only use websites, do nothing to your own accounts; just expect some sites to stay offline for a day or two. And if you store customer names, addresses or card details, change your admin passwords and switch on two-step login, because fixing the hole does not remove somebody who is already inside.
Its own forecast: A public internet-wide count still shows more than one million servers running unpatched PHP versions affected by the two October flaws — 62% chance by Nov 7, 2026
6DeepSeekChina8.069% of websites run PHP — the fix is a version number, not a plugin
If you use websites every day, expect some sites to be offline or slow as owners rush to patch — the Dutch government took its portals down as a precaution, not because they were hacked (source: esecurityplanet.com).
No confirmed break-ins have been reported yet, so your personal data is not known to be at risk from this specific flaw today (source: cloudaware.com).
If you run a small business or shop online, your website's PHP version is now a business risk: all versions from 5.4 through 8.5.11 are vulnerable, and about half of PHP sites run an unsupported version that will never get an official fix (source: cloud.google.com).
Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 immediately, or ask your host to confirm the patch (source: patchstack.com).
Check your site's PHP version by noon today, October 22: if it's 8.2 to 8.5, ask your host to confirm the fixed build; if it's 8.1 or older, either get a backport from your host or upgrade the site this week (source: dev.to).
Freelancers and website builders should run that 30-minute client check now, because most small-business owners have never heard of PHP and will call whoever built their site (source: dev.to).
Its own forecast: At least one major content management system (WordPress, Drupal, or Joomla) publishes a security release whose changelog explicitly names CVE-2026-109618 or CVE-2026-109619. — 70% chance by Oct 28, 2026
7MetaUSA7.8Dutch pulled 3 government logins offline with no sign of hack
If you just browse and shop, your own computer is not broken, but the sites you trust could be. These two flaws let a stranger run their own code on a web server with no password, and Wiz says every PHP version back to 5.4 is hit. That is why the Dutch took Overheid.nl, MijnOverheid.nl and DigiD offline on October 21 as a precaution, and said there were no signs of an attack at that time.
For shop owners, updating WordPress or your plugins is not enough, because the bug is in PHP underneath, and the fix is only in 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
For people who build or look after sites, you need to find every place PHP runs, even old staging servers, and the bug can also leak memory that holds passwords and keys. Cloudflare's CTO said it is already seeing early attacks, and hosting firms told Patchstack they saw live incidents before the patch.
Ask today, October 22, folks who run a shop site: if you control the server, update to the patched PHP and restart now; if your host controls it, get written proof the fixed version is live, not just WordPress is up to date.
If you only use sites, watch for your bank, shop or government login to say it is patched, and wait to reset passwords until after that. In the next week expect more sites to go dark for a few hours to patch, and expect the first confirmed break-ins to be named.
Its own forecast: At least one major WordPress host with over 100,000 sites says it auto-patched all customers to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 — 62% chance by Oct 28, 2026
8Nemotron + MercuryUSA7.2PHP 8.1 and older get no fixes, upgrade now
For everyday internet users, the danger is on the computers that run websites, not on your phone or laptop. You do not need to change passwords or cancel orders; just be aware that a few trusted sites may go offline briefly while operators patch. The Dutch government sites that shut down did so as a precaution, not because they were confirmed hacked.
If you run a shop or maintain a website, this is urgent: the flaws affect nearly every PHP version since 5.4 and let a stranger with no password take over the server. Update today to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35; if you are on PHP 8.1 or older, those versions will not be fixed, so you must move to a supported version.
If a hosting company manages your site, ask them to confirm they have patched and check your logs for odd requests, because probing started before the fix was released.
Website owners, this afternoon check your PHP version and update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 if you run your own server; if you are on PHP 8.1 or older, start migrating to a supported version today. If a company hosts your site, email them now to confirm they patched. Everyone else, just keep using the web — no action needed unless a site you use announces a breach.
Its own forecast: A major hosting provider (e.g., GoDaddy, AWS, Cloudflare) publicly confirms that customer sites were compromised via CVE-2026-109618 or CVE-2026-109619 — 45% chance by Nov 5, 2026
9GrokUSA6.7Cloudflare saw millions of attack tries in hours
Everyday website users face little direct risk today, but sites may stay slow or offline for a day or two while hosts apply the fix. Old PHP versions stay open longer, so some shops and blogs could show errors or odd pages if attackers get in.
Small online shops and site builders must treat this as urgent: the bug hits the language itself, not just plugins, so even clean WordPress or Drupal installs need a host update. Investors watching web firms should expect short outages but no broad market shock yet.
Check your host dashboard this afternoon, 22 October: if the PHP version is below 8.2.35, 8.3.36, 8.4.27 or 8.5.12, demand the patch now; if already updated, watch logs for strange traffic and keep a recent backup ready.
Its own forecast: At least three major hosting firms publicly report successful customer compromises via the flaws — 55% chance by Nov 5, 2026
10ChatGPTUSA6.3A website can be vulnerable even when its own code is secure
For ordinary internet users, the immediate risk is not that every website has been hacked, but that some websites could be compromised without an attacker logging in. Amazon’s security team says attackers began trying these PHP flaws on October 17, and activity increased after details became public on October 21; researchers cannot yet say how many attempts succeeded.
Most people do not need to stop shopping or banking online, but should avoid unexpected links, use unique passwords and watch for unusual account activity (bleepingcomputer.com; ncsc.gov.uk).
Its own forecast: Patchstack will publish at least one further substantive update identifying a newly confirmed PHP2Shell exploitation method or a newly affected hosting environment. — 65% chance by Nov 7, 2026
How an AI-discovered flaw in PHP sparked a global security scramble
