Government services across Europe, police and council sites in the UK, a US credit union’s online banking and, for a while, even Australia’s own cyber security website, cyber.gov.au, were unavailable on 21st and 22nd October and it was big news. Most were not responding to a hack, they were simply taking cover while they waited for an emergency fix to PHP, the software that quietly runs most of the internet.
If you own a website, this one is worth five minutes of your time. Here is what happened, in plain English, and what to take away from it.
In August, two security firms, Calif and Wiz, each found serious flaws in PHP itself. Working with OpenAI and the PHP team, they reported them privately so a fix could be built before anyone else knew. That fix was due to be released on Thursday 22 October.
On 20 October, word got out early when a post on a tech forum revealed the flaws’ reference numbers (CVE-2026-109618 and CVE-2026-109619) and claimed they would be announced that Thursday. To be clear, no PHP code was leaked and no technical details came out, only the fact that the flaws existed. That was out of the ordinary and once security firms confirmed they were real, the internet nicknamed them “PHP2Shell”, and the PHP team brought the release forward by a day.
Australia’s Cyber Security Centre issued a critical alert on Wednesday afternoon. The fixed versions of PHP arrived just before midnight that night, Brisbane time.
Imagine the lock fitted to seven out of ten front doors in the country has a hidden fault. Inspectors find it and quietly tell the manufacturer, who starts making a replacement. The plan is to announce the recall and hand out new locks on the same day, so burglars never get a head start.
Then someone overhears that a recall is coming. The new locks are not ready yet, but word spreads that a weakness exists, and a few burglars start walking the streets trying door handles. Some building managers lock the whole building and close the front office until the new locks arrive, that is what all those offline websites were doing.
A few things follow from the picture. Rearranging the furniture or upgrading the alarm (updating WordPress and plugins) does nothing, because the fault is in the lock. Usually it is the building manager, your hosting company, who fits the new lock, not you. A security guard at the gate (a firewall like Cloudflare) can turn away the burglars he recognises, but he is not a new lock. And once the new lock is on, it is worth checking that nobody slipped in while the old one was faulty.
Most website security scares involve a single plugin or theme. This one sat underneath all of that, in PHP, the engine that builds every page of a PHP website. PHP runs approx. 70 per cent of websites whose server software is known, so the reach was enormous.
That also meant the usual advice did not apply. Updating any WordPress CMS, your plugins or your theme did nothing to fix it. The fix had to be installed on the server, which for most small businesses means by their hosting company.
The flaws were also about as serious as they come. Both were rated 9.2 out of 10. Researchers showed that someone with no login at all could take control of a standard, freshly installed WordPress, Drupal or Joomla website.
And attackers did not wait. Amazon later found an attack attempt from 17 October, four days before any fix existed. Cloudflare saw thousands of attempts in the hours before the release. Meanwhile, on release day, security firm Censys counted about 1.57 million of the 1.58 million public servers showing a PHP version as still unpatched. That gap is why so many organisations simply pulled the plug and patched behind closed doors.
Australia was not spared. On the night of 21 October, cyber.gov.au, run by the government’s own Australian Cyber Security Centre, was among several federal government websites that were temporarily unavailable. A spokesperson for Home Affairs Minister Tony Burke said some sites were down while work was done to reduce the risk. In New South Wales, some state government websites were taken out of service while patches were applied, and the NSW Government said the next day that no agency had reported a breach.
In the United States, CISA, the NSA and the FBI urged organisations to patch PHP or take vulnerable systems offline, and New York’s financial regulator told the banks and insurers it oversees to do the same. MSU Federal Credit Union in Michigan, with approx. US$8.9 billion in assets, switched off its website and online banking for about a day while it patched, and said member information was not affected. Wikimedia, the organisation behind Wikipedia, also took some of its systems offline as a precaution.
Elsewhere, the list was long. In the UK, the Metropolitan Police, the Office for Budget Responsibility and councils including Edinburgh and Oxford went offline. The Netherlands saw the most disruption, with the DigiD government login, the Port of Rotterdam and several hospitals affected. Finland, France, Denmark and the Czech Republic took government services down, and in Japan some of the largest banks paused parts of their online services while the Prime Minister urged website owners to apply the fix.
Almost all of these were precautions, not break-ins. They show how seriously the biggest organisations in the world took this, and how few of them could say with confidence, on the day, exactly which of their systems ran PHP.
Both research teams used AI to find these flaws. Wiz says the faulty code had sat unnoticed in PHP for more than a decade, and that AI made it practical to understand the weakness and prove it could be used in a real attack.
That is good news for defenders, but it cuts both ways. The same tools help attackers turn a newly announced flaw into working attack code faster than ever. The time between “a problem is announced” and “someone tries it on your website” is now measured in hours, not weeks.
At the time of writing, most of the attack code circulating publicly does not work, and no large-scale break-ins have been publicly confirmed. That is unlikely to last. Several security firms have already built working attacks in their own labs, so the risk now sits squarely with websites that have not been updated.
There is also more to come. On 23 October, PHP disclosed a third, smaller flaw in the same area, to be fixed in its next regular update. PHP has also been open that it knew about early signs of the underlying problem in 2024 and was too slow to act, and says it is changing how it handles these decisions. Expect PHP updates to keep coming, and treat them as seriously as WordPress updates which should always be regular.
When the news broke on Wednesday, we went through every client website we look after. For each one, we confirmed which version of PHP it was running, checked the fixed release was installed and active, and looked for anything out of the ordinary. We found no signs of trouble on any of them.
We kept a close eye on traffic for the rest of the week and got in touch with our clients to let them know we were on it. Most people never see this side of looking after a website, and it’s exactly what it’s for.
Information current as at 25 October 2026.
📊 Accommodation Rate Parity Analysis Strategic Revenue & Asset Valuation Analysis — Replicating professional RMS distribution methodology to identify revenue…
Read more
Explore how artificial intelligence is revolutionalising digital marketing and how you
Read more
WCAG is the accessibility standard Australian courts use as a benchmark under the Disability Discrimination Act. What it is, who…
Read moreLet's discuss how Gravity Projex can help accelerate your business growth.
Launch Projex