Authored by: Bryan Lachapelle, President & CEO
Authored by: Ashley Barron, Sales & Marketing Manager
If a website or online tool you use has suddenly gone offline, switched to read-only, or is showing a "temporarily unavailable" page this week, there's a good chance it's connected to a security issue called PHP2Shell. Businesses, governments and software companies around the world are pulling services offline as a precaution while they roll out a fix. Here's what's going on, and why it matters for your business.
So what is PHP? It's a programming language, which is basically the set of instructions developers use to make websites actually do things. It's often what's working behind the scenes when a site talks to a database (like when you log in, fill out a form or check an order) or when something runs automatically in the background. It has been around for decades and powers a huge share of the internet, including WordPress, Drupal and Magento sites, plus plenty of business software that never mentions it. The short version: if a website or tool you rely on uses PHP, that's a good reason to ask your provider how they're handling this.
On October 20, details about two critical flaws in PHP (tracked as CVE-2026-109618 and CVE-2026-109619) leaked online before a fix was ready. Normally, a security team prepares a patch quietly and announces the problem at the same time, so everyone can update before attackers catch on. This time, the details got out early.
Researchers describe the flaws as "remote code execution." In plain terms, that means an attacker could potentially get a vulnerable web server to run commands of their choosing. The PHP security team rated both flaws 9.2 out of 10 for severity.
That's why so many organizations have hit pause. HR platform BambooHR took its app offline, saying the issue affects software it uses. In the Netherlands, government services like DigiD and MijnOverheid went offline along with the House of Representatives website, and media company DPG Media in Belgium and several major services in Japan did the same. Going offline doesn't mean these organizations were breached. It means they chose to play it safe until they can safely apply the update, and with security companies already reporting early attack attempts, that's a responsible call.
Here's the good news: the fix is out. On October 21, PHP released security updates for every supported version: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP is strongly encouraging everyone to update right away, and says the risk applies to any PHP installation that serves websites.
That said, a released patch doesn't mean every site is fixed. Web developers still need to apply the update to each website, then test it to make sure everything still works the way it should. For some sites, that will be quick. For larger or more complex platforms, it could take a day or more before things are fully back to normal, so it's worth being patient with services that stay offline a little longer.
Older versions are a different story. PHP 8.1 and anything older are "end-of-life," which means the PHP project no longer releases regular updates for them. Because this issue is so serious, PHP did share some basic fixes for versions 7.4, 8.0 and 8.1, but those are meant for technical teams building PHP themselves. Some hosting providers and software vendors also offer their own fixes for older versions. If a website or tool you rely on still runs one of these, it's worth asking your provider what they're doing about it, and whether it's time to upgrade.
This is a good reminder of why keeping software up to date matters. Updates aren't just about new features. They're often how developers close security gaps, and older, unsupported software is where attackers tend to find the easiest way in.
You may also see quick "workarounds" shared online, mostly settings changes. PHP has listed a few that can reduce the risk for teams who can't update right away, but it's clear that none of them make a website safe. Updating is the only complete fix.
Some companies are adding protective filters in the meantime. Cloudflare, for example, rolled out firewall rules for websites that run through its network, but described them as a stopgap. Filters like these help, but they don't replace the actual update.
For most businesses, PHP isn't something you'd patch yourself. It usually lives with your website host or inside the cloud tools you already use. That makes the first step a conversation, not a technical fix. Here are a few questions worth asking your web host, website developer or software vendors:
- Does our website, or any software we use, run on PHP?
- Which version is it, and is that version still supported?
- What's your plan for applying the patch, and when?
- Is there any downtime we should plan around?
If a service you use is offline right now, the best thing you can do is check its status page and plan around the downtime, especially if payroll or other time-sensitive tasks are coming up.
We'd also suggest being extra careful with emails about this issue over the next few days. Scammers love a big headline, and while plenty of vendors will send real updates, an unexpected message asking you to log in or "fix" something is a classic phishing move. If something feels off, check with your IT team before clicking.
Things are changing by the hour, and we'll update this post as more details come out. In the meantime, if you're not sure whether your website or tools are affected, or you'd like a hand figuring out what to ask your vendors, we'd be happy to help. Just reach out to our team at 905-228-4809 (Niagara) or 705-885-0993 (Barrie).
Sources:
Huntress: Rapid Response on php2shell
PHP: Security advisory and release announcements (October 21, 2026)
BambooHR status page
Patchstack: PHP major vulnerability alert
ITdaily: DPG Media sites offline and Cloudflare WAF rules
Tenable: php2shell FAQ
