PHP, the language behind WordPress and a large share of the web, shipped emergency fixes on October 21 for two critical flaws that let an attacker take over a server without a password. Security firms say attack attempts are already under way. Ordinary users can't patch PHP; the people who run web servers have to. What reaches everyone else is what usually follows a big breach story: "your card was exposed" texts and fake security alerts.

Key facts

  • What: Two flaws in PHP, CVE-2026-109618 and CVE-2026-109619, nicknamed "PHP2Shell", rated 9.2 out of 10; an attacker can run code on a server without logging in
  • Fixed in: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released October 21, 2026; PHP 8.1 and older get no fix
  • When: The flaw IDs leaked early on October 20 on Hacker News; full disclosure had been planned for October 22
  • Attacks: Cloudflare and watchTowr report attack attempts; the PHP Foundation said it saw no working exploit at release
  • Source: Dutch NCSC php2shell page and CERT-EU advisory 2026-018

What happened

PHP is the code that runs behind most WordPress sites, online shops, forums and plenty of crypto blogs and exchange support pages. On October 21 its developers patched two flaws that let an attacker run their own code on a server without logging in. The identifiers leaked a day early on Hacker News, so the race to patch started before the fixes were out. Amazon says its decoy servers logged a first attempt on October 17. That's a warning sign, not proof that sites have been broken into. So far there's no public list of hacked sites, and there may never be one.

Why it still reaches you

When a server is taken over, what usually leaks is a customer list: names, emails, phone numbers, sometimes order history. That data turns up weeks later as messages that look like they come from a shop or service you really use. A breach that's in the news also gives scammers a ready story, so expect the name "PHP2Shell" in the scams themselves.

The scams to ignore

  • "Your card was exposed" texts. A message says your card or account was caught in a security breach and asks you to "verify" or "secure" it through a link or a phone number. Your bank won't ask you to confirm a card number, PIN or code that way.
  • "Urgent PHP security update" emails, if you run a website. The email claims to be from your host or a security company and links to a login page or a "patch" to install. On shared hosting your host patches PHP for you. A link that asks for your hosting password is the attack.
  • "Your wallet was in the breach" messages. No breach notice needs your recovery phrase or a signature. If you're unsure, run it through our 2-minute scam check.

What we don't know yet is which sites, if any, were hit, so nobody can honestly tell you your data is safe or that it leaked. That's why the next step works either way. If a text or email about a breach asks you to act, don't use its link or its phone number. Open the company's app, or call the number on the back of your card, and ask there. If you run a site, ask your host which PHP version it's on and whether it's patched. Ask them yourself, not through a link someone sent you.

Sources: Dutch NCSC: php2shell operational information, CERT-EU security advisory 2026-018, Help Net Security, The Hacker News, Tenable FAQ.