Your favorite websites are down due to an internet-breaking PHP security flaw

Credit: Lucas Gouveia / Justin Duino / How-To Geek Published Oct 21, 2026, 12:54 PM EDT Jon is a seasoned journalist who has written definitive coverage of consumer tech at publications like Engadget, Android Authority, and BetaKit. He's an expert on making tech accessible ranging from mobile and PCs to emerging platforms like wearables. When he's not writing, he's going on adventures with ihis family and is an avid photographer. Sign in to your How-To Geek account If your favorite website is down for maintenance today (October 21), you now know why. The developers of the PHP scripting language have released emergency patches for two "critical" vulnerabilities that hackers can use to compromise web servers. The updates close two flaws (CVE-2026-109618 and CVE-2026-109619) used by PHP2Shell, an exploit tool that can remotely run code in PHP's core engine on servers running a wide range of platforms, all without logins. Examples seen so far include WordPress, MediaWiki, Joomla, and Drupal. Some of these targets have already patched their code, but security researcher Silas Cutler estimates that as many as 1.3 million hosts are at risk. Websites vulnerable to the attacks have also gone offline to either install or prepare for the fix, including European Union (EU) government sites. Asana, GOG, and Wikipedia. Prepping can be extensive and includes taking stock of every potential vector, backing up data, and in some cases disconnecting systems that aren't crucial. The exploits affect many PHP versions. Security firm WatchTowr claims PHP2Shell compromises releases dating back to 2004. Should I update to protect against PHP2Shell? Don't even hesitate It's common practice for website owners to delay installing updates to ensure they don't break vital functions. However, this is a notable exception. Users are "strongly encouraged" to install the PHP2Shell patch "immediately," the PHP team says. Multiple security firms warned that attacks could start soon after the exploit tool became public. While it's not clear if there are any significant issues with the fix, the consequences of leaving a website susceptible far outweigh the possible side effects. Intruders can use PHP2Shell to take sites down, steal sensitive data directly from memory, and bypass security in otherwise well-protected apps. Many major sites are likely to be safe now or in the very near future. However, PHP 8.1 and earlier releases are deprecated and don't receive typical security updates. That could leave some servers permanently vulnerable, particularly for rarely maintained sites and Internet of Things (IoT) devices that won't (or can't) get relevant patches.