php2shell: the security vulnerability that can take over your website

what happened on 21 october?

On the evening of 20 October the developers of PHP warned: a critical security update is coming tomorrow. That was all they said. On 21 October the vulnerability went public. Earlier than planned, because according to reports details had already leaked. For everyone running a PHP website that meant: no time to breathe.

The headline of the official warning on php.net leaves no room for doubt: "Critical remote code execution vulnerabilities, update now". In plain words: critical vulnerabilities that let strangers run code on your server from afar. Act now.

The Austrian daily derStandard calls them extremely dangerous vulnerabilities. They were found by the security firms Calif and Wiz together with OpenAI, with the help of artificial intelligence. According to the researchers the root of the problem goes back to 2004. Until now nobody had shown that it can be turned into an attack.

why is this so dangerous?

Because PHP is almost everywhere. According to W3Techs, 69.3 percent of all websites whose technology can be detected run on PHP. Your company website on WordPress, the online shop, the reservation system, the customer portal: if PHP runs underneath, it was open to attack until the update.

And because the vulnerability is not in a plugin you can simply switch off, but in PHP itself. It does not help that WordPress or your shop is up to date. What matters is the PHP version on the server underneath, and in many companies nobody looks after that.

Security researchers estimate there are more than a million vulnerable servers on the internet. The researchers state they used the vulnerability successfully against WordPress, Joomla, Drupal, Magento, Nextcloud and phpMyAdmin. Exactly the systems businesses run every day.

what can an attacker do with your website?

Pretty much anything. Whoever can run commands on your server has taken it over. That means:

• Copy customer data, orders and enquiries from the database. Under the GDPR you are liable for a data breach, not the attacker.
• Grab passwords and access keys. One of the two vulnerabilities allows reading the server’s memory, and that is exactly where such data sits.
• Change your website. Redirect visitors to scam pages, deliver malware, build in fake payment pages.
• Leave a back door and come back whenever it suits the attacker. Weeks later, even after your update.
• Use the server for extortion. According to the security firm Tenable, earlier PHP vulnerabilities have already been used in ransomware campaigns, where data is encrypted and only released for a ransom.

And the nasty part: at first you notice nothing. The website looks the same as always. Whoever plants a back door does not want to be seen.

is the vulnerability already being exploited?

Austria’s CERT.at reports that attack code has already appeared online. Several security firms report first attacks on their trap servers, which are set up for exactly that purpose. The EU’s cyber security body CERT-EU warns that this raises the likelihood that attackers are already exploiting the vulnerabilities. According to the security firm Patchstack, hosts reported first attacks as early as the morning of 21 October.

Germany’s BSI had no confirmed attacks on 21 October. Nobody should rely on that. Two earlier PHP vulnerabilities from 2019 and 2024 were actively used in attacks after they became public, some for extortion. Waiting now means betting that this time will be different.

who pulled the plug?

CERT.at advised shutting affected systems down where possible in the night before the vulnerability went public. Many did. According to media reports the University of Vienna, TU Wien, WU, BOKU, MedUni Wien and JKU Linz switched off websites, webmail, learning platforms and online forms. Media houses and organisations such as NÖN and Caritas were also unreachable for a while.

According to derStandard, large web hosts also switched services off as a precaution until their servers were updated. In the Netherlands, according to reports, one host took its customers’ websites offline, along with government online services. In Germany, according to media reports, the websites of several federal ministries were down for a time.

The hardest hit were companies whose software still runs on PHP 8.1 or older. There is no official update for those versions any more, and their old code does not run on a newer version without changes. All they could do was switch off. A booking system that cannot be reached takes no bookings. A shop that is offline sells nothing.

is your website affected?

If your website, shop or software runs on PHP and you do not know for sure that it has been updated since 21 October: yes, possibly. Settle these three questions today.

• Which PHP version runs on your server, and has it been updated since 21 October? Ask your host or your agency and get it confirmed in writing.
• Is it still PHP 8.1 or older? Then there is no official update and you have to move. How to do that without your software going down is in our article Upgrading your PHP version.
• Has anyone checked whether new or changed files sit on the server? The UK’s NCSC explicitly advises looking for back doors. An update shuts the door, but it does not throw out anyone who is already inside.

why our clients could sleep soundly

The websites we build at creatingfaces run on Next.js, not PHP. The same goes for the booking software and CRM systems we run for our clients. While others had to switch off on 21 October, none of ours were affected. Not a single system had to go offline, everything was reachable all day.

Where our clients use WordPress, it always sits on managed servers. There the large hosting provider is responsible for closing PHP vulnerabilities like this one, with its own security team whose job is exactly that.

And in case someone does get through one day, most of our clients have a second safeguard: our reporting automatically detects when code changes on an instance or new files are placed there, whether WordPress, Shopware or another system. The very back door the authorities are now warning about gets noticed before it is used.

• php.net: Security advisory, 21.10.2026
• CERT.at: Kritische Sicherheitslücken in PHP, Updates verfügbar
• BSI: Cybersicherheitswarnung PHP
• CERT-EU: Security Advisory 2026-018
• NCSC UK: Critical security issue affecting PHP
• derStandard: Warnung vor extrem gefährlichen PHP-Lücken
• MeinBezirk: Webseiten österreichischer Organisationen und Firmen down
• Tenable: PHP2Shell FAQ
• Dr. Web: Erste Angriffe auf PHP-Lücken (Patchstack)
• Calif: PHP2Shell
• W3Techs: Usage statistics of PHP
• W3Techs: PHP 8 Versionen

As of 21 October 2026. The situation is changing constantly, and we keep this article up to date. We calculated the share of websites without an official update from the W3Techs version figures.