PHP2Shell: Why a Security Flaw Should Concern All of Us

As of October 22, 2026, two critical vulnerabilities have been discovered in PHP. They’re collectively being called PHP2Shell, and they’ve both received a severity rating of 9.2 out of 10.

The potential consequences are serious enough that governments have issued emergency warnings, and some organisations have temporarily taken websites offline while applying fixes.

So, what does this mean for us in the world?  Is the Internet going down? Has the world been hacked?  Let me see if i can clear up what this actually means, and add my two cents on a fundamental issue this is highlighting (in my opinion).

What is PHP2Shell?

Researchers discovered two serious flaws in the way PHP handles computer memory, and they are collectively being named PHP2Shell.

Normally, when you visit a website, PHP processes your request and uses some temporary memory to do its job. When finished, it cleans up that memory so the next request starts safely.

The newly discovered flaws can interfere with that process.

One flaw involves PHP becoming confused when it runs out of memory. The other involves PHP accidentally using memory that has already been released.

The frightening part is that hackers can potentially manipulate these mistakes to make a website’s server execute instructions it was never supposed to execute.

And they may be able to do this without knowing a password, having an account or convincing someone to click a malicious link. 

Why is this so dangerous?

Imagine that someone discovers a way to send a specially written request to a restaurant’s kitchen. Instead of simply ordering a hamburger, that request tricks the kitchen into giving the stranger control over its equipment. Suddenly, that stranger might be able to change orders, make a copy of a customer’s personal information and banking detail when they pay via credit card, leave the kitchen and go to the manager’s office to use the restaurant’s financial records, or shut the kitchen and restaurant down entirely.

That’s essentially what could happen to a vulnerable website.

Stealing information: Hackers could potentially retrieve customer records, private documents, passwords or financial information stored on the affected server.

Changing information: They could modify website content, tamper with records or potentially redirect visitors to malicious websites.

Holding organisations hostage: Depending on the access obtained, attackers could install ransomware, disrupt operations or use the compromised server to attack other systems.

Taking services offline: Websites supporting healthcare, government services, businesses and other essential operations could become unavailable.

These are potential outcomes, not evidence that every vulnerable website has been compromised. The attacker’s actual capabilities depend on the server’s configuration and security protections.

But, the situation is leading to a higher level of attack traffic, as people look to exploit these weaknesses.  Cloudflare, one of the leading CDN and reverse proxy companies (for those who don’t know, you can think of Cloudflare like a digital bodyguard and high-speed delivery service for websites) are reporting that they are seeing an increase in said traffic.

Does this mean 70% of the Internet has been hacked?

Absolutely not. And this is an important distinction. The approximately 70% figure describes how widely PHP is used, not how many websites have been compromised.

There are three very different things:

1. Using PHP: A website relies on the technology.
2. Being vulnerable: The website uses an affected version and could potentially be attacked.
3. Being compromised: Someone has successfully exploited the vulnerability.

Only the third means a successful attack has happened.

The Canadian Centre for Cyber Security has confirmed that working demonstrations of the vulnerability exist, although its October 21 advisory stated that active exploitation had not been identified at that time. Other security reporting has described early attack activity.

Why is everyone rushing to fix this?

There are two reasons.

First, the vulnerability exists in PHP itself, rather than simply in one particular website or plugin.

That means an otherwise well-maintained website could still be vulnerable because the underlying software has the problem.

Second, now that the vulnerability is publicly known, criminals can study how it works and attempt to exploit websites that haven’t been updated.

This creates a race between website administrators installing security updates and attackers searching for vulnerable systems.

The PHP developers released emergency fixes on October 21. Organisations are being urged to apply them immediately.

What should ordinary Internet users do?

For someone who simply uses websites, there isn’t much that needs to be done directly.

The responsibility for fixing this issue lies primarily with website owners, hosting providers and software vendors.

Keeping devices updated, using unique passwords and enabling two-factor authentication are still sensible precautions. However, changing your password does not fix a vulnerable PHP server.

For businesses operating websites, the situation is more urgent. They need to establish whether their websites use vulnerable PHP versions, install the security fixes and check for evidence of suspicious activity.

The Canadian Centre for Cyber Security recommends immediate updates, particularly for websites accessible from the public Internet.

So how big a deal is this, really?

The official vulnerability severity has been set to 9.2 out of 10.  That’s…pretty high.

Now, note that this is a technical severity score, not the percentage of websites compromised.

This is one of those vulnerabilities that security professionals take extremely seriously because it affects a widely used piece of software, can potentially give attackers substantial control over servers, and doesn’t necessarily require stolen credentials.

But there is also good news: fixes already exist. The most important task now is getting those fixes installed everywhere they’re needed.

The reason I am blogging about this (my opinion)

Security vulnerabilities happen. That’s just part of living in a technical world. However, this latest incident highlights how Internet and technology security still aren’t receiving the attention and investment they deserve.

According to AppSecNews, of the websites that use PHP, roughly 48.5% (almost half) run a version that is no longer officially receiving security updates. Now, that doesn’t necessarily mean all those websites are vulnerable to these particular flaws, but it does highlight a much larger problem.

Before anyone asks why these companies don’t simply update their software, there’s another issue to consider. Upgrading from an older version of PHP to a current version isn’t necessarily straightforward. Applications can break, customisations may need to be rewritten, and integrations that have worked for years might suddenly stop functioning. For some organisations, particularly smaller businesses and nonprofits, this can represent a significant financial and technical undertaking.

And that’s precisely the point I’m trying to make.

Here in 2026, we’ve built a world where healthcare systems, banking, electricity distribution, water treatment, transportation, emergency communications, food supply chains and government services all depend on interconnected digital infrastructure to varying degrees.

Yet too often, the budgets allocated to maintaining and securing that infrastructure don’t reflect just how dependent we’ve become on it.

Instead, the onus is frequently placed on the end user. People are told to use strong passwords, enable MFA, recognise phishing attempts and keep their software updated. Now, don’t get me wrong, this is all sensible advice. But it doesn’t address the systemic problem of keeping the fundamental tools and infrastructure that power our digital world secure and up to date.

We’ve built a society that depends on digital infrastructure, yet we continue to treat maintaining that infrastructure as an optional expense.

Technical debt doesn’t disappear because we ignore it. It accumulates, and eventually the bill comes due. Sometimes in the form of an expensive upgrade. Sometimes in the form of a security emergency.

I truly hope that governments and private companies take a serious look at how we got here, and what needs to change, once the immediate crisis has passed.

And maybe…just maybe, it’s time we stopped treating Internet security as an IT expense and started treating it as essential infrastructure.

My belief in a nutshell?

Is the Internet necessary for human life, like clean air and water? No.

Is the Internet necessary for human life as we have created for ourselves in 2026? Yes.