Last updated: 21 October 2026
Today, 21 October 2026, a lot of websites have gone offline or are showing a "temporarily unavailable" notice, including the WordPress sites we host. Nothing has broken. Hosts and agencies are taking sites down on purpose, as a precaution against a serious security flaw in PHP.
If your site is offline, or you're wondering why it isn't, here's what is going on, without the jargon.
First, what is PHP?
PHP is the programming language that runs behind the scenes on a huge share of the web. Every time someone loads a page on a WordPress website, PHP is what builds that page, sends the contact form and runs the plugins. WordPress, WooCommerce, Magento and plenty of other website systems all depend on it.
So when PHP itself has a problem, it isn't one website's problem. It's everyone's.
What is the flaw?
Today the PHP project released an emergency update for two critical vulnerabilities, officially CVE-2026-109618 and CVE-2026-109619. Security researchers have nicknamed them PHP2Shell.
In plain terms: a stranger can send one specially crafted request to a website and take control of the server behind it, without needing a password. Researchers have shown this working against WordPress and other popular systems. One of the two flaws can also leak fragments of the server's memory, which can include passwords and security keys.
Three things make this one unusually serious:
- It's in PHP, not in a plugin. Usually a WordPress security issue sits in one plugin, and updating that plugin fixes it. Here, nothing you change inside WordPress will help. As Cloudflare puts it, updating website code or plugins "alone does not fix these vulnerabilities". The fix has to go onto the server itself.
- It reaches back years. The security firm Sansec reports that the vulnerable code dates back to 2012, and that default settings are vulnerable.
- Older versions of PHP get no fix at all. Updates have been released for PHP 8.2, 8.3, 8.4 and 8.5. Anything on PHP 8.1 or older is out of support, so the only way to protect those sites is to move them to a newer version.
Why are so many websites offline?
Because there is a gap between "a fix exists" and "the fix is on your server".
Most hosting companies don't install PHP straight from the PHP project. They use packaged versions from their server software vendors, and those packages take time to build, test and release. Right now, many servers are sitting with a known, public, critical flaw and no update to install yet.
During that gap, the safest option is to stop PHP running at all. That's why so many sites are showing a holding page today.
One detail matters here. A normal WordPress "maintenance mode" plugin doesn't help, because that plugin runs on PHP too. The block has to sit in front of PHP, at the web server, so the vulnerable software is never touched.
Why some websites aren't affected
Not every website runs PHP.
As well as WordPress sites, we build bespoke websites on a modern framework called Next.js. They don't use PHP anywhere, and there are no plugins or WordPress core to keep patched. They aren't exposed to PHP2Shell, and they've stayed online throughout. This website is one of them.
This is part of why we often recommend a bespoke build. WordPress is still the right choice for many businesses, particularly if your team wants to update the site regularly themselves. But a WordPress site depends on WordPress, its plugins and the PHP underneath all being kept up to date, and today is a clear example of what that means in practice.
What we've done for the sites we look after
For our hosting and maintenance clients, we have:
- Checked which version of PHP every site was running as soon as the advisory came out, and moved the sites on a version that will never get a fix onto a supported one, so they can take the patch the moment it is available.
- Set up an automatic alert for the patched version, so we know as soon as it reaches our servers rather than waiting for the routine overnight update.
- Taken our hosted WordPress sites offline as a precaution. Each one shows a short notice with that business's own phone number and email address, so their customers can still get in touch. The notice is served by the web server, so PHP never runs.
- Emailed every affected client this evening, explaining what is going on and what it means for their contact forms and online bookings.
Most of the sites we look after also sit behind Cloudflare, which has been blocking the known attacks since early this morning (more on that below).
The sites will stay offline until the patched version of PHP is installed on the servers they run on. Our bespoke Next.js sites have needed none of this.
What the experts are saying
The security industry is treating this as one of the big ones. Researchers at the cloud security firm Wiz said the findings "rank among the most severe vulnerabilities discovered in PHP", as reported by Help Net Security. Sansec says it expects "mass exploitation now that the patch and the writeups are public".
Attacks have already started. Cloudflare reported early attacks this morning, before the fix was even released, and the security firm watchTowr says it is seeing active exploitation attempts against both flaws. At the time of writing there are no public reports of confirmed break-ins, but nobody expects that to last.
Taking sites offline is the recommended stopgap. Sansec's advice to anyone who can't update straight away is to take the site offline and serve a plain, static page, or at the very least make it read-only. Help Net Security reports that the UK's National Cyber Security Centre is urging organisations to consider taking offline any system that can't be fixed right away.
This will drag on. As security expert Hal Pomeranz told Help Net Security, "There will be a long tail for this one." Sites on old, unsupported versions of PHP, or on hosts that are slow to update, will stay exposed for a long time.
What Cloudflare has done
Many websites sit behind Cloudflare, a service that filters traffic before it reaches the website's server.
Cloudflare had been working on this ahead of the announcement. According to Cloudflare, its firewall has been blocking the known attacks since 3:02am UTC today, around nine hours before the flaws were made public. The protection applies to every Cloudflare plan, including the free one, with nothing for customers to switch on. Cloudflare says it has already seen attackers tweaking their attacks to try to slip past its rules, and that it will keep updating them.
But Cloudflare is clear that this is a layer of defence, not the fix: "Customers should patch their PHP repos even with WAF protections."
Two things worth knowing if your site uses Cloudflare:
- A firewall blocks the attacks it knows about. A slightly different version of an attack may not match the rules. Updating PHP is the only complete fix.
- It only protects traffic that actually goes through Cloudflare. If your server will also answer visitors who go to it directly, an attacker can go around Cloudflare altogether.
If you have a WordPress website: three questions to ask
If someone else looks after your site, ask them:
- Which version of PHP is my site on? It should be 8.2 or newer.
- Has the PHP2Shell update been installed? You're looking for PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or later.
- If it hasn't, what is protecting the site in the meantime? "Nothing, it's still online as normal" isn't a good answer today.
If you look after your own hosting, update PHP from your hosting control panel as soon as your host makes the update available. If you can't update yet, taking the site offline until you can is a reasonable call, however frustrating it is.
Once the dust settles, keep an eye out for the usual signs of a hacked WordPress site: pages you didn't create, visitors being redirected to strange websites, admin users you don't recognise, or warnings from Google or your browser.
How we can help
If your WordPress site has been hacked, or you're worried it might have been, our WordPress malware removal service will find out what happened, clean it up and close the way in.
If you'd rather not have to think about days like this at all, our WordPress maintenance plans start at £55 a month plus VAT. They include updates, a web application firewall, malware scanning, daily off-site backups, and malware cleanup at no extra charge if your site is compromised while your plan is active (terms apply). When something like PHP2Shell happens, we deal with it and keep you posted while we do.
Or get in touch if you'd just like someone to check where your site stands.
Sources
- Cloudflare, Cloudflare deploys protections against php2shell vulnerability
- Sansec, PHP2Shell: Critical PHP RCE (CVE-2026-109618, CVE-2026-109619)
- Help Net Security, PHP2Shell: Critical PHP vulnerabilities patched, update now!
- watchTowr, PHP2Shell FAQ
- CERT-EU, Security Advisory 2026-018
- PHP, php.net release announcements