What Is PHP — and Why Has It Caused Chaos for Millions of Websites This Week?

It is not often that a programming language makes the national news. But this week The Independent asked the question on a lot of people’s minds — “What is PHP, and why has it caused chaos for millions of websites?” — after the UK’s National Cyber Security Centre (NCSC) urged organisations to take immediate action, and dozens of UK government services were taken offline as a precaution. Here is the plain-English answer, and what it means for your business.

So, what is PHP?

PHP is the engine room of the modern web. It is a programming language that runs on web servers — the computers that host websites — and its job is to build each page on the spot: fetching your content from a database, checking who is logged in, processing a form, completing a purchase, and then handing the finished page to your visitor’s browser.

You never see PHP. You just see the websites it powers — and there are an extraordinary number of them. PHP runs on roughly three-quarters of all websites whose technology can be identified (W3Techs), around 24 million sites by BuiltWith’s count. If your website is built on WordPress, Joomla or Drupal, or your shop runs on Magento or WooCommerce, then your business runs on PHP — whether or not anyone ever told you. It has been doing this job since the mid-1990s, quietly, underneath a very large slice of the internet.

Which is precisely why a serious flaw in PHP is not a niche technical story. It is closer to a fault being found in the foundations of millions of buildings at once.

What went wrong: two flaws, hidden for over a decade

On Wednesday 21 October 2026, the PHP project released emergency security updates fixing two critical vulnerabilities, together nicknamed “PHP2Shell”:

• CVE-2026-109618 — “RCE via OOM corruption.” If a request pushes PHP into an out-of-memory error at exactly the wrong moment, its internal memory can be left in a corrupted state that an attacker can exploit.
• CVE-2026-109619 — “RCE via stale global state.” Information from one visitor’s request could linger and be wrongly reused during a later request, creating another route to the same destination.

Both are rated 9.2 out of 10 for severity, and both end at the same place: remote code execution with no login required. An attacker who reaches a vulnerable server can run their own code on it — installing hidden backdoors, stealing the database, or using your site to attack others. The flaws affect every PHP release line back to PHP 5 — meaning they sat undetected in the code for well over a decade — and were discovered this year by security researchers at Wiz and Calif, using AI tools to hunt through the codebase. PHP considers the risk highest for servers running Apache with mod_php, where a working attack was demonstrated that fires before a website’s own code even starts.

We published a full technical breakdown — the affected versions, how exploitation is unfolding, and how to check your own site — in our companion article: PHP2Shell: Two Critical PHP Flaws Put Millions of Websites at Risk.

Why “chaos”? Because the cure itself took websites down

Here is the part that turned a security advisory into headlines. The flaws had leaked a day early, on 20 October, before the fixes were ready — giving attackers a head start and defenders no choice but to move at full speed the moment patches landed on the 21st.

The NCSC’s advice, issued the same day, was unusually blunt: find everywhere PHP runs, starting with anything accessible from the internet; install a fixed release immediately; use temporary mitigations only as a stopgap; and if you cannot update or mitigate quickly enough, consider taking the system offline until you can — and check it for signs of compromise either way.

Organisations listened. By Thursday, ministers reported that 32 UK government services were unavailable and four more partially unavailable — overwhelmingly not because they had been hacked, but because they had been deliberately taken down as a precaution while emergency work was done. The City of Edinburgh Council’s website was among those reported offline on the Wednesday. That is the “chaos” in the headlines: not a wave of successful hacks, but a nationwide scramble — patch it, shield it, or switch it off — while attackers raced to find the sites that hadn’t moved yet. Security firms reported exploit attempts at enormous scale within the first day.

The fixed versions — and the old-version trap

One honest nuance on the oldest versions: because this flaw is so serious, the PHP team published minimal source-code backports for PHP 7.4, 8.0 and 8.1, and some hosting and Linux providers have shipped their own backported fixes. That helps people who compile and maintain PHP themselves. For a typical business, though, the practical advice is unchanged: if you are on PHP 8.1 or older, plan your upgrade now — every future emergency like this one will find you unpatched.

What your business should do today

Step 1 — Find out if you run PHP, and which version. WordPress users: Dashboard → Tools → Site Health → Info → Server. For anything else, ask whoever built or hosts your site. “We don’t know” is the most dangerous answer this week.

Step 2 — Update to a fixed version immediately. This is the NCSC’s first instruction, and it outranks everything else on your website’s to-do list.

Step 3 — If you can’t update today, shield and watch. Your host or firewall may offer temporary rules that reduce exposure. Treat them as a plaster, not a cure — and watch the site closely meanwhile.

Step 4 — Check for signs of compromise. If your site sat unpatched while exploit attempts were flying around, look (or have someone look) for unknown admin accounts, changed files and strange scheduled tasks before you relax.

Step 5 — Fix the root cause: unmanaged software. This week’s chaos had a pattern: the victims were not the well-maintained sites, but the forgotten ones. A maintenance routine — updates watched, versions supported, backups tested — is what turns the next emergency into a non-event.

Frequently asked questions

Were the UK government websites actually hacked?
There is no public evidence of that. The services went unavailable largely because their operators took them offline as a precaution while patching — which the NCSC explicitly recommended where an immediate update wasn’t possible.

My site is WordPress. Is WordPress itself the problem?
No. WordPress is an application that runs on PHP; the flaws are in PHP underneath it. Updating WordPress, your theme or your plugins does not fix them — PHP itself must be updated (usually via your hosting panel or your host).

My hosting company hasn’t contacted me. Should I worry?
Many hosts patched their shared platforms centrally and silently — that’s the good scenario, but don’t assume it. Check your PHP version yourself (Step 1), and if it’s below the fixed versions, contact them today.

Can I wait for my usual monthly maintenance slot?
The NCSC’s word was “immediate”, and attackers are actively scanning for unpatched sites. This one should jump the queue.

What actually is the worst that can happen?
A successful attack gives the intruder control of your server: your customer data, your website defaced or redirected, your domain used to send spam or host scams — and the cleanup bill and reputational damage that follow. That’s why a 9.2-rated, no-login-required flaw gets governments switching systems off.

The bottom line

PHP is not exotic, and it is not going away — it is the quiet engine under roughly three-quarters of the web, very likely including your own website. This week, two flaws that had slept in its code for over a decade forced emergency patches, a national cyber agency’s bluntest advice, and dozens of government services offline as a precaution. The businesses that barely noticed were the ones who already knew what they ran and kept it updated. And if there’s one sentence to remember, it’s this: you cannot patch software you don’t know you have.

Not sure what your website runs on — or whether it’s patched? That’s exactly what we check for our clients. Get in touch with Altus Web Solutions for a free website audit: we’ll identify your PHP version and platform, flag anything vulnerable or end-of-life, and tell you in plain English what needs doing. No panic, no jargon.