PHP is the software that builds a web page each time someone visits. It runs roughly 75% of websites whose language can be identified, according to W3Techs figures cited by Reuters via KSL, and it sits underneath WordPress, Drupal, Joomla and Magento. On Wednesday, Oct 21, the PHP team shipped emergency fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed "PHP2Shell." Both let an attacker run their own code on a web server with no password, per BleepingComputer.

Why it’s urgent. The NSA says the flaws are in PHP itself, not in your website’s code or settings, so servers running affected versions are exploitable. Amazon’s security chief said the flaws are "now being broadly exploited in the wild," and Singapore’s Cyber Security Agency reports widespread exploitation attempts and multiple public proof-of-concept exploits. Government sites in Europe, the Dutch cybersecurity agency, and some Wikipedia systems went offline as a precaution, Reuters reported. Censys data cited by Reuters puts about 1.5 million of 2.6 million PHP hosts on a version with no fix.

The old-PHP problem. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer get official updates. CISA says organizations that can’t update right away, or still run 8.1 or earlier, should take PHP-based systems offline until they’re patched. Temporary workarounds only reduce exposure; the update is the fix.

Action item: Is your site on old PHP? Email your web host or web developer today and ask:
1. Have you installed the Oct 21 PHP security update on my site’s server?
2. What PHP version is my site on? (You want 8.2 or newer, on one of the fixed releases above.)
3. Do any of our other tools, like a customer portal, booking form or intranet, run PHP? CISA notes PHP is often built into other software where it isn’t obvious.

Not sure what version you’re on? Check it free with our KeyRing PHP version checker: https://awhind.com/keyring/php/

If you’re on a managed host like WordPress.com, check its status page; if you run your own server, patch internet-facing systems first.

Also today

SafePay ransomware. The FBI warns SafePay has hit more than 600 organizations (eSecurity Planet). Offices with a VPN or backup server should confirm both are fully updated and protected by multi-factor sign-in.
Forgotten AI agents still hold keys. An Arrakis Security report finds 76% of AI agents are dormant but keep their credentials and connections (NextBigFuture). Offboard AI agents the way you offboard staff: remove access when the job ends.
ConnectWise supply-chain attack. China-linked hackers used AI agents in an attack via ConnectWise, per The Hacker News. Microsoft 365 admins: review old third-party app permissions and remove ones you no longer use.