Astrology

Website operators are updating PHP after a security flaw was disclosed.

Website operators began updating their systems after a major PHP security flaw was announced on October 21, 2026, Astrology News Service reports. Patches were immediately available for four recent versions of PHP, a programming language used by an estimated 70% of websites worldwide.

Some administrators were able to install a patch, while others took sites offline until they could carry out more extensive work, according to Astrology News Service. Fortune reported that governments and organizations also moved to address the flaw, which could give attackers access to website data and control.

Published

The flaws affect PHP itself#

The two flaws, known together as PHP2Shell, affect the PHP runtime, the software that runs PHP on a server, TechInformed reports. They involve errors in the way PHP handles memory during website requests. In one setup, an attack can work before a site's own code begins running.

Fortune reports that the issue sits in the core PHP system and the libraries it uses. According to Fortune, the flaw can let an attacker run unauthorized commands on the computer hosting a site, potentially giving that person access to data and full control of the website.

The PHP project released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to TechInformed. The outlet notes that updating a site's content management system, such as WordPress, does not necessarily update PHP itself.

The discovery preceded the patches#

TechInformed reports that one of the weaknesses first came to light in 2024. According to the PHP Foundation, a developer found it without showing how to exploit it. Work on a fix stalled because of concerns that a change might disrupt other software.

In August 2026, Calif researcher Ryan Austin demonstrated an attack with help from artificial intelligence, according to TechInformed. Fortune reports that the firm alerted the nonprofit managing PHP, but word of the flaw leaked before patches were released.

Amazon Threat Intelligence detected an attempt against decoy servers on October 17, TechInformed reports. Amazon could not determine whether it would have succeeded on a real system. After identifiers for both flaws circulated online on October 20, the PHP project brought its release forward by a day.

Discover more