A web-wide alarm, with an important nuance
The panic around the flaw affecting “70% of websites” is about PHP, the server-side language that powers much of the modern web, including WordPress-driven sites and many legacy business applications. CrowdStrike’s October 23 analysis says PHP powers approximately 70% of websites on the internet, which explains why two critical flaws in the PHP runtime immediately became a global security event rather than a niche developer problem .
The vulnerabilities are being tracked as CVE-2026-109618 and CVE-2026-109619 and are widely referred to together as PHP2Shell. Salesforce’s security team summarized the core issue on October 23: the PHP project released fixed versions on October 21, and both vulnerabilities can enable unauthenticated remote code execution in affected deployments, with reported CVSS v4.0 scores of 9.2 . In plain language, a vulnerable server may be reachable by an attacker who does not need a password, an account, or a compromised plugin to try to run code.
That does not mean 70% of websites have been hacked. It means the blast radius is unusually large because the vulnerable component is not a single website theme, plugin, framework, or vendor product. It is the underlying PHP engine used by millions of sites and services. CrowdStrike said the bugs affect multiple PHP versions and can be exploited in products running vulnerable PHP versions under certain conditions .
What makes PHP2Shell so serious
The immediate concern is remote code execution, the category of bug defenders fear most in internet-facing systems. Salesforce said CVE-2026-109619 can also expose memory, raising the possibility that sensitive data processed by the web worker could be disclosed even when a full takeover is not achieved .
The Record reported on October 23 that companies have seen an explosion in exploitation attempts, while experts cautioned that many public proof-of-concept exploits only work in ideal lab conditions and have not translated into mass compromise . That distinction matters: defenders must patch as if exploitation is imminent, but the public evidence so far points to widespread probing, scanning, failed attempts, and fast-moving exploit development rather than a confirmed internet-wide breach.
CrowdStrike reached a similar conclusion. Its Counter Adversary Operations team said it had not observed successful exploitation in the wild or in its honeypot environments at the time of publication, and that many analyzed proof-of-concept samples were crash demonstrations rather than reliable tools for remote code execution . The company also warned that turning a crash into a stable exploit is not trivial, especially because attackers may need to adapt to a target’s exact PHP version, container, package, and application setup .
That is the good news. The bad news is that “hard to weaponize” is not the same as “safe.” Recorded Future News cited experts warning that the current quiet period may be borrowed time, because attackers are already fingerprinting servers and building target lists for the moment a more reliable exploit becomes available .
What site owners should patch
The fixed PHP releases named by Salesforce are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 . Organizations running PHP-based websites, applications, or third-party software should identify those environments and apply the appropriate updates quickly .
This is not only a WordPress problem. WordPress is common, but the vulnerable layer is PHP itself. That means Drupal, Joomla, Magento, custom PHP applications, old intranet tools, vendor appliances, admin panels, and forgotten containers can all matter if they embed or expose PHP. SANS contributors urged teams to start with internet-facing systems and then search for inherited PHP in places organizations often overlook, including management interfaces, stale container images, and vendor products .
SANS also emphasized that older PHP environments create a hard operational choice. If an organization still has PHP 7 environments, it may need to update or disable incompatible components so it can move to a supported version . That is why the crisis has become not just a patching sprint, but an asset-inventory test. Many organizations are discovering that they do not know where PHP is installed.
What is the current exploitation picture?
As of the latest fresh reporting, the picture is mixed. The Record reported on October 23 that multiple large companies had seen a surge in attempted exploitation, but also that dozens of experts said they had not seen successful mass exploitation . The same report said Sophos retracted an earlier successful-exploitation claim and later described only a small number of failed attempts .
The Record also reported that botnet-linked attempts had been observed, including activity associated with Potassium and Mirai-style botnets, but those reports still fit the broader pattern of scanning and attempted exploitation rather than proof of broad compromise . CrowdStrike’s assessment aligns with that reading: it had seen testing, probing, and unsuccessful exploitation attempts, not a fully weaponized public exploit capable of broad exploitation at scale .
Still, the absence of confirmed mass compromise should not reassure anyone into waiting. In several security incidents, the most damaging phase begins after defenders stop paying attention. The Record noted that VulnCheck researchers had developed a technique to bypass address space layout randomization, showing that a major exploitation barrier can be overcome even if the technique is not broadly public .
Why web application firewalls help, but do not solve it
Some cloud and security vendors moved quickly to add virtual patches and managed rules. AWS said in an October 23 update that its PHP application managed rule group includes rules for both CVE-2026-109619 and CVE-2026-109618, and that customers using the default version would receive those protections without extra action . But AWS was explicit that patching is the only complete fix and that WAF controls are defense-in-depth during the patch window .
That caveat is crucial. A WAF sees HTTP traffic; it does not fully understand PHP worker memory, process state, or every configuration detail behind an application. AWS described the vulnerabilities as reaching PHP before application code runs, which is why relying only on application-level checks or CMS security plugins is not enough . If PHP itself remains vulnerable, the foundation remains weak.
For teams that cannot patch immediately, temporary controls can still reduce risk. AWS’s guidance focuses on narrowing attack surface around multipart requests, request body patterns, and the PHP session upload progress field . SANS experts also recommended restricting access to systems that cannot yet be patched and getting firm timelines from vendors whose products bundle PHP .
Why cybersecurity teams are panicked
The anxiety is not only about PHP2Shell. It is about the speed of the vulnerability economy. CrowdStrike noted that PHP2Shell received widespread media and industry attention before and immediately after disclosure because of PHP’s reach and the severity of the bugs . SANS contributors described the situation as a race against the clock, with malicious actors likely analyzing newly released patches to build exploits .
The operational burden is enormous. Security teams must inventory PHP, patch supported versions, isolate unsupported systems, review logs, monitor for suspicious PHP worker behavior, validate vendor exposure, and answer executives who are reading alarming headlines. At the same time, they must avoid burning out the responders who will be needed for the next incident. SANS explicitly advised leaders to absorb noise, make written risk decisions, and send people home in shifts rather than demanding hourly updates from exhausted teams .
The broader lesson is uncomfortable: widely used open-source infrastructure can be both mature and fragile. PHP is everywhere because it works, because it is cheap to deploy, and because huge ecosystems depend on it. But ubiquity turns a runtime flaw into a global coordination problem.
What users and businesses should do now
For website owners, the first step is to ask a concrete question: what PHP runtime is actually serving each public endpoint? A CMS dashboard showing that WordPress or Drupal is updated does not prove the underlying PHP engine is fixed. The relevant check is whether the server is running a fixed PHP release or a vendor-provided backport that addresses the flaws.
For businesses, the priority list is clear: patch internet-facing PHP first, isolate systems that cannot be patched, require third-party suppliers to state their PHP2Shell status, and monitor logs from the period before and after disclosure. The Record reported that experts expect attackers to continue refining their tooling, so defenders should treat the current period as a narrowing window rather than an all-clear .
For ordinary users, the advice is less technical but still important. Be cautious of unusual login prompts, unexpected password reset emails, suspicious redirects, or sudden changes on sites you use. The more direct responsibility, however, lies with site operators and hosting providers, because PHP2Shell is a server-side problem.
The headline is frightening because it is partly true: a flaw in a technology used across much of the web has sent the cybersecurity world into emergency mode. But the most accurate reading is not that the internet has already fallen. It is that defenders have a short, uncertain window to patch the foundations before opportunistic attackers turn today’s probes into tomorrow’s compromises.