Governments Shut Down Their Own Websites. PHP Is Hacked. Is Your Site Safe?

Bob didn't touch his website this week. He was on a job every day, same as always. Somewhere in there he caught a headline on his phone. Governments in Europe were shutting down their own websites on purpose. He figured that was a government problem and went back to work.

Here's what he didn't know. The thing those governments were scared of was a hole in PHP. That's the software his WordPress site runs on. Same software. Same hole. The only difference is they have whole teams watching for this, and Bob has Bob.

Bob didn't do anything wrong. He didn't add a bad plugin. He didn't pick a weak password. Nobody needed his login at all. His site just sits on the same thing those governments pulled the plug on, and nobody called to tell him.

So here's who went dark, what the hole does in plain words, and the one email that tells you where your own site stands.

TL;DR

PHP2Shell is two holes in PHP itself, the software under about 69% of websites and every WordPress site (Wikipedia, 2026). One request, with no login and no password, could run a stranger's code on the computer behind a site (Help Net Security, 2026). Finland, the Netherlands, France and Denmark took their own websites offline rather than leave them open. The fix came out October 21, 2026. If your site is on WordPress, ask your host one question this week: is the October 21 PHP fix on my site?

3 Things to Remember

Pulled the Plug. On Purpose.

Nobody knocked these governments offline. They did it to themselves, on purpose, so nobody could use this hole on them first. That isn't a figure of speech. They pulled the plug.

Finland pulled its public government websites. The Netherlands pulled its main government portal and the login its people use for government services. France took down every Interior Ministry website. Denmark shut down its national school platform (Wikipedia, 2026).

It wasn't just governments. The people who run Wikipedia shut down a bunch of their behind the scenes services. Drupal.org, the home of one of the big website platforms, went offline to put the fix on (Patchstack, 2026).

Then the advice came down. The NSA told sites that couldn't update right away to go offline. The UK said the same thing (Help Net Security, 2026).

Sit with that. The people whose whole job is keeping things online said turn it off. Those are people with security teams and plans for exactly this. You've got a crew to run and a phone to answer.

Mistake: you figure this is a government problem, because governments are what made the news.

Fix: treat it as yours until your host tells you the fix is on your site.

Payoff: you get a yes or no in one email instead of a week of wondering.

Tap through who went dark below. Every card carries its source.

One Request. That's All It Took.

Here's the hole in plain words. Your website lives on a computer somewhere, called a server. On a WordPress site, PHP is the software on that computer that builds your pages every time somebody visits.

PHP2Shell let a stranger send that computer one request and run whatever they wanted on it. No login. No password. Nothing for you to click (Help Net Security, 2026). The makers of PHP rated it 9.2 out of 10. One security company gave it a full 10. That's about as bad as the scale goes.

Running code on that computer is the whole ballgame. Your pages live there. Your contact form lives there. Whatever your customers type in lives there.

Keeping WordPress up to date didn't save anybody either. It worked on the newest version of WordPress (Patchstack, 2026). The hole wasn't in WordPress. It was in the thing WordPress sits on.

And WordPress already had its own trouble this year. In July a hole in WordPress itself let strangers in with no password. PHP is the layer under that. So now it's both.

It moved fast, too. Attacks started the morning of October 21, the same day the fix came out (Patchstack, 2026). Nobody got a long head start on this one.

Here's the part that should bother you. These holes sat in PHP for years. AI is what made them easy to use (Wikipedia, 2026). Old code that sat quiet for years just got a lot easier to break. That's the world your website lives in now.

Mistake: you think a strong password and a security plugin have you covered.

Fix: know this fix lives on the server. That's your host's side, so ask them.

Payoff: you stop guarding the front door while the floor is wide open.

The Fix Arrived. Some Sites Got Nothing.

Here's the good news. The fix came out October 21, 2026, and it's not on you to install it. It's on whoever runs the computer your site lives on. For most people that's the web host, the company you pay every month or every year to keep the site up.

Here's the bad news. Not every site got a fix. The old versions of PHP are past their expiration date, and they got no normal release for this (Wordify, 2026). In plain words, nobody is shipping those sites a button to click. Somebody has to move them up to a newer version.

That's not a small pile. About 884,000 servers were still on one of those old versions the day before the fix (The Hacker News, 2026). Somebody owns every one of them. Plenty of those somebodies are business owners like Bob who have never heard the word PHP.

So this is the one spot where a number matters. Ask your host which PHP version your site is on, and whether the October 21 fix is on it. If they tell you 8.1 or older, that's the one to push on. Ask them to move you up, and get the answer in writing.

Mistake: you assume your host moved you up because they update everything else.

Fix: get the version number back in writing.

Payoff: you hold a number, not a promise. Numbers you can check.

Who's Watching Your Website?

Those governments had people watching. Most small business sites don't. Your site is clear of this one when it runs a fixed version of PHP or doesn't run PHP at all. One email tells you which.

If your site sits behind Cloudflare, they put up a shield for this one, free accounts included (Help Net Security, 2026). Good. That buys you time. It doesn't replace the fix.

If you're not sure what your site runs on, start with what PHP is and how to tell if it's under your site.

Then tick through the check below. It takes about five minutes and nothing gets sent anywhere.

My website runs on [WORDPRESS, DRUPAL, JOOMLA OR SOMETHING ELSE].
I asked my web host about the PHP security fix from
October 21, 2026. Here is what they told me, word for word:
[PASTE YOUR HOST'S REPLY]

The fixed PHP versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35,
or anything newer in the same line. PHP 8.1 and older did not
get a normal fix.

Do four things.

1. Tell me in one line if the reply says my site has the fix.
   If the reply does not say, tell me that.
2. List anything in the reply that is vague or dodges the
   question.
3. Write a short, friendly note I can send back to my host
   asking for exactly what is missing.
4. If I am on 8.1 or older, tell me plainly that I need to move
   up and what to ask for.

Rules: write at a 5th grade reading level. Short sentences.
No jargon. If you are not sure about something, say so.
Do not guess.

My Sites Had Nothing to Patch.

I didn't write this from the cheap seats. I ran my own business on WordPress for years, which means PHP was under my site too. I got tired of reading lists like this one about my own site, so I moved 1,387 of my own posts off it.

Everything I build now is an AI-JSX site. 281 of them so far. None of them run PHP. So when governments started pulling the plug, there was nothing on mine to patch. Not because I'm any sharper than you. Because there's nothing there for it to be about.

It's not magic, and I won't sell it as magic. My sites still need somebody keeping them current. That's my job, and I do it. The difference is there's no PHP under them for this kind of hole to hit. Here's what an AI-JSX site actually is, and how my own move off WordPress went.

When This One Isn't Your Problem.

I'll give credit where it's due, and you should weigh it before you take my side. The makers of PHP shipped a fix fast. Cloudflare put up a shield for everybody, free accounts included. A lot of people did their jobs here, and did them quick.

If you're on Wix, Squarespace or Shopify, this one isn't yours. Those companies run their own computers and do their own fixing. Close the tab and go run your business.

If you're with a good host, they may have put the fix on the day it came out. One email confirms it. Then you go run your business too.

Now the turn. Here's who that isn't. A WordPress site on old PHP, a host nobody has emailed in two years, and a web guy who answers sometimes. And PHP is just one layer. If the weekly list of WordPress holes already wears you out, this is one more thing sitting under all of it.

Your Site Goes Dark. The Calls Go Too.

I'm not telling you your site got hit. I'm telling you governments chose dark over open, and your host owes you one answer.

Think about what dark means for you. A government can turn its site off for a day and the country keeps running. When your site goes dark, nobody finds you. Nobody fills out the form. The calls just stop, and you might not know why for a week.

So ask this week. Get the number. If it's old, move up.

And if you're done with a setup where a hole in somebody else's code decides your week, look at the 100K Site, with no PHP under it. Take a test drive. I'll put your site on my code, and you look at it before you spend a dime.

Take a Test Drive →

FAQ

Read These In This Order

1. WTF Is PHP? Your Website Runs on It. Are You Safe? Hackers Just Cracked It.
2. LMAO! WordPress Got Hacked Again. Is Your Site One of Them?
3. Leave WordPress