PHP Radar

Live tracker · updated October 22

The PHP security flaw that put most of the internet at risk.

A hole was found in PHP, the software behind about 70% of all websites. Hackers are attacking websites with it right now, and banks, airlines and governments shut their sites down to fix it. Here is what is going on.

Is a website at risk? Check it:

We look at what the website shows publicly, the same thing any browser sees, to tell whether it runs on PHP and which version. Nothing is saved.

Has any website actually been hacked through it?None confirmed yet.
~70%of all websites run on PHP1.3M+servers could be open to attackMillionsof attacks on websites blocked0websites confirmed hacked so far

What happened

  1. 1

    PHP is the software that runs most websites: WordPress blogs, online shops, even bank sites.

  2. 2

    Researchers found a security flaw in it: a hole that lets a hacker take over a website’s server by sending it a single message. No password needed.

  3. 3

    Details leaked a day before the fix was ready, so hackers got a head start.

  4. 4

    The fix is out now. Every website that runs PHP has to install it, and many big companies shut their sites down while they did.

Are websites being hacked?

Hackers are attacking websites with it a lot. So far no website has been confirmed hacked.

Are hackers attacking websites with it?Yes, millions of times
Has any website been hacked?None confirmed
Has the US government officially listed it as “being used by hackers”?Not yetlive

Companies that shut down their websites or apps to be safe

None of these were hacked. They went offline while they installed the fix.

What security companies watching the attacks are saying

These companies track the attacks. They are not victims.

Where websites went offline or came under attack

Each dot is a country. Tap one to see what happened there.

EUROPEUnited Kingdom: Government warningGBSouth Korea: Government warningKRSingapore: Government warningSGEuropean Union: Government warningEUGermany: Attacks on websites seenDEUnited States: Attacks on websites seenUSJapan: Websites shut down to be safeJPNetherlands: Websites shut down to be safeNLFrance: Websites shut down to be safeFR
Websites shut down to be safe Attacks on websites seen Government warning

JapanWebsites shut down to be safe

  • Mizuho, one of Japan’s biggest banks, shut its banking and trading services to be safe The Next Web
  • MUFG and Shizuoka Bank paused parts of their online banking The Next Web
  • ANA turned off phone boarding passes; Japan Airlines, JR East trains and 7-Eleven Japan took parts of their sites down The Next Web
  • The government says nobody has been hacked through it yet, and told every website to update The Next Web

NetherlandsWebsites shut down to be safe

  • The Dutch parliament, the national cyber agency and tech site Tweakers took their websites offline to be safe Sansec
  • Dutch officials: no sign anyone has been hacked through it The Next Web

FranceWebsites shut down to be safe

  • Orange, the big phone and internet company, paused some websites and apps while fixing them The Next Web

GermanyAttacks on websites seen

  • Germany’s cyber agency has seen hackers try it, but none succeeded The Next Web

United StatesAttacks on websites seen

  • Amazon caught the first hacker trying it on Oct 17, four days before the fix came out Tenable
  • Cloudflare, which protects millions of websites, went from thousands of hack attempts to millions The Next Web
  • The US cyber agency (CISA) had seen no successful hacks when it issued its warning The Next Web

United KingdomGovernment warning

South KoreaGovernment warning

  • Raised its national cyber alert level for businesses The Next Web

SingaporeGovernment warning

European UnionGovernment warning

  • The EU’s cyber team issued a warning on Oct 20 Tenable

What should I do?

If you just use websites

Nothing to install. This affects the computers that run websites, not your phone or laptop. If a site you use gets hacked, it should tell you. None has so far.

If you own a website

Ask your web host whether they have updated PHP for this, or check your site with the search box at the top. Updating PHP is the only real fix.

How it unfolded

  1. AugustSecurity researchers (Calif and Wiz, helped by AI) find the hole and quietly tell PHP Wiz
  2. Sep 21PHP starts building a fix in secret Wiz
  3. Oct 17Amazon spots the first hacker trying it, before anyone announced it Tenable
  4. Oct 20Word leaks early. A post called “PHP-UP-2026” publishes details before the fix is ready LWN
  5. Oct 21, morningCloudflare sees hack attempts start Sansec
  6. Oct 21, afternoonThe fix is released. Dutch government sites go offline to be safe php.net
  7. Oct 22Japanese banks, airlines and trains, and France’s Orange, shut services while they update The Next Web
  8. Oct 22Millions of attempts, but still no confirmed successful hacks The Next Web

Latest news

Newest articles about it, refreshed every 10 minutes.

Technical details (for IT people)

“PHP-UP-2026” was the name of the blog post that leaked the details early (its author later said they had overstated part of it). Security companies call the bug “PHP2Shell” because it can give a hacker a “shell”, meaning full control of the server. Official IDs: CVE-2026-109618 and CVE-2026-109619. PHP-UP-2026 write-upLWN

Fixed PHP versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35. Restart every PHP worker after updating; config changes only reduce risk. Patch status as reported, so confirm with your vendor.

PHP 8.2 – 8.5Fixed8.5.12 · 8.4.27 · 8.3.36 · 8.2.35 (Oct 21, 14:00 UTC) php.net
PHP 7.4 – 8.1PartialNo release; source-only emergency backports Tenable
PHP 5.4 – 7.3No fixEnd of life, no fix from PHP Tenable
Debian 13 / 12FixedDSA-6574-1 (php8.4) · DLA-4848-1 (php8.2) MassiveGRID patch guide
Debian 11No fixFree LTS ended Aug 31, 2026 MassiveGRID patch guide
UbuntuPartialUSN-8948-1/-2; 20.04 and older via Ubuntu Pro only MassiveGRID patch guide
RHEL 8 / 9 / 10In progressBulletin RHSB-2026-013; errata rolling out Red Hat
Alpine 3.24 / edgeFixedphp83 – php85 updated MassiveGRID patch guide
cPanel EasyApache 4Fixedea-php74 – ea-php85 patched MassiveGRID patch guide
PleskFixedUpdated PHP builds, see advisory Plesk
Cloudflare WAFPartialBlocking rules on by default since Oct 21 (shield, not a fix) Cloudflare
CVE-2026-109618: NVD modified, updated 10 h agoCVE-2026-109619: NVD modified, updated 10 h ago

Primary sources: php.netWizTenablewatchTowrSansecQualysCloudflare