Is the Internet Safe Again After the PHP Nightmare? What You Need to Know

A day after two bugs in PHP sent governments scrambling to unplug their websites, the fix is out, attackers are hammering away, and a lot of people are asking the same thing: Can I use the internet without worrying, or should I hide under the bed until next week?

The short answer is that the internet didn't break, and for most people the risk sits with the websites they visit, not with their own phones or laptops. The longer answer has a few caveats worth knowing.

Quick recap: PHP is the software that runs behind the scenes on about 70% of websites whose server-side language is known, and the two flaws, nicknamed PHP2Shell, let a stranger take control of a vulnerable server without logging in.

Is it fixed?

So, is the exploit fixed? Yes, mostly. PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on Wednesday, according to its release notes. "There are no complete mitigations, updating is the only safe choice." As of Thursday, PHP has not issued any follow-up patch.

A fix only helps once someone installs it, though. PHP doesn't update itself, so every hosting company, IT department, and solo website owner has to apply it on their own servers, and then restart the software for it to take effect.

In other words, the fix is out there, but it doesn’t mean the sites you visit are necessarily safe.

PHP 8.1 and earlier no longer get official releases, which makes older servers the weak spot, although PHP's security team posted bare-bones patches for 7.4, 8.0, and 8.1 for people who compile the software themselves.

Did anyone actually get hacked?

Attackers certainly tried: Cloudflare CEO Matthew Prince said his network saw thousands of exploit attempts in the 10 hours before the announcement, tens of thousands in the 45 minutes after it, hundreds of thousands within two hours, and millions since.

Amazon went further, saying its decoy servers logged an attempt on October 17, four days before the bugs went public. "It remains unclear how the actor acquired exploit information prior to disclosure," Amazon CISO CJ Moses wrote, adding that PHP2Shell is "now being broadly exploited in the wild."

Governments, however, don’t seem to have experienced any sort of successful break-in yet. Thomas Caspers, vice president of Germany's federal cybersecurity agency BSI, said the agency had seen attacks but no successful use of the flaws, adding: "It seems a little bit more complicated than expected to exploit." Japan's Chief Cabinet Secretary, Minoru Kihara, also said no attacks exploiting the flaws had been confirmed.

An attempt is someone rattling the doorknob; a breach is someone getting inside, so both claims can be true at once. Millions of rattled doorknobs and zero confirmed break-ins is good news, but break-ins tend to be discovered later, not in real time.

Why wasn't this caught sooner?

It sort of was. In a blog post published Wednesday, the PHP Foundation said its security work in 2024 "found the first signs of the OOM problem behind CVE-2026-109618," meaning the out-of-memory bug at the heart of one of the two flaws.

The team came up with "several competing approaches" to fix it but "struggled to choose between these and feared the repercussions of shipping the wrong choice," according to the foundation. "Without the Foundation's funding it would have been impossible to have multiple people work on this issue full time," it added.

"We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources," the foundation wrote, adding that its security team, which used to need consensus, will now decide by majority. For the software running most of the web, that security work "still depends on a small group of foundation-funded developers and a little volunteer help," per the post.

Why are some websites still down?

Because patching takes time, and "offline" was the official advice for anyone who couldn't patch right away. The UK's National Cyber Security Centre told organizations to consider "taking the system offline until it can be fully mitigated."

The list of sites that went dark on Wednesday got long fast. According to TechRadar, it included Wikimedia services, Orange websites and apps across dozens of countries, 32 UK government services, Dutch hospitals, and Germany's federal IT provider, ITZBund.

The UK's Office for Budget Responsibility and Edinburgh's council website were back by Thursday. Others, like the Dutch anonymous crime-reporting site Meld Misdaad Anoniem, were still offline Thursday morning, according to DutchNews.

Should I change my passwords?

Not because of this, at least not yet. No confirmed data breach has been tied to PHP2Shell so far, and changing every password today won't help if a site's server is still unpatched.

What does help is the boring stuff: unique passwords for every account, two-factor authentication turned on, and paying attention if a company emails you about a breach in the coming weeks. If one shows up, change that password, and any account where you reused it.

Website owners have more homework, because patching closes the door but doesn't tell you whether someone walked in first. Security firm Tag1 advises looking for PHP files you didn't upload, new scheduled tasks, and new accounts, and rotating database passwords and API keys on any internet-facing server that ran a vulnerable version.

What about crypto?

Binance founder Changpeng Zhao had a short piece of advice on X: "Call me paranoid, but be extra careful visiting ANY web site in the next few days."

A hacked web server can show you a fake version of a real site, and in crypto that usually means a page that asks you to connect your wallet and approve a transaction that empties it. A blockchain network itself may be fine; the websites in front of it might not be.

For the next few days, triple-check what you're signing, bookmark the sites you use instead of clicking links, and use a hardware wallet if you have one. So far, no crypto exchange has publicly reported a breach tied to PHP2Shell.

So, is it safe?

Browsing the web today is about as safe as it was last week, which is to say not perfectly. The real exposure is on servers that haven't been patched, and security company Mallory counted roughly 884,000 internet-facing hosts running PHP versions that get no official fix.

Amazon's advice to defenders is basically that this isn’t over. "Defenders should not assume the public disclosure date is the earliest date of exploitation." Any server that ran a vulnerable version since at least October 17 should be checked, not just patched.