The PHP project released emergency fixes on 21 October for two critical flaws in PHP, the language behind a large share of websites, the BBC reported. If your website, a client site or any tool you host runs on PHP, the server underneath needs updating this week. Your Macs are a much smaller part of this.
What PHP is and where it runs
A PHP script is a plain text file of code that sits on the web server and does nothing on its own. When someone visits the page, the PHP software installed on the server reads the file, runs the code and sends the result, usually a web page, to the visitor’s browser, as PHP’s manual explains. Visitors never see the code itself.
Think of the script as the recipe and the server’s PHP as the cook. These flaws are in the cook. The US National Security Agency put it plainly: “These vulnerabilities are flaws in PHP itself, not in the hosted application or its configuration,” the BBC reported. So updating WordPress or its plugins won’t fix this; the server needs the update.
What happened
On 20 October, PHP’s security team announced a release fixing two vulnerabilities, both rated 9.2 (Critical). The BBC says details leaked on social media the same day. CERT-EU’s advisory says the fixes landed at 13:30 UTC on 21 October in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Both let an attacker run code on any web server running PHP without logging in, CERT-EU says. PHP 8.1 and older no longer get updates from the PHP project.
The BBC reports that the flaws, nicknamed PHP2Shell, went undetected for at least a decade and were found with the help of AI. Researcher Ryan Austin told Radio 4’s Today programme it began with a hunch he couldn’t have followed up without AI.
Amazon said it saw an attempt to exploit the flaws against one of its decoy (honeypot) servers on 17 October, four days before the fixes and more on 21 October from what looked like several different actors, the BBC reported. Security firm watchTowr says it has since seen both flaws exploited against its own honeypot network, and Singapore’s Cyber Security Agency said on 23 October it’s aware of widespread exploitation attempts.
Public bodies including the Dutch cyber security agency, the Office for Budget Responsibility and, for a time, Edinburgh and Oxford councils took sites offline, the BBC reported. There’s no confirmed count of affected websites; Prof Alan Woodward of the Surrey Centre for Cyber Security told the BBC it’s around 30 million.
What the NCSC, Amazon and others have said
The NCSC told UK organisations to find and update every system running PHP, internet-facing ones first. Where that isn’t possible, it points to PHP’s temporary mitigations, then to taking the system offline, and says anything not updated straight away should be checked for backdoors.
Amazon said it automatically restricted the malicious scanning it saw.
OpenAI called the discovery “one of the most impactful security issues in recent memory”, according to the BBC.
Nobody has yet said how many organisations have actually been compromised.
What it means for a Mac-first team
macOS hasn’t included PHP since Monterey, so a standard company Mac doesn’t run it. Developers who installed it with Homebrew should update it too.
Your websites are the real job. In Dr Logic’s experience, most of the agencies we support run their marketing site on WordPress or a similar PHP platform, hosted by someone else. [CONFIRM WITH SHAUN: one real example, e.g. how often an IT audit turns up a forgotten microsite, staging copy or freelancer-built server nobody was patching.] A managed host will usually patch PHP for you. We’d worry most about sites nobody’s looked at lately, like an old microsite or a freelancer’s server.
If you build or host sites for clients, they’re probably waiting on you. A short note saying what you’ve checked will save a lot of anxious emails.
Cyber Essentials v3.3 makes high-risk and critical updates an automatic fail if they aren’t installed within 14 days, putting the deadline for in-scope servers at 4 November. If you’re not sure who patches which server, we’re happy to help you map it out.
What we’d do now
- List every site and tool running on PHP, including staging and client sites, and ask suppliers whether their products bundle it.
- Ask each host which PHP version is serving the site, in writing. Treat configuration tweaks as a stopgap, since watchTowr says PHP has stated none fully closes the flaws. If a site is on 8.1 or older and can’t be fixed quickly, take it offline.
- For anything not updated on 21 October, ask your host to check for backdoors from 17 October onwards.
Related articles
- Cyber Essentials has changed. Here’s what the April 2026 Danzell update means for your Mac fleet
- AI has changed the cyber threat landscape – here’s what businesses need to know
FAQs
Do our Macs need updating for PHP2Shell?
Probably not, unless someone’s installed PHP themselves. macOS hasn’t shipped with PHP since Monterey, so a standard company Mac doesn’t run it. Developers who use Homebrew or a local server app for PHP work should update it, but your internet-facing servers come first.
Our website runs on WordPress. Are we affected?
WordPress runs on PHP, so the server it sits on needs one of the fixed versions. The flaws are in PHP itself, so updating WordPress or its plugins won’t cover it. Ask your host which PHP version the site runs and when it was last updated. Managed hosts usually handle this for you.
What if our site runs PHP 8.1 or older?
The PHP project no longer updates 8.1 and older, though some hosting and Linux vendors offer backported fixes. Ask your provider whether they’ve applied one. If they haven’t, plan the upgrade now, and in the meantime follow the NCSC’s advice and consider taking the site offline until it’s fixed.
Does this affect our Cyber Essentials certification?
It can. Under Cyber Essentials v3.3, high-risk or critical updates for anything in scope need installing within 14 days of release, and missing that is an automatic fail. These fixes are rated critical and came out on 21 October, so any in-scope PHP server needs updating by 4 November.
