23/10/2026
AI just found a decades-old flaw hiding in the software behind roughly 70% of the world’s websites. 🌍
It’s called PHP2Shell. It’s serious enough that governments in Germany, France, Belgium, the Netherlands, Finland and the Czech Republic took some of their own websites offline to patch it.
What it means: if the PHP running your site hasn’t been updated, an attacker could get in and run commands on your server without a password or a login.
It’s not just WordPress. Drupal, Joomla, Moodle, Nextcloud and MediaWiki can all be at risk if the PHP underneath them hasn’t been patched.
The tricky part is that your site can look completely normal while it’s compromised.
The good news is that fixes are out. If you own a website, ask your host two questions:
1️⃣ Has our PHP been patched? (Updating a plugin alone won’t fix it.)
2️⃣ Was PHP restarted afterwards?
Just browsing? Watch out for suspicious login links and payment requests, because phishing spikes around stories like this.
Not sure you’re covered? Let’s check. DM us or drop a comment and the Tech Local team will help you find out where you stand. 💬
