# The PHP flaw and why your website is also at risk - Link: https://buenodesign.studio/en/the-php-flaw-and-why-your-website-is-also-at-risk/ - Published: 2026-10-24T00:02:49-03:00 - Author: Maichel Bueno **Visitor**opens your site **Server + PHP**builds the page on the spot **Page ready**arrives in the browser PHP is the invisible cook: it works on every visit, without you seeing it. **Last week, part of the internet went down. ** **And the culprit has just three letters: PHP.** Government agencies and federal courts took systems offline as a precaution. If you have a website, or plan to have one, this is about you too. I’ll quickly explain what happened, why it affects you even if you’re not a public agency, and give you six checks to close your site’s doors today. ![](https://buenodesign.studio/wp-content/uploads/2026/10/falha-php-como-proteger- seu-site-dicas-seguranca.jpg) ## The internet flickered, and PHP was at the center. On October 21, 2026, researchers found two critical PHP flaws, nicknamed **php2shell**. Serious enough that many people chose to shut the system down rather than risk it. * Severity **9.2 out of 10**, nearly the maximum. * It ran commands on the server with no password at all. * Agencies and federal courts suspended systems. * Germany, France and the Netherlands also pulled services. * The fix was released the same day it was found. PHP 8.2.35 8.3.36 8.4.27 8.5.12 No jargon: PHP is the language that runs hidden on the server and **builds your page every time someone visits the site**. Think of PHP as the restaurant cook: with every order, it prepares the dish on the spot. Half the internet works this way. And if your site is WordPress, it’s PHP from head to toe.The illustration at the top of the post explains it well. ## What is ⏎ PHP, anyway? ## A door ⏎ that opened without a key. Normally, to touch a server you need a key: login, password, permission. This flaw was a **broken lock**: a stranger walked in and gave orders, with no key at all. In security, this is the worst kind of flaw there is. Hence the nickname **php2shell**, and why serious organizations chose to pull everything offline right away. CVE-2026-109618 CVE-2026-109619 Remote execution without login The bot scans the whole internet looking for any open door. ## The danger of vibe-coding It’s never been easier to ask an AI to build a site and publish it. That’s amazing, I use it and recommend it myself. The thing is, AI hands you a site that **works**; keeping it **secure** is still on you. Updating, closing doors, making backups: almost always left out. Security belongs in the project from day one. ## Okay, so what? This is the part most people miss. The attack bot scans the whole internet for any open door, including yours, without picking targets. ## 6 ways ⏎ to shield your site today. And look, none of them require being a developer. **You, a coffee and about 20 minutes will do.** ### Check your PHP version In WordPress: Tools › Site Health. Below the fixed versions? Ask for an update. ### Update everything WordPress, theme and plugins up to date. Attacks love old stuff. ### Automatic backup If things go wrong, you’re back in minutes, not weeks. ### Serious hosting Good hosting patches PHP for you, sometimes the same day. ### Fewer plugins Every abandoned plugin is one more door for them to test. ### HTTPS and firewall Trusted security plugins close many doors on their own. ## Every site needs ⏎ maintenance to stay online. Your site is your shop, open 24 hours. An open shop with no one watching the door is an invitation. Better to find out today whether yours is locked than on the day it goes down. Our brand consultancy handles this too. [Let’s talk? →](https://buenodesign.studio/contato/) Keep reading --- * [⌊The PHP flaw and why your website is also at risk⌉⌊The PHP flaw and why your website is also at risk⌉[ * ## 󠀁[The PHP flaw and why your website is also at risk](https://buenodesign.studio/en/the-php-flaw-and-why-your-website-is-also-at-risk/)󠁿 * Two critical PHP flaws took agencies and courts offline. Understand what happened, why it affects your site, and… * [⌊Dark Sugar: a bakery with personality⌉⌊Dark Sugar: a bakery with personality⌉[ * ## 󠀁[Dark Sugar: a bakery with personality](https://buenodesign.studio/en/dark-sugar-rebranding-visual-identity-bakery/)󠁿 * Dark Sugar rebrand for an artisan confectionery in Curitiba, Brazil: a mascot, colour, type and tone of voice… * [⌊ADVB Personalities Award 2026: art direction and visual identity⌉⌊ADVB Personalities Award 2026: art direction and visual identity⌉[ * ## 󠀁[ADVB Personalities Award 2026: art direction and visual identity](https://buenodesign.studio/en/advb-personalities-award-2026-art-direction-visual-identity/)󠁿 * Art direction for the 2026 ADVB Personalities Award: a visual system that turns recognition, connection, and shared progress… [Next Page](https://buenodesign.studio/en/the-php-flaw-and-why-your-website-is-also-at-risk/?output_format=markdown&query-4-page=2)