Hackers didn't take these sites down. Their owners did, on purpose. Both the FBI and the NSA recommended that anyone who couldn't update right away take their site offline until they could.
The cause was a flaw in PHP, the programming language running quietly underneath a huge part of the internet. Security firm Wiz estimates PHP runs roughly 70% of all websites.
For our clients, it was a normal week. Their products stayed online and nothing needed an emergency fix. That wasn't luck. NeWwave has never built a product on PHP. That decision was made long before anyone had heard of PHP2Shell, and this week showed why it matters.
So this article isn't another news recap. It's about what PHP2Shell means for you as a business owner, and what to do about it.
What happened, in plain words
The flaw, nicknamed PHP2Shell, lets an attacker take control of a website's server without needing a password. Once inside, they can read customer data, steal passwords, or change the website however they want.
What made it worse is the timing. Details of the flaws became public before the fixes were released, so attackers had a head start. Cloudflare saw attack attempts climb from tens of thousands within 45 minutes of the October 21 disclosure to millions by the next morning.
Confirmed damage has started to appear. At a European government body, attackers used PHP2Shell to reach password data and MFA secrets, the codes behind two-factor logins, which are the very thing meant to keep accounts safe.
Most businesses never chose PHP. They inherited it. It came with the WordPress site a previous agency built, the theme someone bought years ago, or the online store set up in a hurry before a launch.
That's why so many owners were caught off guard. They assumed that keeping their website and plugins up to date meant they were protected. This time it didn't. Updating WordPress, WooCommerce or Magento changes nothing, because the flaw sits underneath the website, in the server software itself. On some setups the attack fires before the website even loads, so security plugins can't see it.
Then there are the sites everyone forgets: an old store left online after a migration, or campaign landing pages and microsites running on WordPress outside the main site. If it's online and runs on PHP, it's a door into your systems.
If you sell online
E-commerce businesses are directly in the firing line. Self-hosted stores on Magento, Adobe Commerce, WooCommerce, PrestaShop, Shopware and CS-Cart all need action. Stores on fully hosted platforms are in a different position, because the platform runs and patches the servers for you.
For a self-hosted store, the choices this week weren't good. Taking the store offline as a precaution means lost sales, possibly for days. Staying online unpatched risks something worse: customer names, addresses and payment-related data in someone else's hands. A refund policy doesn't fix that, and the damage to customer trust lasts much longer than the downtime.
Your tech stack is a business decision
Here's the part of this story that should concern business owners most. It isn't about the one flaw. It's about how old so much of the web is.
Around 59% of internet-facing PHP hosts that report their version run PHP 8.1 or older, which gets no official fix. Those versions are "end of life," meaning the people who make PHP have stopped supporting them. CISA's advice is that anyone still running PHP 8.1 or older should take those systems offline until they're patched or upgraded.
Think about what that means. If your business runs on unsupported software, this flaw isn't your only problem. Every future flaw arrives with no fix coming. You're no longer maintaining your website. You're just hoping.
To be honest about it: no technology is immune. Every language and platform will have serious flaws at some point, including the ones we use. Avoiding PHP isn't the lesson. The lesson is to build on modern technology that is actively supported, and to keep it maintained. When the next big flaw lands, and it will, the businesses on current, well-looked-after systems will have a normal week. That's what happened for our clients this time.
You don't need to be technical to act on this. Start here:
- Ask your host or developer two questions: what PHP version are our websites on, and has the October 21 security update been applied? The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Managed hosts may have handled it already. Automattic, for example, said sites on WordPress.com, WordPress VIP, WP Cloud and Pressable were already protected. Get a clear yes in writing.
- If the answer is 8.1 or older, treat it as urgent. A temporary patch may be possible, but the real fix is moving to a supported system.
- List every website you own. Include old stores, campaign pages and anything a past agency set up. If nobody can say who looks after a site, that's your answer.
- Make sure you have a fresh backup before anything on your server changes.
- Know what to do if something looks wrong. The FBI's advice is to isolate affected systems, keep the web server and PHP logs, and report it. Change admin and customer-facing passwords after any confirmed break-in.
- Check your insurance. Find out whether your policy covers a breach, and whether it covers the sales you lose if you take your site offline as a precaution.
What the future looks like
PHP2Shell is a preview of how security will work from now on.
The flaws were found by researchers using AI tools, during an audit OpenAI funded, with OpenAI and Google AI models. That's good news for defenders, but attackers have access to the same kind of tools. In the government breach above, investigators saw signs that the attackers used AI agents to explore the system after breaking in.
For businesses, this means three things:
- The time between a flaw being found and being exploited is shrinking to hours. "We'll update it next quarter" is no longer a plan.
- Maintenance is a budget line, not an afterthought. A website or app isn't finished at launch. It needs looking after, the same way you'd maintain any other business asset.
- Knowing your stack matters. You don't need to understand the code. You do need to know what your systems run on, who keeps them current, and how fast they can act when the next alert goes out.
Worried your website is exposed to PHP2Shell? Book a call with our team. We'll talk through where you stand and find the right solution to protect your online assets. [Book a call]
Get updates like this before they become headlines. [Subscribe]
