If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency updates and consider temporarily taking affected services offline until they can be patched.

The vulnerabilities, known as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a severity rating of 9.2 out of 10.

Why this matters

PHP is a programming language that works behind the scenes to power a large part of the web. It underpins WordPress, Drupal, Joomla, Magento, and many other applications, including software whose users may not realize PHP is involved.

Successful exploitation could let an attacker run malicious code on an affected server without logging in. That code would run with the permissions available to the PHP process, potentially allowing attackers to steal application data, alter website content, or establish a backdoor.

The PHP team says all PHP installations serving web requests are at risk. In some configurations, an attacker can trigger an exploit before the website’s own code even runs.

Cloudflare’s chief technology officer, Dane Knecht, has reported “early attacks emerging,” while warning that firewall mitigations are only a stopgap.

Emergency patches are now available

The PHP team scheduled its emergency security updates for October 21 at 10:00 am ET (14:00 UTC). It has now released fixes in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and urges users to update immediately. Administrators should check with their hosting provider or operating system vendor for the appropriate updated packages.

You may still encounter offline websites while administrators install the updates and check their systems.

CERT-EU recommends identifying PHP-based applications and patching as soon as possible. Where an immediate fix is not feasible, it advises considering isolation of internet-facing applications from public networks.

The risk may outlast today’s emergency

The longer-term concern is forgotten infrastructure: abandoned websites, unsupported applications, and connected devices with PHP-based management interfaces. Vulnerable installations may remain exposed if nobody maintains them or a vendor no longer supplies updates.

PHP 8.1 and older no longer receive routine security updates from the PHP project. Administrators using those versions should check whether their vendor supplies a fix or arrange an upgrade to a supported version.

Website owners should establish who updates their underlying PHP installation. Updating WordPress or its plugins is not the same as updating PHP. Hosting providers or server administrators may need to apply the fix.

For visitors, temporary downtime alone doesn’t mean a website has been breached. It may reflect a protective decision while its administrators install updates.

However, consumers need to be extra careful as a “trusted website” may no longer be trustworthy, and not just because of PHP2Shell, but also because of eight compromised TLS certificates.

Shahak Shalev, Global Head of Scam and AI Research at Malwarebytes, said:

“This is a goldmine for hackers. They can hijack real websites to take advantage of the site’s reputation to do things like phish people, serve malicious software from the trusted channel. The opportunities are endless.”

What to do

If you’re a website visitor:

• Some websites may temporarily go offline while they are patched.
• Watch for unexpected content, downloads, or redirects, and repeated login requests, even on familiar sites.
• If something looks wrong, leave the page.
• You don’t need to install PHP updates on your own device.

If you’re a website owner:

• Ask your hosting or IT provider to confirm PHP fixes are installed, not just scheduled, across all your websites and applications.
• If they can’t patch immediately, ask whether affected services should temporarily be taken offline.
• If you manage your own servers, follow PHP’s update instructions.
• Using unsupported PHP? Check for a vendor fix or upgrade to a supported version.

What Malwarebytes is doing

• Helping keep you safe from hacked websites: Malwarebytes web protection and Browser Guard block known harmful sites, scam pages, and dangerous downloads. Our researchers are watching for websites compromised through these flaws so we can quickly add them to our block lists.
• Updating our own websites: We use a managed hosting provider and are working with them to install the PHP fixes. We are closely monitoring our websites until the updates are in place.

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

WordPress has patched a serious core vulnerability chain known as wp2shell, and site owners are understandably focused on updating their own sites. But there’s another question worth asking: what happens to ordinary visitors when they land on a compromised site?

Because a hacked website becomes a delivery mechanism for scams, credential theft, malware, and malicious redirects.

The wp2shell vulnerabilities are especially concerning because they affect WordPress Core itself, don’t require a malicious or vulnerable plugin, and can be exploited without authentication on vulnerable versions. Experts say the chain can lead to full administrative control of a site and remote code execution with web server privileges, meaning an attacker can change what the site serves to visitors.

And cybercriminals are already doing their dirty work:

“Exploitation activity began within hours of the patch release. Wordfence observed endpoint probing and SQL injection attempts the same evening, and public proof-of-concept code was reported in the days that followed.”

Once attackers control a WordPress site, they rarely stop at defacement. A common next step is to quietly inject JavaScript, redirect visitors to malicious pages, or load content from attacker-controlled infrastructure. That can expose visitors to fake login pages, scam pop-ups, browser-based malware, or drive-by downloads, depending on the attacker’s goals.

The possible harm

This isn’t an exhaustive list, but these are some of the ways visitors to a wp2shell-compromised site could be affected:

• Credential theft. Attackers can inject fake login forms or iframe-based overlays that imitate Microsoft 365, Google, banking, or social media sign-in pages to steal usernames and passwords.
• Malware delivery. The site can be turned into a staging point for browser exploitation, malicious downloads, or redirect visitors to malware-hosting pages.
• Scams and fraud. Visitors may be redirected to fake support pages, fake giveaways, or fraudulent payment prompts.
• Tracking and profiling. Attackers can use injected scripts to fingerprint visitors, harvest browser details, and track victims across sessions.
• Search and reputation damage. Search engines and security tools may flag the site, which can expose visitors to warnings and reduce trust long after the initial compromise.

What you can do

Be cautious, even on websites you normally trust. If something looks different from what you’d expect, treat it as a warning sign.

Be especially wary of unexpected login prompts, download requests, and browser warnings. For site owners, it means patching quickly and treating compromise as a possibility, not an edge case.

Keep your operating system, browsers, and security software up to date. Compromised websites can also try to exploit known vulnerabilities on visitors’ devices.

Use an up-to-date, real-time anti-malware solution that can alarm you if a website tries to infect your device.

Pro tip: Use Malwarebytes’  free Browser Guard extension. It uses heuristic detection to identify malicious websites, block scams, and protect against other web-based threats.

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →