Two serious security holes were found in PHP, the behind-the-scenes software that powers a large share of the websites you visit every day. Fixes went out on Oct. 21, 2026. Until each website installs them, attackers could use the holes to take over the computers that run those sites and grab the passwords and data stored there.

For most people, there is nothing to install on your phone or computer. Website owners and hosting providers are responsible for installing the fix. You can still take steps to protect your accounts in case a site you use is compromised.

The PHP security team announced the two flaws, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), in an Oct. 21 security advisory and rated both 9.2 out of 10 for severity. The UK’s National Cyber Security Centre warned that “organisations using any version of PHP are affected.” PHP runs about 69.7% of websites whose server-side programming language is known, according to W3Techs data cited by Infosecurity Magazine.

What Is PHP?

PHP is a programming language that runs behind the scenes on many websites. When you log in to an account, add something to a shopping cart, or post a comment, PHP is often the software doing that work on the website’s computer, called a server. It runs on servers, not on your phone or laptop. Many popular website builders, including WordPress, Drupal, and Joomla, are built on PHP.

How the PHP2Shell Vulnerability Works

Both flaws stem from errors that occur while PHP is processing a request from a website visitor. When PHP fails partway through, it can leave data from that request behind in the server’s memory. Attackers can trigger these errors deliberately and exploit the leftover data to gain access to the server.

Both flaws involve how PHP cleans up after handling a request. According to PHP’s Oct. 21 advisory:

• CVE-2026-109618: When PHP runs out of memory at the wrong moment, it can stop while data is only partly set up, then treat that incomplete data as valid.
• CVE-2026-109619: After an error, PHP can keep a reference to memory it has already released, and a later request handled by the same server process can reuse it.

To exploit the flaws, an attacker sends specially built requests to a website and does not need a password. That can expose passwords, digital keys, and other secrets stored in the server’s memory, or let the attacker run their own commands on the server. Wiz Research showed the attack working against WordPress, Drupal, and Joomla sites.

Information about the flaws leaked online on Oct. 20, a day before the fixes came out, according to the PHP Foundation. Cloudflare said it saw attack traffic aimed at its customers after the leak. For a short window, PHP2Shell was effectively a zero-day threat, meaning attackers knew about it before a fix existed.

Artificial intelligence helped find the flaws. OpenAI said the research firm Calif used one of its AI models to find one of them, and Wiz independently found both with help from AI tools.

How the PHP Exploit Could Affect You

The main risk to you is indirect: a website you use gets hacked before it installs the fix. Think of it like a store whose back door was left unlocked. You didn’t do anything wrong, but your information inside the store could still be taken.

If an attacker breaks into a site’s server, they could:

• Steal account information, such as usernames, email addresses, and passwords stored on that site.
• Grab the site’s own keys and passwords, which attackers can use to reach other systems that hold customer data.
• Change what the site shows you, because whoever controls the server controls the pages it sends.

You may also notice some sites going offline for a while. Some Dutch government and education sites went down, and the HR software company BambooHR took its service offline as a precaution. A site going offline doesn’t by itself mean your data was stolen.

Attackers moved quickly. Amazon Threat Intelligence reported that one of its decoy servers caught an attack attempt on Oct. 17, four days before the flaws were made public, and said PHP2Shell “is now seeing broad exploitation attempts in the wild.” One web hosting platform blocked more than 60,000 suspicious requests probing the flaws by the evening of Oct. 21, according to The Hacker News. As of Oct. 23, no successful break-ins had been publicly confirmed, according to SecurityWeek.

Warning Signs to Watch For

You can’t see whether a website runs PHP or has been patched. What you can watch for are signs that a site you use was affected, or that scammers are using the news to trick you. McAfee’s guide to recognizing a phishing email covers more of the tricks to look for.

Red Flag	Why It Matters
A message telling you to download a “PHP update” or “PHP2Shell patch” for your phone or computer	PHP runs on website servers, not personal devices. A message like this is a scam.
An email from a company saying your data may have been exposed	The site may have been breached. Act on it, but log in by typing the site’s address yourself instead of clicking the link.
Password reset emails or login alerts you didn’t request	Someone may be trying to use stolen login details.
A familiar site suddenly asks for unusual information or tries to download a file	The site may have been tampered with. Leave it and check the company’s official channels.
Charges you don’t recognize on a card you used with an online store	Payment details may have been stolen.

How to Protect Yourself

You can’t patch other people’s websites, but you can limit the risk to yourself if one of them is breached. These steps help with PHP2Shell and with data breaches in general.

1. Use a different password for every account. If one site leaks your password, attackers can’t use it to get into your other accounts. A password manager can create and remember them for you.
2. Turn on multi-factor authentication. It adds a second step, like a code sent to your phone, so a stolen password alone isn’t enough to get in.
3. Set up alerts with your bank and card issuer. Text or email alerts for new charges let you spot fraud the day it happens, instead of weeks later on a statement.

If you run a personal blog or small business website: Ask your hosting company to confirm that PHP is updated to version 8.5.12, 8.4.27, 8.3.36, 8.2.35, or newer. Updating WordPress or your plugins is not enough on its own, according to Cloudflare, because the fix has to be made to PHP itself. If your site runs an older PHP version, ask your host to move it to a supported one.

What to Do If Your Information Was Exposed

If a company tells you your data may have been exposed, act quickly. Being caught up in a breach is not your fault, and these steps can limit the damage.

• Change your password for that site, and on any other account where you used the same one.
• Turn on multi-factor authentication for that account and for your email.
• Call your bank or card issuer if payment details may have been exposed, and ask about freezing or replacing the card.
• Consider a free credit freeze with Equifax, Experian, and TransUnion. It stops anyone from opening new credit in your name.
• Go to IdentityTheft.gov if your Social Security number or other identity details were exposed. It creates a step-by-step recovery plan.
• Keep records of the breach notice, any suspicious messages, and any charges you dispute.

How to Report It

If you lost money or think someone is using your information, report it:

• FTC: ReportFraud.ftc.gov for scams and fraud
• FBI Internet Crime Complaint Center: ic3.gov for online crime, including hacked websites
• Identity theft: IdentityTheft.gov
• Your bank or card issuer: for any unauthorized charges
• Local police: if you lost money or were threatened

PHP2Shell is a problem that website owners have to fix, but it can still impact your accounts if a site you use is breached. The most important thing you can do is use a unique password and multi-factor authentication for every account, so one breach doesn’t expose the rest.

FAQ

What is PHP2Shell?

PHP2Shell is the nickname for two serious security flaws in PHP, software that runs behind the scenes on many websites. Fixes were released on Oct. 21, 2026.

Do I need to update my phone or computer?

No. PHP runs on website servers, not personal devices, so the fix is up to website owners. Any message telling you to install a “PHP update” on your device is a scam.

Is my information at risk?

It could be, if a site you use was hacked before it installed the fix. Watch for breach notices from companies you do business with, and use unique passwords and multi-factor authentication.

How do I know if a website I use was affected?

You can’t tell by looking at a site. Companies that find a breach may notify you by email or post an update on their official website. Check the company’s site directly rather than trusting a link in an email.

Has the PHP exploit been used in real attacks?

Yes. Security firms including Amazon and watchTowr have reported widespread attack attempts, and Amazon saw one as early as Oct. 17, before the fix was public. No confirmed break-ins had been publicly reported as of Oct. 23.

The post PHP2Shell Leak Sparks Emergency Fix for Software Behind Most Websites: How to Stay Safe appeared first on McAfee Blog.

Digital certificates function like digital passports, confirming to your browser that a website is genuine so it can set up an encrypted connection for the information you send. On October 20, 2026, Ars Technica reported that eight intermediate digital certificates were compromised due to weak private signing keys. This vulnerability created a window where bad actors could forge credentials, impersonate legitimate websites, and intercept sensitive web traffic across the internet.

The TLS Certificate Vulnerability: What Happened and the Risks to Your Data

When you visit a secure website, like your bank, email provider, or healthcare portal, your web browser inspects the site’s digital certificate, often called an SSL certificate, to confirm you are connecting to the real service rather than an imposter. These certificates rely on cryptographic keys generated by authorized Certificate Authorities. When those keys are generated properly, each one is an enormous random number, far too large for anyone to guess. The danger comes when that randomness breaks down.

On October 17, 2026, a security researcher checking the Common CA Database discovered that eight subordinate certificates issued by Indian authority eMudhra relied on private keys between 3 and 8 bits in size. The researcher reported the flaw to Apple, Google, Microsoft, Mozilla, and eMudhra, and Mozilla made the incident public on October 20 on its Dev Security Policy forum. Keys of this type normally carry about 384 bits of randomness, but one of these compromised keys was generated as the number “4.”

With keys that weak, unauthorized actors could easily discover them and generate counterfeit security certificates for virtually any website. If an attacker positioned themselves between you and the internet, such as on a public Wi-Fi network, they could launch a man-in-the-middle attack. During this attack, your browser would mistakenly trust the fraudulent connection, exposing entered passwords, messages, and personal information.

There is no public evidence that anyone used these keys to forge certificates, and eMudhra says none of the affected certificates were used to issue certificates to websites. However, the weak keys existed from April 2025 until the flaw was reported in October 2026, so no one can say for certain that they went unnoticed for those 17 months.

Warning Signs of an Insecure Connection

A certificate forged with one of these keys would look legitimate to any device that hasn’t received the block, so there may be no visible warning at all. That’s why updates are your main defense. Still, these signs can point to an intercepted or unsafe connection:

• Sudden browser security warnings: On an updated device, a site using one of the blocked certificates triggers alerts like “Your connection is not private.”
• Repeated login requests: Prompts demanding credentials on websites where your browser normally keeps you signed in.
• Unexpected account security alerts: Emails or texts about sign-ins, password changes, or new devices you don’t recognize.
• Address bar discrepancies: URLs that switch from HTTPS to HTTP, or subtle typos in web addresses.
• Suspicious Wi-Fi networks: Networks with names nearly identical to a legitimate one, or that ask for personal details before you can connect.

How to Protect Yourself From Insecure Connections and Man-in-the-Middle Attacks

Google, Mozilla, Apple, and Microsoft have all blocked the compromised certificates. Chrome and Firefox blocked them on October 17, the day the flaw was reported. Android devices received a block on October 19, and Apple and Microsoft devices followed on October 19 and 20. Most browsers are now protected, but apps and older devices that don’t get regular updates may still trust the bad certificates. Keeping everything up to date closes that gap:

• Keep your web browser up to date. Browsers receive lists of blocked certificates automatically, but installing any pending update and restarting your browser makes sure you have the latest protections.
• Install all pending operating system updates. Operating systems maintain internal certificate trust stores. Updating your phone, tablet, and computer helps non-browser apps, including mobile banking and email clients, reject compromised certificates. Older devices that no longer receive updates are the most exposed.
• Avoid public Wi-Fi for sensitive activities. Man-in-the-middle attacks require access to your shared network path. When accessing sensitive accounts, mobile cellular data or a private home network you control is generally safer.
• Heed certificate warnings. If your browser blocks a page due to an invalid certificate, close the tab immediately rather than clicking past the warning screen.

What to Do If You’ve Already Been Targeted

If you have reason to believe you entered sensitive information over an untrusted or intercepted connection, act quickly to secure your data and accounts:

• Disconnect and update passwords: Disconnect from the suspicious network immediately. Using a separate, secure connection, change passwords for any accounts accessed during that session and enable multi-factor authentication (MFA).
• Notify your financial institutions: Monitor your bank and credit card accounts for unauthorized transactions, and notify your card issuer if financial details were entered.
• Set up a credit freeze: Contact the three primary credit bureaus (Equifax, Experian, and TransUnion) to freeze your credit files if personal identifying details were exposed.
• Document and begin identity recovery: If sensitive personal data was compromised, create a personalized recovery plan through IdentityTheft.gov.

How to Report Suspicious Online Incidents

You can report suspicious cyber activity to official consumer protection agencies. File an incident report with the FBI Internet Crime Complaint Center (IC3) or submit a fraud complaint to the Federal Trade Commission (FTC).

Broad infrastructure vulnerabilities demonstrate why digital security requires cooperation across every layer of the internet. While global security teams and certificate authorities identify and revoke flawed credentials at the root level, taking simple personal actions, such as applying system updates and maintaining healthy browsing habits, goes a long way toward keeping your personal devices secure.

The post Flawed Certificates Left Web Traffic Open to Interception: How to Stay Safe appeared first on McAfee Blog.