GovernmentUpdated 23 Oct 2026
In 30 seconds
Two serious flaws were found in PHP, a language that runs many websites. India's cyber agency CERT-In and agencies in the US and UK told site owners to update fast. Some sites went offline while owners fixed them.
Two serious flaws were found in PHP, a language many websites use. They are nicknamed PHP2Shell. The PHP project released fixes on 2026-10-21. CERT-In, India's computer emergency response team, and agencies in the US and UK then issued warnings.
Our sources name no Act, section or Article of the Constitution of India for this issue. CERT-In's note and the US warnings are technical advice. Our sources give no legal basis for the note. No court has ruled, and our sources show no case pending.
CERT-In and US agencies say attackers could take over servers, so sites must update fast. The PHP project has released fixes for the flaws. OpenAI and Google say the flaws are serious and that AI helped find them. Fortune says OpenAI is poised to cash in.
Our sources do not say how many sites were actually hacked. They name no Indian victims. There is no official count of Indian sites at risk. They do not say who is behind any attacks. No court dates or deadlines were found.
The causes and the earlier steps behind this issue.
Our sources say the flawed code dates back to PHP 5.4, released in 2012. Later versions kept it. A memory problem was spotted in 2024 but was not made a priority.
About 70% of websites use PHP, according to our sources. So one flaw in PHP can reach millions of sites. Many site owners may not know they use it.
Watch for a count of sites actually hacked, as our sources have none.
The NSA advises extra monitoring for now.
Hard words used on this page, in plain English.
What the law or the rule says, in plain words. This page says what the law says, not who is right.
CERT-In is India's national cyber agency. Its note CIVN-2026-0510, dated 2026-10-21, rates the flaws critical. It warns that attackers could run code and take over systems. It advises limiting access, using a web application firewall (a filter that blocks bad web traffic), and checking logs and backups. Our sources call this advice, not an order. No court has ruled on it.
CISA is the US cyber-defence agency. It strongly urges organisations to patch at once. It says PHP systems that cannot be patched should go offline. The same applies to PHP 8.1 and older, which the PHP project no longer updates. No court has ruled on this alert.
Made a reel on this (0)
Nobody yet.
Headlines from other outlets. We show the headline, the outlet and the date, and link out. We do not copy their articles or pictures.
Different views on this issue, in simple words. SocialWire shows them; it does not say which is right.
The strongest argument each side makes, the evidence it points to, and the weak point its critics raise. We do not say who is right.
CERT-In and US agencies say attackers could take over servers. They say sites must update at once or go offline.
Evidence it cites
CERT-In rates the flaws critical. CISA, the NSA and the FBI issued warnings on 2026-10-21.
Weak point critics raise
Our sources note that being open to a flaw does not mean a site was hacked. No official count of Indian sites at risk exists.
Swipe through the issue, one card at a time.
1 of 13
Two serious flaws were found in PHP, a language many websites use. They are nicknamed PHP2Shell. The PHP project released fixes on 2026-10-21. CERT-In, India's computer emergency response team, and agencies in the US and UK then issued warnings.
2 of 13
Our sources say attackers could take over a website's server, the computer that hosts it. They say PHP runs about 70% of websites. Some sites went offline during the fix. Being open to the flaw does not mean a site was hacked.
3 of 13
Our sources name no Act, section or Article of the Constitution of India for this issue. CERT-In's note and the US warnings are technical advice. Our sources give no legal basis for the note. No court has ruled, and our sources show no case pending.
4 of 13
CERT-In and US agencies say attackers could take over servers, so sites must update fast. The PHP project has released fixes for the flaws. OpenAI and Google say the flaws are serious and that AI helped find them. Fortune says OpenAI is poised to cash in.
5 of 13
Our sources do not say how many sites were actually hacked. They name no Indian victims. There is no official count of Indian sites at risk. They do not say who is behind any attacks. No court dates or deadlines were found.
6 of 13
Share of websites that use PHP, per our sources: About 70% Serious flaws in PHP: 2 Severity score (CVSS v4.0): 9.2 out of 10 CERT-In note number, dated 2026-10-21: CIVN-2026-0510 Indian victims named so far: None
7 of 13
Fortune says AI security tools may become a business for OpenAI. Our sources give no cost figure for Indian firms.
8 of 13
News reports say ordinary users felt the effect when sites went offline during the fix.
9 of 13
Supporters of this view say the flaw was found and fixed before wide damage was reported.
10 of 13
Making a reel on this? Everything you need in one place: the summary, the timeline, the facts and the sources.
Use them as a start, in your own words.
Nobody yet. Be the first.
PHP programming language security flaw and government warnings Two serious flaws were found in PHP, a language that runs many websites. India's cyber agency CERT-In and agencies in the US and UK told site owners to update fast. Some sites went offline while owners fixed them. TIMELINE 2026-10-17: Amazon's threat team saw the first attempt to attack the flaw, according to our sources. 2026-10-20: Details of the flaws leaked online, and PHP announced an emergency fix. 2026-10-21: PHP released fixes about a day earlier than planned. 2026-10-21: CERT-In published a critical vulnerability note. The US NSA, CISA and FBI also warned site owners. 2026-10-22: Agencies in the US, UK and Europe told firms to patch or go offline. Sites were taken down worldwide. 2026-10-23: IBM said exploit attempts were emerging. Reports said European sites had gone dark. THE BASICS What happened? Two serious flaws were found in PHP, a language many websites use. They are nicknamed PHP2Shell. The PHP project released fixes on 2026-10-21. CERT-In, India's computer emergency response team, and agencies in the US and UK then issued warnings. Why does it matter? Our sources say attackers could take over a website's server, the computer that hosts it. They say PHP runs about 70% of websites. Some sites went offline during the fix. Being open to the flaw does not mean a site was hacked. What do the law and the Constitution say? Our sources name no Act, section or Article of the Constitution of India for this issue. CERT-In's note and the US warnings are technical advice. Our sources give no legal basis for the note. No court has ruled, and our sources show no case pending. What does each side say? CERT-In and US agencies say attackers could take over servers, so sites must update fast. The PHP project has released fixes for the flaws. OpenAI and Google say the flaws are serious and that AI helped find them. Fortune says OpenAI is poised to cash in. What is still undecided? Our sources do not say how many sites were actually hacked. They name no Indian victims. There is no official count of Indian sites at risk. They do not say who is behind any attacks. No court dates or deadlines were found. FACTS AND FIGURES Share of websites that use PHP, per our sources: About 70% (ThePrint) Serious flaws in PHP: 2 (The Times of India) Severity score (CVSS v4.0): 9.2 out of 10 (The Times of India) CERT-In note number, dated 2026-10-21: CIVN-2026-0510 (The Times of India) Indian victims named so far: None (The Indian Express) PERSPECTIVES Economic lens: Fortune says AI security tools may become a business for OpenAI. Our sources give no cost figure for Indian firms. - Fortune's headline says OpenAI is poised to cash in on the PHP bug. - Fortune links this to a new era for the internet. - Our sources do not give the full argument. - No cost to Indian firms was found. Social lens: News reports say ordinary users felt the effect when sites went offline during the fix. - The New York Times asks why government and business sites are going offline. - BBC reports sites taken down worldwide. - Being open to the flaw does not mean a site was hacked. Argued benefit for India: Supporters of this view say the flaw was found and fixed before wide damage was reported. - PHP released fixes on 2026-10-21. - The Hindu reports AI helped expose the flaws. - OpenAI and Wiz say AI can help defenders find bugs. - CERT-In issued a public warning. Argued risk for India: Others say the risk is large because so many sites use PHP and exploit attempts are emerging. - ThePrint says about 70% of websites could be affected. - IBM says exploit attempts are emerging. - Old PHP versions no longer get updates and must be upgraded. - Our sources name no Indian victims so far. HOW WE GOT HERE Old code, long unfixed: Our sources say the flawed code dates back to PHP 5.4, released in 2012. Later versions kept it. A memory problem was spotted in 2024 but was not made a priority. PHP runs much of the web: About 70% of websites use PHP, according to our sources. So one flaw in PHP can reach millions of sites. Many site owners may not know they use it. Leak forced an early fix: Attack attempts were seen on 2026-10-17. Details leaked on 2026-10-20. PHP then released fixes a day early, on 2026-10-21. Warnings and shutdowns: After the fix, agencies told firms to patch or go offline. Sites that could not update were taken down in several places. EACH SIDE'S CASE Government cyber agencies: CERT-In and US agencies say attackers could take over servers. They say sites must update at once or go offline. - Evidence it cites: CERT-In rates the flaws critical. CISA, the NSA and the FBI issued warnings on 2026-10-21. - Weak point critics raise: Our sources note that being open to a flaw does not mean a site was hacked. No official count of Indian sites at risk exists. Website owners and users: Owners of WordPress and other PHP sites say they face risk from a flaw in PHP itself. - Evidence it cites: Reports say sites went offline worldwide as a precaution. - Weak point critics raise: Our sources name no Indian victims. They give no statement from site owners. WHO IS SAYING WHAT Fortune (US business magazine): Frames it as a new era for the internet. Says OpenAI is poised to cash in. BBC (UK broadcaster): Stresses what PHP is and the race to update computer systems. The New York Times (US daily): Asks why government and business websites are going offline. The Times of India (Indian daily): Stresses the global scramble and CERT-In flagging the flaws. The Indian Express (Indian daily): Explains what US and Indian government warnings mean for websites. IBM (US technology company): Says critical PHP flaws put millions of websites at risk as exploit attempts emerge. WHAT TO WATCH NEXT Watch for a count of sites actually hacked, as our sources have none. The NSA advises extra monitoring for now. WORDS EXPLAINED PHP: A programming language that many websites use to run their pages and shops. CERT-In: The Indian Computer Emergency Response Team. It is India's national cyber agency and issues security warnings. CISA: The US cyber-defence agency. It issued a warning on the PHP flaws. server: A computer that stores a website and sends its pages to visitors. patch: A software update that fixes a security flaw. web application firewall: A filter that blocks bad traffic before it reaches a website. exploit: A way or tool that attackers use to take advantage of a flaw. WordPress: Popular software for building websites. It runs on PHP. WHAT THE LAW SAYS CERT-In's PHP warning note: CERT-In is India's national cyber agency. Its note CIVN-2026-0510, dated 2026-10-21, rates the flaws critical. It warns that attackers could run code and take over systems. It advises limiting access, using a web application firewall (a filter that blocks bad web traffic), and checking logs and backups. Our sources call this advice, not an order. No court has ruled on it. CISA's alert on PHP: CISA is the US cyber-defence agency. It strongly urges organisations to patch at once. It says PHP systems that cannot be patched should go offline. The same applies to PHP 8.1 and older, which the PHP project no longer updates. No court has ruled on this alert. WHAT THE SOURCES SHOW Established: Two serious flaws were found in PHP. The PHP project released fixes on 2026-10-21. CERT-In, CISA, the NSA and the FBI warned site owners. Some sites went offline. Our sources name no Indian victims and no court case. Claimed by one side: Agencies say attackers could take over servers and sites should update at once. Claimed by the other side: Our sources show some reports of exploit attempts, while others said no working exploits had been seen. Sources conflict on how old the flaws are. Not yet decided: How many sites were hacked, who is behind attacks, and whether Indian systems were hit. SOURCES The Times of India - https://timesofindia.indiatimes.com/business/india-business/php-security-flaws-trigger-global-scramble-cert-in-flags-critical-vulnerabilities/articleshow/135122467.cms BBC - https://www.bbc.com/news/articles/cmly0lg3w5x2o The Times of India - https://timesofindia.indiatimes.com/technology/tech-news/patch-or-go-offline-say-security-agencies-in-the-us-uk-and-europe-to-companies-as-two-critical-bugs-in-php-put-millions-of-websites-at-risk/articleshow/135100188.cms CNBC TV18 - https://www.cnbctv18.com/technology/us-nsa-indias-cert-in-warn-of-critical-php-flaws-that-could-let-hackers-take-over-servers-20016561.htm ThePrint - https://theprint.in/tech/how-computer-language-flaws-found-using-ai-could-impact-70-websites-cert-in-issues-critical-alert/3078520/ The New York Times - https://www.nytimes.com/2026/10/22/technology/what-is-php-vulnerability-risks.html Moneycontrol.com - https://www.moneycontrol.com/technology/cert-in-flags-critical-php-flaws-that-could-let-hackers-take-control-of-servers-article-14057522.html The Hindu - https://www.thehindu.com/sci-tech/technology/websites-go-dark-as-ai-exposes-critical-security-flaws/article71609942.ece Fortune - https://fortune.com/2026/10/22/php-security-flaw-ai-powered-attacks-hackers-openai-daybreak/ IBM - https://www.ibm.com/think/news/critical-php-flaws-millions-websites-risk-exploit-attempts-emerge The Indian Express - https://indianexpress.com/article/technology/cert-in-php-vulnerability-alert-india-cybersecurity-warning-us-nsa-php-alert-10931962/ The Times of India - https://timesofindia.indiatimes.com/videos/international/europe-websites-go-dark-after-major-cybersecurity-flaw-sparks-hacker-warning/videoshow/135130389.cms WION - https://www.wionews.com/technology/php-security-alert-why-wordpress-and-other-websites-need-urgent-updates-1792660720022 The Hindu - https://www.thehindu.com/sci-tech/technology/what-is-php-and-why-is-it-facing-a-security-crisis/article71611487.ece The Indian Express - https://indianexpress.com/article/explained/explained-sci-tech/php2shell-php-security-flaws-websites-offline-explained-10931935/lite/ BBC - https://www.bbc.com/news/articles/c9j34zgmkxx1o BBC - https://www.bbc.com/news/articles/c3qjnwye0ep5o The Times of India - https://timesofindia.indiatimes.com/business/international-business/php-security-flaws-trigger-global-scramble/articleshow/135127762.cms More: https://socialwire.in/issues/php-programming-language-security-flaw-and-government-warnin
Named or shown on this page? Send your reply. Something wrong or a reel to remove? Report a problem. How replies and corrections work
Attack attempts were seen on 2026-10-17. Details leaked on 2026-10-20. PHP then released fixes a day early, on 2026-10-21.
After the fix, agencies told firms to patch or go offline. Sites that could not update were taken down in several places.
Owners of WordPress and other PHP sites say they face risk from a flaw in PHP itself.
Evidence it cites
Reports say sites went offline worldwide as a precaution.
Weak point critics raise
Our sources name no Indian victims. They give no statement from site owners.
Experts, public figures and news outlets, in how they frame it. Each is listed with a source.
FortuneNews outletUS business magazine
Frames it as a new era for the internet. Says OpenAI is poised to cash in.
BBCNews outletUK broadcaster
Stresses what PHP is and the race to update computer systems.
The New York TimesNews outletUS daily
Asks why government and business websites are going offline.
The Times of IndiaNews outletIndian daily
Stresses the global scramble and CERT-In flagging the flaws.
The Indian ExpressNews outletIndian daily
Explains what US and Indian government warnings mean for websites.
IBMGroupUS technology company
Says critical PHP flaws put millions of websites at risk as exploit attempts emerge.
Fortune says AI security tools may become a business for OpenAI. Our sources give no cost figure for Indian firms.
News reports say ordinary users felt the effect when sites went offline during the fix.
Supporters of this view say the flaw was found and fixed before wide damage was reported.
Others say the risk is large because so many sites use PHP and exploit attempts are emerging.
Others say the risk is large because so many sites use PHP and exploit attempts are emerging.
11 of 13
CERT-In is India's national cyber agency. Its note CIVN-2026-0510, dated 2026-10-21, rates the flaws critical. It warns that attackers could run code and take over systems. It advises limiting access, using a web application firewall (a filter that blocks bad web traffic), and checking logs and backups. Our sources call this advice, not an order. No court has ruled on it.
12 of 13
CISA is the US cyber-defence agency. It strongly urges organisations to patch at once. It says PHP systems that cannot be patched should go offline. The same applies to PHP 8.1 and older, which the PHP project no longer updates. No court has ruled on this alert.
13 of 13
Established: Two serious flaws were found in PHP. The PHP project released fixes on 2026-10-21. CERT-In, CISA, the NSA and the FBI warned site owners. Some sites went offline. Our sources name no Indian victims and no court case. Claimed by one side: Agencies say attackers could take over servers and sites should update at once. Claimed by the other side: Our sources show some reports of exploit attempts, while others said no working exploits had been seen. Sources conflict on how old the flaws are. Not yet decided: How many sites were hacked, who is behind attacks, and whether Indian systems were hit.