October 2026 has brought a series of serious cybersecurity incidents into focus, from critical vulnerabilities in PHP to AI-assisted attacks on businesses and breaches involving sensitive customer information.
The developments have raised a troubling question for website owners, developers and everyday internet users: how safe is the infrastructure that keeps the internet running?
The term “Black October” captures the anxiety surrounding these incidents, but the events should not be mistaken for one coordinated attack against the entire internet. The evidence points to several distinct security incidents and disclosures, including a critical pair of PHP vulnerabilities, an AI-assisted campaign targeting organisations through IT infrastructure, and breaches affecting cloud development platforms and financial customers.
The PHP vulnerabilities are especially significant because PHP is widely used to power websites and web applications. However, the claim that 70% of websites are in danger needs context. Widespread use of PHP does not mean that 70% of websites have been hacked, or that every website using PHP is equally exposed.
Key Takeaways
- The PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) pose a critical risk, allowing potential remote command execution on vulnerable servers.
- While PHP powers a vast majority of the web, the 70% danger figure is a measure of reach, not a verified count of compromised or uniquely vulnerable systems.
- Artificial Intelligence is increasingly a double-edged sword, utilized by both researchers to identify critical patches and by state-aligned threat actors to automate cyberattacks.
- Organizations must prioritize security patching while simultaneously auditing logs to ensure that no earlier, undetected intrusions have occurred.
PHP2Shell: The Critical Vulnerability Behind the Alarm
The most prominent development this week is the disclosure of two critical vulnerabilities in the PHP programming language, identified as CVE-2026-109618 and CVE-2026-109619. Researchers have referred to the vulnerabilities collectively as PHP2Shell.
Google Cloud and the UK NCSC have issued urgent warnings regarding two critical 9.2-severity PHP vulnerabilities, and to brief you on how critical this is, a 9.2 score signifies that successful exploitation can grant attackers remote code execution and total system takeover without needing login credentials.
PHP is a server-side programming language used to generate dynamic web pages, process requests and support applications and content management systems. It is part of the technology stack behind many websites, including services built using popular web frameworks and platforms.
The danger with PHP2Shell is that, under vulnerable conditions, a specially crafted request could trigger memory corruption and potentially allow an attacker to execute commands on an affected server without first logging in.
Depending on the circumstances, this could expose sensitive information or give an attacker control over parts of the compromised system. That makes the issue more serious than a routine website bug. If an attacker gains control of a web server, they may be able to access data, tamper with files, steal credentials or use the compromised system as a stepping stone into other parts of an organisation’s infrastructure.
Why Could the PHP Flaw Affect So Many Websites?
PHP’s popularity is the reason this vulnerability has attracted such widespread attention. The language is used across a large ecosystem of websites, hosting environments, content management systems and business applications. A flaw in the PHP runtime can therefore have consequences beyond a single website or software product.
However, the often-repeated figure of 70% should not be interpreted as the percentage of websites confirmed to be vulnerable or compromised. It refers to the broad reach attributed to PHP in discussions of the incident, not a verified count of affected sites. Actual exposure depends on factors such as the PHP version in use, how the server is configured, whether the relevant code path can be triggered and whether security updates have been applied.
The risk is not limited to large companies. Small businesses, online stores, blogs and organisations running their own servers may also use PHP-based applications. Website owners who rely on managed hosting may not know which runtime version their provider operates, making it important to check with the hosting company rather than assume the platform has already been secured.
The important distinction is between potential exposure and confirmed compromise. A website can run vulnerable software without evidence that an attacker has successfully exploited it. Equally, installing a patch does not automatically establish whether an earlier intrusion took place, so organisations should also review relevant logs and security alerts.
AI Helped Researchers Find the Flaws—and Attackers Can Use AI Too
One of the most striking aspects of the PHP2Shell disclosure is the role of artificial intelligence in security research. Google Cloud and Google DeepMind reported that AI models, including Gemini 4 Argon, contributed to finding and analysing the PHP vulnerabilities, supporting exploit development, detecting attacks and validating the fix. This illustrates how AI can help defenders examine complex software behaviour and identify bugs that might otherwise remain undiscovered.
But the same broader advances in automation can also benefit attackers. Microsoft’s October 21 report described an AI-driven campaign in which a China-state-aligned group, tracked as Storm-0940, used an agentic penetration-testing framework called ARTEX. Microsoft linked the campaign to the ConnectWise Cloud Backup compromise and said the activity targeted hundreds of organisations across multiple industries.
According to Microsoft, the framework helped automate reconnaissance and other offensive security activities. The campaign included attempts to obtain privileged access to cloud environments, and the company reported that some organisations were successfully compromised. ConnectWise has also described its investigation into unauthorised access and the suspension of related services while remediation continued.
The lesson is not that AI independently carries out every cyberattack. Rather, AI-powered tools can help people automate and accelerate existing techniques. That can increase the volume and speed of malicious activity, placing greater pressure on security teams to detect suspicious behaviour and respond quickly.
What Bloggers and Website Owners Should Do
If you own a blog, an online store, or any other website, the first step is to check which PHP version your website is running and whether the latest security patches have been installed.
How to check your PHP version
If you use WordPress, log in to your dashboard and go to Tools → Site Health → Info → Server. You should find your PHP version listed there.
You can also check your hosting control panel, such as cPanel, or contact your hosting provider and ask them to confirm which PHP version your live website uses.
Update PHP to a patched version
For the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), the reported patched versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
If your website runs an earlier release, check your hosting provider’s security advisory and arrange an update to a version that includes the fixes. Some hosting providers and operating-system vendors backport security fixes, so an older-looking version number does not always mean the server remains vulnerable. Confirm that the specific package you use has been patched.
What if your website uses an older PHP version?
PHP 8.1 and older branches have reached end of life. They no longer receive regular upstream security updates, although some vendors may provide their own security patches.
If your website uses one of these versions, ask your hosting provider to confirm its security status and plan a migration to a supported PHP release. If you manage the server yourself, follow your vendor’s update instructions and restart PHP-FPM or other relevant services when required.
Take extra precautions if you cannot update immediately
If an immediate update is not possible, consult your hosting provider or a security professional about temporary measures to reduce exposure. A web application firewall (WAF) may help block some malicious requests, but it is not a substitute for installing the appropriate security fixes.
You should also update your content management system, plugins, themes, and server software. Enable multi-factor authentication (MFA), review your website’s logs for suspicious activity, change potentially exposed passwords or credentials, and keep backups that you know how to restore.
Most importantly, do not panic—but do not ignore the warning. Running PHP does not automatically mean your website has been hacked. Checking your PHP version, confirming that the relevant patches are installed, and keeping your website’s software up to date are practical steps you can take to reduce the risk.
Critical PHP vulnerabilities may allow attackers to run commands on affected servers. Check your website before assuming it is safe.
Tick each step after you have completed or verified it.
What is PHP2Shell?
Does using WordPress mean I’m affected?
What if I suspect my site was compromised?
Join our community by subscribing to our Weekly Newsletter to stay updated on the latest AI updates and technologies, including the tips and how-to guides.
(Also, follow us on Instagram (@tid_technology) for more updates in your feed and our WhatsApp Channel to get daily news straight to your Messaging App).
