PHP2Shell and SSL Attacks: Website Hacks of 2026 Explained

Website security news in October 2026 has been unusually heavy. Two critical flaws in PHP, nicknamed PHP2Shell, put a language that runs most of the web under active attack. At the same time, the SSL/TLS system that browsers use to trust websites took two separate hits: hijacked certificates tied to country domain registries, and a certificate authority whose private keys turned out to be absurdly weak. Add a steady stream of WordPress plugin exploits, and many site owners are asking what is real, what is hype and what they should do today. This guide covers each incident, what attacks cost companies, and a practical checklist. Facts are current as of October 31, 2026, and the situation is still developing.

Quick Summary of the Main Threats

PHP2Shell: The PHP Flaws Everyone Is Talking About

What happened

On October 21, 2026, the PHP team released emergency security updates for two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 for severity. They can let an attacker run code on a vulnerable server without any login. PHP is used by roughly 70 percent of websites whose server language is known, so the potential reach is huge. The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, or anything newer.

Technical details leaked before the planned announcement, which pushed the release forward. Cloudflare said it saw attack traffic on the morning of the release, and Amazon’s threat team reported suspected attempts days before the public announcement.

Why it is not only a WordPress problem

The flaws are in PHP itself, not in one application. WordPress has clarified that the problem is not specific to its software, but any WordPress, Drupal or Joomla site running a vulnerable PHP version can be exposed. Updating plugins alone does not fix it. Your server needs the patched PHP version.

How serious has real exploitation been?

Early headlines were dramatic, and the first week was more mixed than feared. Security firms noted that many public proof of concept exploits did not work, because they relied on a PHP setting that is rarely used in real servers. Mandiant reported that some working exploits succeed against default Apache mod_php setups but not against PHP-FPM.

That changed on October 26 and 27. The US cyber agency CISA added both flaws to its Known Exploited Vulnerabilities list, and researchers at Perplexity reported confirmed remote code execution on a honeypot running Apache mod_php with PHP 8.4.26. Experts treated that as the first high quality confirmation of successful exploitation.

The Palo Alto Networks firewall campaign

The most serious confirmed damage so far was reported on October 30. Researchers at Dream and Palo Alto Networks Unit 42 said a suspected China-linked actor chained the PHP flaws with a Linux kernel privilege escalation bug to gain root access on 25 Palo Alto Networks firewall and management servers in the United States, Japan, Taiwan and South Korea. The targets included servers linked to the US government. After getting in, the attackers went after Microsoft Active Directory, and researchers confirmed directory listing and credential theft.

According to the report, the campaign began around October 8 with an AI-assisted scanning platform. About 19,000 firewalls were scanned by October 23, the list was narrowed to 240 targets, and roughly two dozen were compromised. Palo Alto Networks said only about 0.02 percent of its global firewall base was exposed to the internet and potentially affected.

Which companies lost service?

Some organizations took systems offline as a precaution while patching. A Belgian education platform, Smartschool, went offline on October 21, and local reports described other institutions pulling services for emergency fixes. Beyond the firewall campaign, public information about confirmed company losses from PHP2Shell is still limited, so treat claims of widespread outages with care until they are verified. Cyber insurers have also said they are watching the issue closely.

One more risk factor: Shadowserver reported more than 260,000 end-of-life PHP installations in the United States alone. Those versions no longer get official security fixes, so their owners must upgrade to a supported version.

SSL and TLS Attacks in 2026

SSL, now technically TLS, is the padlock system that lets browsers confirm they are talking to the real website. Three different problems have hit it this year, and it helps to keep them apart.

1. Hijacked country domain registries

In early October, Google disclosed that attackers compromised the registries behind three country code domains, .gh for Ghana, .sl for Sierra Leone and .as for American Samoa. By changing authoritative DNS records, they obtained unauthorized HTTPS certificates for several Google domains and for other large organizations. Google said the certificate authorities that issued them appeared to have followed normal procedures, because the weakness is that DNS control is used as proof of domain ownership. Chrome blocked the certificates with a CRLSet update, and Firefox used its own revocation system. Google advised domain owners to watch Certificate Transparency logs for unexpected certificates and to publish strict CAA records that name exactly which authority may issue for their domain.

2. The eMudhra weak key incident

On October 17, a researcher found that the private keys behind eight intermediate certificates run by the Indian certificate authority eMudhra were tiny numbers, below 256, and could be worked out from public certificates. Anyone holding such keys could in theory forge certificates that browsers trusted. eMudhra said the keys came from a flawed key generation ceremony on April 30, 2025, and that the weakness went unnoticed for about 18 months.

The response was fast. Chrome and Firefox blocked the affected certificates on October 17, Apple on October 19 and Microsoft on October 20. Chrome began removing the emSign ECC Root CA G3 root from its trust store on October 27, so any website certificate that chains to that root can show a full page security warning in Chrome. On October 22, eMudhra announced it is leaving the global TLS certificate business. The company said none of the eight affected certificates had issued certificates to end users or websites, and that its Indian eSign services are not affected. If your site uses an eMudhra certificate, replace it with one from another authority now.

3. Expired certificates that look like attacks

Not every certificate failure is an attack, but the damage is similar. When Let’s Encrypt’s root certificate expired in 2021, large sites including Shopify and Fortinet saw problems. In 2022, an expired certificate caused an eight hour outage at Spotify’s Megaphone podcast platform. Alaska Airlines once grounded flights in Seattle because of a certificate failure and stated that it was not a cyber attack. To a visitor, a connection not private warning looks the same whether the cause is an attacker or a missed renewal.

WordPress Plugin Attacks Keep Growing

Plugins remain the easiest way into most WordPress sites, and attackers move fast. Patchstack’s 2026 data puts the median time to first mass exploitation of a newly disclosed flaw at about five hours. Recent examples from 2026 include:

• Kirki (CVE-2026-8206): a 9.8 severity flaw that lets an attacker take over any account, including administrators, on a plugin installed on more than 500,000 sites. Wordfence recorded over 222 attack attempts in 24 hours after disclosure on June 2, even though a patch had been released on May 18.
• Burst Statistics (CVE-2026-8181): an authentication bypass under mass exploitation, with Wordfence blocking about 7,400 attempts per day against a plugin with more than 200,000 sites.
• Gravity SMTP (CVE-2026-4020): reported mass exploitation aimed at stealing API keys from sites using the plugin, which is installed on roughly 100,000 sites.
• WordPress core chain known as wp2shell: a SQL injection and code execution chain in newer 6.x versions that attackers used in July to upload malicious plugins as persistent backdoors.

What Attacks Cost Companies

Direct losses depend on size and industry, but the pattern is consistent: lost sales while the site is down, plus a pile of recovery bills. An insurer’s case study of a small online retailer hit by a denial of service attack shows the typical mix. The site was unreachable for six hours, and costs included about 142,500 dollars in lost sales, 18,000 dollars in extra working costs, 23,000 dollars for an outside service provider, 22,000 dollars for a forensics firm and 15,000 dollars in legal fees. That adds up to roughly 220,500 dollars for one incident at one small business.

Costs also go beyond cash. Customers lose trust after a security warning, search engines can drop sites that are flagged or compromised, and a breach can trigger notification duties and legal claims. For firms hit by the PHP2Shell firewall campaign, the larger cost is stolen credentials that must be rotated across the whole network.

Protection Checklist for Website Owners

For PHP and your server

1. Check your PHP version in your hosting panel or ask your host. Move to 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer.
2. Restart web services after updating so the new version is actually loaded.
3. If your PHP version is end of life, upgrade to a supported branch instead of waiting for a patch that will not come.
4. If your site was exposed before patching, rotate passwords, API keys and secrets stored on the server and watch logs for unusual requests.
5. Put a web application firewall in front of the site as a temporary shield, but treat it as a stopgap and not a replacement for patching.

For WordPress

1. Turn on automatic updates for plugins you trust and review the list weekly.
2. Delete plugins and themes you do not use, since inactive code can still be exploited.
3. Use strong admin passwords and two factor login, and limit the number of administrator accounts.
4. Keep offsite backups and test a restore at least once.

For SSL and TLS

1. Check which authority issued your certificate and replace it if it chains to the removed eMudhra root.
2. Automate renewal and add monitoring that warns you well before expiry.
3. Publish CAA records that name your approved certificate authorities.
4. Watch Certificate Transparency logs for certificates you did not request.
5. Use registrar lock and DNSSEC where available, and never teach your team to click through browser certificate warnings.

Final Thoughts

The big lesson of October 2026 is speed. Flaws now go from disclosure to attacks in hours, and AI tools are helping attackers scan thousands of targets quickly. The defense is boring but effective: keep PHP, WordPress and plugins updated, monitor your certificates, keep backups and limit what any one account can do. Patch first, then investigate, because waiting for proof of damage usually costs more than a restart.

Frequently Asked Questions

What is PHP2Shell?

PHP2Shell is the nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow remote code execution without authentication. They were fixed on October 21, 2026.

Is my WordPress site affected by PHP2Shell?

It can be if your server runs a vulnerable PHP version. The flaw is in PHP, not WordPress, so you fix it by updating PHP through your host, not by updating a plugin.

Which PHP versions fix the flaws?

PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 or later versions. Older end of life versions do not receive fixes and should be upgraded.

What happened with the eMudhra SSL certificates?

Researchers found that eight eMudhra intermediate certificate keys were weak enough to be recovered from public data. Major browsers blocked them, Chrome began removing the related root on October 27, and eMudhra is exiting the global TLS certificate business.

Do I need to replace my SSL certificate?

Only if it was issued under the affected eMudhra root. Check the certificate chain in your browser or with your host, and replace it with one from another authority if needed.

How fast do attackers exploit new WordPress plugin flaws?

Patchstack data for 2026 shows a median of about five hours from public disclosure to first mass exploitation, which is why quick updates matter.