A PHP Bug Just Took Websites Offline Worldwide

PHP2Shell is two critical bugs in PHP itself, rated 9.2, that can let attackers run code on PHP servers, and PHP runs roughly 70% of websites. We cover how the disclosure leaked a day early, why the NSA, CISA, the FBI and the UK's NCSC told organisations to take unpatched sites offline, and how 4chan, Wikimedia, DigiD and even BreachForums went dark. Then there's the fight over who found it between OpenAI, Wiz and Calif, plus the same-day Node.js, GitLab and Railway security news. 🔗 Relevant Links - PHP2Shell disclosure (Wiz Research): https://www.wiz.io/blog/php2shell-php-rce - PHP Foundation on the release, the leak and what's changing: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ - PHP security advisory: https://www.php.net/archive/2026.php - CISA alert: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching ❤️ More about us Radically better observability stack: https://betterstack.com/ Written tutorials: https://betterstack.com/community/ Example projects: https://github.com/BetterStackHQ 📱 Socials Twitter: https://twitter.com/betterstackhq Instagram: https://www.instagram.com/betterstackhq/ TikTok: https://www.tiktok.com/@betterstack LinkedIn: https://www.linkedin.com/company/betterstack 📌 Chapters: 0:00 - Intro 0:30 - What PHP2Shell is 1:29 - The leaked disclosure 2:24 - Websites go offline 3:11 - Even hackers went offline 3:39 - Was anyone hacked? 4:25 - Who found it? 5:40 - It won't be the last 5:51 - Railway breach 6:27 - Final thoughts