Millions of cyberattacks threaten websites worldwide
Two critical security vulnerabilities in the widely used programming language PHP caused alarm worldwide on 21 October 2026. The first attacks were recorded even before the official announcement. Within a few hours, the number of attempted attacks had risen to millions. Numerous companies, public authorities and institutions took their websites offline as a precautionary measure – including several organisations in Austria. Security experts are warning of significant risks and urging website operators to install available updates as a matter of urgency.
What is behind the PHP security vulnerability?
PHP is one of the world’s most widely used programming languages for websites and web applications. Well-known content management systems such as WordPress, TYPO3, Drupal and Joomla! are also based on it. The two vulnerabilities known as ‘PHP2Shell’ are located directly within PHP. Under certain conditions, they enable attackers to remotely execute malicious code on unprotected servers – without first having to log in. In the worst-case scenario, this can result in websites being completely taken over, sensitive company and customer data being stolen, or malware being injected.
What role does artificial intelligence play?
Artificial intelligence is playing an increasingly important role in cyber security. AI-powered tools help security researchers detect vulnerabilities in complex software more quickly. At the same time, cybercriminals can also use AI to analyse security vulnerabilities and automate attacks. This reduces the time companies have to respond to new threats.
What should organisations do now?
The PHP developers have already released security updates. Website operators should therefore work with their hosting provider to check whether their server environment is adequately protected.
The key measures:
Check the PHP version: Ensure that the necessary security patches are installed.
Apply updates: Install any available security updates immediately.
Contact your hosting provider: Check whether the server environment has already been secured.
Check server logs: Examine systems for any previous attempted attacks.
Secure unprotected systems: If an immediate update is not possible, affected websites should be temporarily isolated or taken offline.
Important: An up-to-date content management system alone is not sufficient. As the vulnerabilities directly affect PHP, security measures must be implemented at server level.
Why regular website maintenance is crucial
This incident highlights just how important it is to have a continuously maintained and secure web infrastructure. Even a website that functions flawlessly from a technical perspective can harbour undetected security risks. Regular updates, clear lines of responsibility and close cooperation with the hosting provider are therefore crucial for protecting digital systems in the long term. At Inscript, we support businesses with the technical maintenance and security of their websites, as well as with the coordination of necessary security measures. Do you want to ensure that your website is adequately protected? Contact us – we’d be happy to help.
Frequently Asked Questions
PHP ist eine Programmiersprache, die auf vielen Websites eingesetzt wird. Durch Sicherheitslücken können Angreifer unter bestimmten Voraussetzungen Schwachstellen ausnutzen und die Sicherheit einer Website gefährden.
Unter bestimmten Umständen könnten Angreifer auf sensible Daten zugreifen. Eine Sicherheitslücke bedeutet jedoch nicht automatisch, dass Daten gestohlen wurden oder ein Angriff stattgefunden hat.
Wichtig ist, dass der Hosting-Anbieter die erforderlichen Sicherheitsupdates installiert. Zusätzlich sollten die PHP-Version, die Serverkonfiguration und die eingesetzten Anwendungen regelmäßig überprüft und aktualisiert werden.
Sobald eine PHP-Version das Ende ihres offiziellen Supports erreicht, erhält sie keine regulären Sicherheitsupdates mehr. Dadurch steigt das Risiko, dass bekannte Schwachstellen ausgenutzt werden können. Manche Hosting-Anbieter stellen jedoch weiterhin eigene Sicherheitskorrekturen bereit.
Sicherheitsupdates sollten laufend überwacht und zeitnah eingespielt werden. Zusätzlich empfiehlt sich eine regelmäßige technische Überprüfung der Website, um veraltete Software, Sicherheitsrisiken und mögliche Schwachstellen frühzeitig zu identifizieren.
