The NSA Told Every Website Owner to Patch or Pull the Plug. Here's What That Means for You.

Your business website probably runs on PHP. Most do. If it does — whether that's a WordPress storefront, a booking system, a custom web app, or a portfolio site — a critical flaw discovered last week means an attacker could walk into your web server without a username or password, read your files, access your database, and plant malware. All without any interaction from you or your team.

On October 22, 2026, the U.S. National Security Agency (NSA) issued an urgent public advisory about two vulnerabilities collectively nicknamed PHP2Shell. The NSA's message was unusually blunt: patch now, or take the affected system offline until you can. The Federal Bureau of Investigation (FBI) issued the same guidance simultaneously.

What Is PHP, and Why Does This Affect So Many Sites?

PHP (Hypertext Preprocessor) is the server-side programming language that powers the back end of a vast portion of the internet. According to W3Techs, PHP is used by 69.3% of all websites whose server-side programming language is known, based on October 2026 data. That includes WordPress, WooCommerce, Magento, Drupal, Joomla, and hundreds of other platforms that small businesses use every day.

The PHP2Shell flaws are particularly unsettling because the problem is not with your website's code — it's with PHP itself. The vulnerabilities are not about flaws in your website code; it's PHP itself that is compromised, meaning anything running the affected PHP versions could be hit, even if your application is not the problem.

What Can an Attacker Actually Do?

Both flaws rely on accessing parts of memory without proper authorization and exploiting that access to run malicious code. The two loopholes mean an attacker can remotely run commands on a server running old PHP code over the internet, without needing a password or legitimate account access.

Once in, the consequences are not abstract. Attackers can run their own commands, steal confidential information, wreck your services, slip in malware, or dig deeper into your network. For a small business, that means customer records, payment data, employee files, and internal credentials could all be exposed — or held for ransom.

The flaws are present in every PHP version since 2004, and could let attackers access a server's file system or connected databases. That is a remarkably wide blast radius.

How Were These Flaws Found?

Cybersecurity experts discovered the pair of vulnerabilities, dubbed PHP2Shell, with the help of artificial intelligence (AI) models. Researchers at security firm Calif, working with OpenAI, reported the first flaw on August 11; Wiz, a security firm owned by tech giant Alphabet, reported the second vulnerability on August 24. The PHP Foundation shipped an emergency patch on October 21, 2026 — and the NSA warning followed the very next day.

The speed matters here. The PHP Foundation also warned that AI would make such security weaknesses easier to find, and called on tech companies to mount a coordinated response to avoid major disruptions to online services. In other words, the same AI tools that found these bugs are now available to the people who want to exploit them.

How Seriously Are Governments Taking This?

Seriously enough to pull government websites offline. The Netherlands, Finland, France, and Australia temporarily took several government services offline to implement the patch and prevent any problems.

By October 21, the National Security Agency had told organizations to prepare for an update, the PHP Foundation had shipped a fix, Cloudflare had rushed out stopgap firewall rules, and government IT teams in France, Denmark, Finland, and the Netherlands had pulled public-facing websites offline while they patched.

The NSA's specific language left little room for interpretation. A server that cannot be secured right away should be disconnected from the internet, particularly if it holds sensitive data, until it can be fixed. When a U.S. intelligence agency tells you to take systems offline rather than wait, that is not a routine security bulletin.

What About Older PHP Versions?

This is where many small businesses will have a problem they don't know about. Sites running PHP 8.1 or older, which are no longer supported, are urged to upgrade to the current version, 8.5.12. An unsupported PHP version cannot receive the emergency patch at all — not because the patch doesn't exist, but because the PHP project no longer maintains those older branches. Your hosting provider or IT team may be running a version that simply cannot be fixed without a larger upgrade.

A Plain-English Severity Read

This is genuinely serious. The flaw is unauthenticated — meaning no stolen password is required — and affects a technology that is almost everywhere. The NSA does not issue emergency public advisories for minor software bugs. That said, a patch is available, and your hosting provider may have already applied it or deployed a temporary web application firewall rule that blocks the most obvious attack paths. The window between "patch available" and "widely exploited" is narrowing, but it has not closed.

If your website is managed by an IT provider or a web hosting company, the action is on them, not you. Your job is to confirm that they have acted.

What to Ask Your IT Provider or Web Host — Today

• What version of PHP is our website currently running? If the answer is 8.1 or older, that version is end-of-life and cannot be patched for PHP2Shell without a version upgrade.
• Has the PHP2Shell emergency patch (released October 21, 2026) been applied to our server? You want a specific confirmation, not a general reassurance.
• If we cannot patch immediately, have you deployed a web application firewall (WAF) rule as a temporary mitigation? Cloudflare and other major providers pushed stopgap rules; your host should have done the same.
• Has anything unusual appeared in our server logs since October 21? Exploitation attempts may have started before the patch was widely applied.
• Is our PHP version on an auto-update schedule, and who owns that responsibility? This flaw existing in every PHP version since 2004 suggests nobody set a reminder to stay current.

If your website is on a managed WordPress hosting platform — WP Engine, Kinsta, SiteGround, and similar — check their status pages or send a support ticket asking specifically about PHP2Shell. Most reputable managed hosts will have patched already, but "probably fine" is not the same as confirmed.

One last thing: if you built your own site years ago and it runs on a VPS (Virtual Private Server) that nobody actively manages, this flaw was written for exactly that scenario. Consider that your priority call this week.