Alert: critical PHP flaws and the risk of disappearing from Google

What happened

In October 2026, researchers from OpenAI, Wiz and Calif disclosed a set of critical vulnerabilities in PHP, nicknamed "php2shell". According to OpenAI, AI models played a central role in the discovery. According to Wiz, every PHP version released in the last decade is affected by at least one of the flaws, with severity of up to 9.2 on a scale of 10. An initial analysis by Palo Alto Networks identified about 22.6 million potentially vulnerable installations.

The fixes were released on October 21. That same day, government websites in Europe and other countries went offline as a precaution, and cybersecurity agencies told PHP users to update immediately or take their sites offline until they could patch. Cloudflare recorded tens of thousands of exploitation attempts within an hour of the news going public.

Why this affects so many people

PHP is the language behind about 70% of the web, according to Wiz, including WordPress, Drupal and Joomla. That means most corporate websites, online stores and blogs may be exposed, even if their owners have never heard of PHP.

A flaw of this kind lets an attacker take control of the server, steal data and alter the site's content.

What this has to do with Google

• Site offline for a long time: when Google keeps hitting errors, it reduces crawling and, if the downtime drags on, may drop the pages from the index.
• Hacked site: attackers often inject spam pages, hidden links or redirects. Google may display security warnings, apply manual actions and knock down your rankings.
• Altered content: defaced pages or pages with malicious code lose the trust of users and search engines.

Recovering rankings lost to a hack usually takes much longer than applying the fix.

What to do now

• Check with your hosting provider whether your server's PHP version has already received the October 2026 fix.
• Update WordPress (or any other platform), its plugins and themes.
• Make a full backup before and after the updates.
• In Google Search Console, check the security, manual actions and indexing reports.
• Search site:yourdomain.com on Google and look for pages you didn't create.
• Change the passwords for your admin panel, hosting and database if there's any suspicion.