Is the Internet Safe Again After the PHP Nightmare? What You Need to Know

In brief

• PHP's October 21 releases remain the only fix for PHP2Shell, and they protect a server only once its owner installs them and restarts PHP.
• Cloudflare's CEO said exploit attempts climbed into the millions, while Germany's BSI and Japan's government said they had not confirmed any successful break-ins.
• The PHP Foundation said it spotted signs of one flaw in 2024 and called the delay in fixing it "a structural failure."

A day after two bugs in PHP sent governments scrambling to unplug their websites, the fix is out, attackers are hammering away, and a lot of people are asking the same thing: Can I use the internet without worrying, or should I hide under the bed until next week?

The short answer is that the internet didn't break, and for most people the risk sits with the websites they visit, not with their own phones or laptops. The longer answer has a few caveats worth knowing.

Quick recap: PHP is the software that runs behind the scenes on about 70% of websites whose server-side language is known, and the two flaws, nicknamed PHP2Shell, let a stranger take control of a vulnerable server without logging in.

Is it fixed?

So, is the exploit fixed? Yes, mostly. PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on Wednesday, according to its release notes. "There are no complete mitigations, updating is the only safe choice." As of Thursday, PHP has not issued any follow-up patch.