Warning: a flaw in the code behind most of the internet is under attack right now. Here's what it means for you.
If you run a website, check it today. Two serious holes were found in PHP, the computer language behind WordPress and a huge part of the internet. The fix came out on October 21, 2026, and attackers are already trying to use the holes (The Hacker News, SecurityWeek).
That's why websites around the world, including government sites, went offline this week: their owners shut them down to fix them before someone broke in.
Is Roadster Flies affected? No. This site doesn't use PHP. Neither do our apps, Cool Cue and Support-O, or their websites. We checked.
Here's what happened, explained simply.
What is PHP?
When you open a website, a computer somewhere builds the page and sends it to you. On a lot of the internet, the language doing that building is PHP. It's more than 30 years old and free for anyone to use.
It runs WordPress, the tool behind a big share of the world's websites, plus Drupal (used by many governments), Joomla, Magento online stores, and the software behind Wikipedia (SecurityWeek, Tenable). It's often estimated that about 70% of websites use it. In Australia alone, 391 government websites run on a Drupal-based system, The Guardian reported.
What's the flaw?
Security researchers nicknamed it PHP2Shell. Officially it's two flaws, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10 for how dangerous it is (Tenable).
In plain words: think of a website's computer as a busy restaurant kitchen. Every time someone visits, the kitchen takes an order, uses some counter space, then cleans up. These flaws are in the cleanup:
- Flaw one: if the kitchen runs out of counter space in the middle of an order, it can clean up a half-made order as if it were finished, leaving a mess an attacker can use.
- Flaw two: scraps from one customer's order can get left behind and picked up by the next order.
A clever attacker can send a specially made "order" that uses that mess to run their own commands on the website's computer. No password needed. From there they could read the site's files and database, or steal passwords and keys stored in memory (SecurityWeek, Tenable).
The problem sits in parts of PHP that nearly every visit touches, which is why it's so serious and why it was hard to fix without breaking things, the PHP Foundation said, as quoted by The Guardian.
How bad is it?
Bad, for anyone who hasn't updated:
- Almost every PHP version is affected, going back to PHP 5.4 from 2012 (Tenable).
- Attacks have started. Amazon spotted an attempt on October 17, four days before the fix was public. Cloudflare, watchTowr and others saw more once it was announced, and security firm Hadrian says it's seeing exploitation "at scale" (Tenable, SecurityWeek).
- Researchers counted somewhere between 1.3 and 1.9 million exposed computers on the internet, by rough estimates (Tenable).
- The sites that went offline aren't the worry. "The bigger concern is the websites that are not down today," Australian National University professor Sigi Goode told The Guardian. Those are the ones that may not have patched.
