On Wednesday 21 October 2026 the PHP project released emergency fixes for two critical security flaws. PHP is the programming language behind around three quarters of the world’s websites and a great deal of business software, so this is one of the most widespread security problems of the year.
If some of the online software you use was unavailable today, this is very likely the reason. If you are a QLine IT client, the short version is: our systems have stayed secure throughout, our website and client portals were not affected, and you do not need to do anything.
What happened?
The two flaws, which researchers have nicknamed “php2shell” (CVE-2026-109618 and CVE-2026-109619), are in PHP itself rather than in any one website or product. Both are rated 9.2 out of 10 for severity. In the worst case they let an attacker on the internet run their own commands on a web server, without needing a password.
The fixes were due to be published on the afternoon of 21 October, giving suppliers a coordinated moment to update. But details leaked the day before, and attackers started trying to use the flaws early on the morning of the 21st, before most servers could be patched.
Where Cloudflare comes in
Cloudflare sits in front of millions of websites and filters the traffic that reaches them. It spotted the attacks early and put emergency firewall rules in place for all of its customers, including those on its free plan, to block the known attack patterns.
Cloudflare has been clear that this is a stopgap, not a fix. Attackers were already changing their methods to get round the rules, and the only real fix is to update PHP on every affected server.
Why some of your software went offline
Faced with a serious flaw and attacks already under way, many software suppliers chose to take their systems offline as a precaution while they applied the updates. That is the responsible thing to do: a few hours of downtime is far better than a breach.
It does mean you may have found some online software unavailable today, or not working properly. For example, Bright Software Group took several of its systems offline “as a precautionary security measure in response to a newly announced PHP vulnerability”, and BrightPay Manager is still unavailable at the time of writing. Other suppliers will be in the same position.
What you can do:
- Check your supplier’s status page or support site for updates, rather than repeatedly trying to log in.
- If you were part-way through something important, such as a payroll run, do not keep retrying. Wait until the supplier says the service is back, then check whether your earlier attempt went through before trying again, so nothing is processed twice.
- Be wary of emails claiming to be from a supplier about the outage, especially any that ask you to log in through a link. Incidents like this are a favourite subject for phishing. Go to the supplier’s website directly instead.
QLine IT clients: what you need to know
Our systems have stayed secure. We have checked everything we run:
- Our website, qlineit.com, is not built on PHP, so it was never exposed to these flaws.
- Our client portals and support systems, including the ticket system, do not run PHP either, and sit behind Cloudflare’s protection.
- Your computers and networks that we manage are not affected. This is a problem for web servers, not for office PCs, laptops or phones.
You do not need to do anything. If a piece of software you rely on has been taken offline by its supplier, there is nothing wrong with your computer or your network, and it will come back when the supplier has finished updating. If you are not sure whether something is down for everyone or just for you, contact us and we will check.
Not a QLine IT client?
If your business runs its own website or web software, especially WordPress, WooCommerce, Magento or anything else built on PHP, ask whoever hosts it:
- Has PHP on our server been updated to version 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later?
- If we are on an older version of PHP that no longer gets updates, what is the plan to move off it?
- Is the site behind a web application firewall, such as Cloudflare’s, and is it switched on?
Updating your website’s plugins or theme does not fix this. The update has to be made to PHP itself, on the server. If you are not sure who looks after your website, or you would like a second opinion, contact us.
IT Solutions
QLine IT is Cyber Essentials Plus accredited and a Microsoft Solutions Partner. We look after businesses, charities and children’s homes across Leeds and the UK, and keep our clients informed when problems like this happen elsewhere on the internet. If you would like to talk about your own systems, speak to us.
