Web Fixes Spread but Attack Proof Fails
Website updates are rising and offline services are reopening, but researchers had to withdraw a major claim of a successful breach.
In a nutshell
Internet administrators are steadily repairing two severe flaws in PHP, the software language that runs millions of websites worldwide. While regional scans show updated software spreading and closed portals like Bangladesh Bank are reopening, cyber defense teams warn that many organizations remain exposed. At the same time, security researchers had to retract their claim linking a European government breach to the flaws, leaving the true global scale of successful attacks unproven.
Highlights
- Patched software versions among monitored New Zealand websites rose from 8.7% on October 22 to 29.9% on October 24.
- Bangladesh Bank reopened its public website on October 25 following a three-day precautionary shutdown.
- Bangladesh's state incident response team warned on October 25 that multiple organizations still operate vulnerable PHP systems.
- Cybersecurity firm Unit 42 retracted its claim that the PHP2Shell flaws were used to breach a European government network.
Monitored New Zealand websites running fixed PHP
%The findingVisible software updates among monitored websites more than tripled between October 22 and October 24.
- The share of monitored, version-identifiable New Zealand websites displaying updated PHP software across two days of scanning.
- TheColab tracker — An automated monitoring project recording visible software versions across New Zealand websites
- It shows rapid local maintenance, but scanner version tags do not confirm whether every system behind the scenes is fully protected.
From the Editor’s Diary
Turning a service back on or updating a public software label shows activity, but genuine safety requires verifying that internal systems are fixed and uncompromised.
Who's involved
PHP Foundation
A nonprofit team of developers that maintains PHP, the computer language powering millions of web servers
goal → Supply emergency software fixes and encourage website hosts worldwide to install them quickly
Palo Alto Networks Unit 42
The cybersecurity research arm of a global security software corporation
goal → Investigate cyberattacks and correct premature conclusions about which software flaws caused an intrusion
BGD e-GOV CIRT
Bangladesh's state computer incident-response team, which tracks cyber threats across public networks
goal → Detect unpatched web servers and persuade public and private organizations to confirm their security fixes
Bangladesh Bank
The central bank of Bangladesh, which runs public financial websites and core monetary services
goal → Restore its public web services safely without exposing operations to online attackers
TheColab.ai
A technology group running an automated internet scanner that records PHP versions on New Zealand websites
goal → Track how fast websites adopt security fixes while clearly explaining the limits of scanner data
Website operators and hosting providers
The technical administrators and web hosting companies that run website servers
goal → Install security updates properly and check systems for signs of intrusion before declaring them safe
Unidentified attackers
Online criminal groups and hackers scanning the internet for unpatched PHP systems
goal → Exploit unpatched web servers to gain unauthorized access before administrators apply security updates
In short
Emergency repairs for a widespread internet security flaw are taking hold, but there is still no worldwide proof that the danger has passed. Millions of websites rely on PHP, a core coding language that builds web pages behind the scenes. On October 21, 2026, developers issued urgent fixes for two critical security holes called PHP2Shell, which let attackers seize control of servers over the web without entering a password.
Website operators are making measurable headway, yet it remains too early to tell whether real-world break-ins are dropping. A tracker in New Zealand showed patched websites rising sharply, and Bangladesh's central bank brought its public website back online after a safety shutdown. But a site returning online shows only that it works again, not that it is safe.
The real path of the crisis is still uncertain because confirmed proof of successful intrusions remains scarce. On October 25, cybersecurity researchers at Palo Alto Networks withdrew their finding that an attack on a European government stemmed from PHP2Shell. An intrusion happened, but investigators could not prove these specific flaws let the attacker in. Knowing whether the global threat is truly receding requires proof of falling attack attempts and verified cleanups, which no worldwide study has yet shown.
Previously in this story
OX Security finds 93.6% of servers lack PHP fixes
27 October 2026Most observable systems using the web code PHP have not installed urgent security fixes five days after release, leaving websites exposed to takeover.
Emergency PHP Patches Spread but Danger Remains Unclear
24 October 2026Millions of web servers have installed fixes, but researchers cannot yet confirm whether successful break-ins are falling.
How it unfolded
A limited code review spots early signs of trouble
In 2024, the nonprofit Open Source Technology Improvement Fund joined the PHP Foundation to review key pieces of PHP's underlying code. Quarkslab, a French cybersecurity firm, carried out the targeted check. While fixing an issue flagged by the review, a programmer noticed early signs of a memory problem. That warning showed a software defect, not an active way for hackers to break into servers. A year later, researchers showed how attackers could weaponize the weakness, forcing the release of emergency patches.
Visible patches spread while researchers pull back a breach claim
Over the weekend of October 24 and 25, the picture of the recovery shifted. In New Zealand, a tracker run by TheColab showed more websites displaying updated software numbers. It was useful evidence, but limited: the tool checked only sites that openly shared their software version numbers, and some software updates changed version labels without proving that every internal process was secured.
Real services began returning as governments shut websites to stop a hack before testing whether their systems were vulnerable. On October 25, Bangladesh Bank restored its public portal after three days of safety downtime. Yet hours later, the country's cyber defense team warned that other public and private agencies were still running outdated software without confirming fixes. That same day, Unit 42 pulled back its earlier report that PHP2Shell caused a European government intrusion. While the network was breached, analysts could not prove these flaws gave the intruders their opening.
Where things stand
By October 26, 2026, evidence shows that recovery is advancing in specific places, but it remains unproven across the global internet. Bangladesh Bank's restored website shows a service back in operation. The New Zealand scanning data demonstrates that visible security updates are spreading across monitored web hosts. At the same time, official warnings from Bangladesh show that multiple public and private systems remain exposed.
The retraction by Unit 42 removes a headline breach from the list of confirmed PHP2Shell victims, but it does not mean hackers have stopped probing servers. Internet scans looking for open doors are not the same as successful digital break-ins. Proving that the wider threat is fading requires repeated global checks, proof of verified software repairs, and forensic evidence confirming that successful attacks are actually falling. Those facts do not yet exist.
PHP2Shell: the PHP security crisis
PHP emergency website patch faces unproven bypass fears
21 October 2026Online warnings claimed that a new fix for the programming language powering millions of websites had failed, but technical evidence shows no broken security update.
PHP fixes flaws rated 9.2 as exploit leaks drive early attacks
21 October 2026Millions of web servers face takeover risks after flaws leaked before fixes arrived.