October 2026 security alerts
What to do about the PHP vulnerability and the eMudhra certificate compromise
Last updated
The October 2026 PHP vulnerability (PHP2Shell) and eMudhra certificate compromise, in plain English: what happened and what to do as a user. Five simple steps.
Every detail counts.
Five things that cover you
In October 2026, two security problems made the news. One was PHP2Shell, a vulnerability in PHP, the software behind many websites. The other was the eMudhra certificate compromise: a company that issues the little padlocks you see in your browser lost control of some of its keys. You do not need to be technical to stay safe. Here is what to do as a user.
Update your browser and your phone.
Chrome, Safari, Firefox and Edge have already blocked the bad padlocks, but only once they are updated. If your browser or phone is asking you to restart for an update, do it today. Better still, turn on automatic updates.
Be suspicious of "security alert" messages.
Scammers love the news. Expect emails and texts saying your account is at risk and asking you to click a link and sign in. Do not click. If you are worried, open the app yourself or type the company's address into your browser.
Take browser warnings seriously.
If your browser says a site is "not secure" or "your connection is not private", do not type a password or a card number there. Close the tab. Do not click through the warning.
Turn on two-step sign-in for your email.
Your email is the key to everything else: it is how every password gets reset. A code from your phone on top of your password stops most break-ins. Gmail, Outlook and iCloud all offer it in their security settings.
If you have a website, ask one question.
If your business has a website, especially a WordPress site, ask whoever looks after it: "Has PHP been updated to 8.4.27, 8.3.36 or newer?" A good host or developer will know the answer the same day. If nobody knows who looks after it, that is worth fixing too. On WordPress you can check it yourself: go to Tools, then Site Health, then Info, then Server.
Not sure your site is up to date?
We will check your PHP version, your hosting and your WordPress plugins, and fix what is out of date.
Get help securing your siteWhat you can skip
- You do not need to change all your passwords because of this. Neither problem leaked passwords.
- You do not need to buy antivirus software or a "security scan".
- Nobody legitimate will call you about this. If someone does, hang up.
Questions people are asking
What is PHP2Shell?
Two flaws in PHP (CVE-2026-109618 and CVE-2026-109619) that let an attacker take over a web server that has not been updated, with a single request. PHP released the fix on October 21, 2026. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
What happened with eMudhra?
On October 17, 2026, a researcher found that the private keys of eight eMudhra intermediate certificates could be recovered. eMudhra revoked them on October 18, and Chrome, Firefox, Safari and Edge blocked them within days.
What should I do about the PHP vulnerability as a user?
Keep your browser and phone updated and be careful with "security alert" messages. The fix itself happens on the website's side, so if you have a website, ask whoever runs it to confirm PHP is updated.
Is my WordPress site affected?
WordPress runs on PHP, so it was exposed until its server was updated. Check the PHP version under Tools, then Site Health, then Info, then Server, or ask your host.
Do I need to change my passwords?
Not because of this. Neither problem leaked passwords. Turning on two-step sign-in for your email is still the best thing you can add.
Not sure who looks after your website, or whether anyone does? We can find out for you.
Get help securing your site