All About Cookies is an independent, advertising-supported website. Some of the offers that appear on this site are from third-party advertisers from which All About Cookies receives compensation. This compensation may impact how and where products appear on this site (including, for example, the order in which they appear).
All About Cookies does not include all financial or credit offers that might be available to consumers nor do we include all companies or all available products. Information is accurate as of the publishing date and has not been provided or endorsed by the advertiser.
The All About Cookies editorial team strives to provide accurate, in-depth information and reviews to help you, our reader, make online privacy decisions with confidence. Here's what you can expect from us:
If a website you use went dark yesterday, be careful what you click to get back in.
Government websites across Europe went offline on Oct. 21 as operators scrambled to address two critical security flaws in PHP, the software that runs websites worldwide. Some shutdowns were precautionary.[1]
An unexpected outage can make a message about restoring your account sound believable. That’s a reason to brush up on spotting phishing emails before clicking an urgent password-reset link.
If you’re already having trouble signing in, an email promising to restore access might catch you at just the right moment. Check who sent it before you click.
The vulnerabilities, known collectively as PHP2Shell, affect the underlying software behind platforms such as WordPress, Drupal, and Joomla.
Security researchers at Wiz say successful attacks could let criminals take control of affected servers, steal sensitive data, or alter websites.
PHP’s developers released emergency fixes on Oct. 21 and urged users to update immediately. For people who simply visit websites, those repairs are the responsibility of the organizations and hosting providers running them.
The threat has already moved beyond researchers’ demonstrations. Amazon’s threat intelligence team reported an exploitation attempt dating to Oct. 17 and further attempts around the public release of the fixes.
Still, a website going offline doesn’t establish that someone stole its customers’ information. Some operators shut down services to prevent an attack while they applied updates.
An outage gives scammers a believable excuse to contact you. You might normally ignore an email about a failed payment, but if the checkout page crashed while you were shopping, you might give it the benefit of the doubt.
Here are several ways those pitches could appear:
You’re better off opening the app yourself to check than taking those messages at face value. Avoid using the link or phone number supplied by whoever contacted you.
If you need to reach customer support, get the contact details from the company’s app or a website address you’ve used before. You can also check there for updates on when service should return.
Searching for another way to sign in can also lead you into trouble. Scammers have managed to get fake banking pages into Google results, where they can catch customers looking for the real thing.
While you’re checking your accounts, change your reused passwords and turn on two-factor authentication to be extra safe.
Have a website of your own? Sign in to your hosting account and ask your provider whether it has installed the PHP fixes. The update needs to happen on the server hosting your site.
If you entered a password on a suspicious page, change it, check active sessions, and log out of any you don’t recognize.
If you shared card or banking information, reach out to your financial institution and explain what happened as soon as you know.
If you installed anything, update your security software and scan your device for malware. Security software with phishing and malicious-site protection can also help catch a dangerous page before you enter your information.
Our #1 rated antivirus that scores 18/18 on AV-TEST across Windows, macOS, and Android, verified across multiple test rounds
Passed every malware, drive-by download, and phishing detection test we ran, quarantining threats automatically
Backed by a 100% Virus Protection Promise: if Norton can't remove a virus, you get your money back
/images/2023/12/01/omniwatch_review.jpg)
/images/2023/12/05/aura-vs.-lifelock.png)
/images/2026/10/22/closeup_of_the_signal_messaging_app_icon_on_a_smartphone_screen_displa_ESczEq4.jpg){kind=icon}
/images/2026/10/22/beware_these_phishing_tricks_after_historic_internet_meltdown.png)
/images/2026/10/20/google-search-redirects-privacy-security.jpeg)
/images/2026/10/20/trump-administration-voter-data-lawsuit.jpeg)
/images/2026/10/19/stop-shop-food-lion-app-outage.jpeg)
/images/2026/10/19/apple-photos-app-facial-recognition-privacy-lawsuit.jpeg)
/authors/thomas-kent-headshot-cropped.png){kind=small}
/authors/kalleigh-lane-new.jpg){kind=small}
/images/2023/03/03/logo-norton-large.png){kind=logo}
/authors/thomas-kent-headshot-cropped.png)