If your website runs on PHP (WordPress and WooCommerce do), this week matters. On October 21, 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The release notes say these versions "fix two critical vulnerabilities that can allow unauthenticated remote code execution." In plain words: an attacker could run code on an unpatched server without logging in. The PHP team says: "All PHP users are strongly encouraged to update immediately."
The two flaws are CVE-2026-109618 ("RCE via OOM corruption") and CVE-2026-109619 ("RCE via stale global state"). The PHP security advisories rate both as critical, with a CVSS v4.0 score of 9.2. Some news sites call the issue "PHP2Shell". That name does not come from the PHP project.
Some site owners take their sites offline until the patch is in place. That can be a sensible security decision. But if you do it the wrong way, it can also cause search problems.
What Google says about going offline
Google's John Mueller posted about this on Bluesky on October 21, as reported by Search Engine Roundtable: "If you're taking PHP sites down to schedule time to deal with 'unplanned updates', use HTTP 503 instead of letting responses time out / 404 / 500." He added that you can do this "outside of PHP / point DNS elsewhere / CDN."
Google's documentation explains why the status code matters:
- On 404 and other 4xx codes: "URLs that are already indexed and return a 4xx status code are removed from the index."
- On 5xx codes (503 is one of them): "5xx and 429 server errors prompt Google's crawlers to temporarily slow down with crawling. For Google Search, already indexed URLs are preserved in the index, but eventually dropped."
- On planned downtime, from a 2011 Search Central post: a 503 "tells search engine crawlers that the downtime is temporary."
Google's guide to pausing a website sets a time limit: "If you need to urgently disable the site for 1-2 days, then return an informational error page with a 503 HTTP response status code." It calls a full shutdown "an extreme measure that should only be taken for a very short period of time (a few days at most)."
What to do
- Find out if you are affected. Ask your host or developer which PHP version your site runs, or check your hosting control panel. Many managed hosts patch for you, but confirm it.
- Patch first. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, whichever matches your branch. PHP 8.1 and older no longer get updates from the PHP project. The project published minimal source fixes for 7.4, 8.0 and 8.1, and some vendors backport fixes. Ask your host, or upgrade to a supported version.
- If you must go offline, serve a 503. Use a simple maintenance page that returns HTTP 503. Set it at the CDN or server level, so it works while PHP is off. Do not let pages time out or return 404.
- Add a Retry-After header. Google says to use it "with a best effort date or duration". Googlebot may use it to decide when to come back.
- Do not send a 503 for robots.txt. Google's guide says: "Don't return a 503 HTTP response status code for the robots.txt file." Keep robots.txt available while the rest of the site shows the maintenance page.
- Keep downtime short. Google's guide says 1-2 days, and "a few days at most". It warns that "completely closing a site even for just a few weeks can have negative consequences on Google's indexing."
- Check afterwards. When the site is back, open Google Search Console. Look at the Pages report and the Crawl stats report for server errors or "not found" pages over the next days.
The bottom line
Security comes first, so patch quickly. If you take the site offline, make sure the way you do it tells Google the downtime is temporary.
Check your site after maintenance
An SEOSFT audit shows the pages that answer with an error such as 404, and its Indexability check counts them as pages Google cannot index. It also warns you if your robots.txt returns a server error, because then Google may not crawl the site at all.
Sources
- PHP, 2026 news archive (October 21 security release): https://www.php.net/archive/2026.php
- PHP security advisory, RCE via OOM corruption (CVE-2026-109618): https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
- PHP security advisory, RCE via stale global state (CVE-2026-109619): https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
- Search Engine Roundtable, Google on PHP2Shell: https://www.seroundtable.com/google-php2shell-42353.html
- Google Search Central, How HTTP status codes affect Google's crawlers: https://developers.google.com/search/docs/crawling-indexing/http-network-errors
- Google Search Central, Temporarily pause or disable a website: https://developers.google.com/search/docs/crawling-indexing/pause-online-business
- Google Search Central Blog, How to deal with planned site downtime: https://developers.google.com/search/blog/2011/01/how-to-deal-with-planned-site-downtime