PHP2Shell Is Knocking Sites Offline
The big story this week is a security emergency, not an algorithm. On October 21, the PHP team shipped an emergency fix for two critical vulnerabilities nicknamed PHP2Shell. Rated 9.2 out of 10, they let an attacker run their own code on a server, remotely, with no account and no password. PHP runs WordPress, Joomla and Drupal, so a huge share of small business sites are exposed. Sites that went offline to install or prepare for the fix include EU government sites, Asana, GOG, and Wikipedia.
Google responded fast. Google Search Central reminded site owners that "serving a 503 (Service Unavailable) HTTP status code ensures already indexed URLs are preserved in Search while you work." A 503 is a server message that means "temporarily closed, come back later." John Mueller added that you can do this outside of PHP, point DNS elsewhere, or use a CDN. That matters because you can't rely on PHP code to show the closed sign when PHP itself is what's down. One catch: according to Google's own documentation, a 503 only protects pages for a while: if the errors persist, those pages are eventually dropped too.
Rankings Running Hot
The emergency lands in the middle of a rough stretch for rankings. Volatility has sat in the moderate-high range since late September and is climbing again, and early readings today are coming in hot. Serpstat and Wincher are both pegged at 10/10. Barry Schwartz said ranking chatter has been spiking to unusual levels over the past 24 hours and suspects an unconfirmed update. Treat the numbers with some caution, though. Nozzle reports that a share of the results pages Google returns to automated requests have been complete but incorrect, which can make rank-tracking tools look jumpier than the real search results.
What to Do
- Ask your host whether PHP is on 8.2.35, 8.3.36, 8.4.27 or 8.5.12.
- If you take your site offline, make sure it returns a 503, not a 404, and keep the downtime to hours.
- Before you react to a ranking drop, check it against Search Console. Third-party trackers may be showing bad data.
