Adult sites down? What the PHP flaw means for fans and creators

If an adult site gave you a maintenance screen or an error on October 21, it probably wasn't you. The world of tech had a hard day on October 21, 2026: the PHP project shipped an emergency fix for two critical flaws, and sites everywhere went offline to patch them.

I'm not a security researcher. I'm a creator who sells on a few platforms and runs my own site, and this is the read I'd give another creator, or a fan, who asked me what's going on. Where something isn't confirmed, I'll say so.

What's changed since October 21?

Updated October 24, 2026.

• The flaws have a nickname now: "PHP2Shell." It's the name most coverage uses.
• Real attacks have been reported. Palo Alto Networks' Unit 42 describes one against a European government body, where the attackers reached password hashes within two hours of getting in. It also counts more than 22.6 million exposed PHP instances that may be vulnerable.
• No new PHP release since October 21. On October 23 the PHP project put out a smaller, informational advisory on session upload progress, which it calls an unlikely route to remote code execution.
• Still no word from adult platforms. As of October 24, I haven't seen one say its downtime was PHP-related, or that any fan data was exposed.

Is it just me, or are adult sites down today?

Probably not just you. OnlyFans showed outage reports on October 21 (status tracker), and a post on X from an adult-industry account reported planned maintenance screens on OnlyFans and SextPanther, and CloudFront errors (Amazon's content delivery network) on other adult sites. What isn't confirmed is why. As of October 21, I haven't seen a platform say its downtime is tied to PHP, and none of the platforms I'm on has sent me a notice about it.

So treat the outages and the PHP news as two things happening on the same day. They may be connected. I haven't seen anyone with the facts say they are.

What is the PHP flaw, in plain words?

PHP is the programming language a huge share of the web's servers run on. The two bugs, CVE-2026-109618 and CVE-2026-109619, let an attacker run their own code on an unpatched server without logging in. The PHP project's advisory says the risk covers "all PHP installations serving web requests" and rates both flaws 9.2 out of 10 for severity.

The fixes shipped on October 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no official release, so sites on old versions depend on their host or vendor for a fix.

It got worse fast. Details leaked on October 20, before the planned disclosure, so the fix went out a day early. And watchTowr, a security firm, reports active attempts to exploit both flaws. That's part of why governments, hospitals and big organizations in Europe and beyond took websites offline on purpose while they patched. On a day like this, a maintenance page can simply mean someone is patching.

Did it hit OnlyFans or other adult sites?

As of October 24, I haven't seen any adult platform confirm it. I don't know what any given platform runs. As far as I can tell, the adult industry sits on the same plumbing as everyone else, from storefronts to payment pages to admin panels, and PHP sits behind so much of the web that it would surprise me if none of it touched PHP somewhere. Any adult platform running an unpatched version is as exposed as any other site.

A site going dark for planned maintenance on a day like this is what a careful operator would do, whatever the reason. It doesn't mean the site was hacked. If a platform is breached, it should tell its users.

Is my account or card at risk?

As of October 24, I haven't seen any report that fan accounts or card details on an adult platform were exposed by this flaw. A flaw that can be exploited hasn't necessarily been exploited. If one does come out, the platform involved should announce it, and I'll add it here.

If you use the same password on an adult site as anywhere else, change it on the sites that matter most to you. That's good advice on any day, and it takes a few minutes.

What should fans do while sites are flaky?

Mostly, wait it out.

• Don't hammer the login. If a site shows maintenance, it'll come back.
• Type the address yourself or use a bookmark. Don't follow a link someone sent you to "check" a site. It's why I tell fans to bookmark the site, not the handle.
• Don't re-enter your login on any page that looks off, even slightly.
• Ignore any DM or email offering to "restore" or "verify" your access.
• Check the platform's own accounts for status, not screenshots of them.

What should creators with their own site do?

If your site runs on PHP, WordPress included, find out today which PHP version it's on and get it updated. If you're on managed hosting, ask your host whether they've patched. If you can't patch yet, the advice from the US National Security Agency's cybersecurity division was blunt: take it offline until you can.

Cloudflare switched on firewall rules against these flaws for every plan with its WAF, free ones included, starting at 3:02 UTC on October 21. That helps, but in the PHP project's own words, "updating is the only safe choice."

This site isn't built on PHP, so this particular flaw doesn't reach it. That's luck of the stack. It's also a reminder of why I run a site of my own at all: when a platform goes dark, fans still have somewhere to find me. I wrote about why in why I run my own site. For the platforms you sell on, there's nothing to do but watch for an official notice.

Why are outages prime time for phishing?

When sites are down and nobody knows why, a message saying "your account was suspended, verify here" looks more believable than it would on an ordinary day. Scammers also copy creators outright, and how to tell it's really me covers how to spot that.

As of October 21, I hadn't had one of those messages. I'd still assume they're coming. If something lands in your inbox claiming to fix your access, don't click it: go to the site directly and check there.

Will this post be updated?

If I see a platform confirm its downtime was PHP-related, or that anything was exposed, I'll add it here with the date. As of October 24, what I know is a serious flaw, a fast patch, reports of real attacks on unpatched servers, and no report I've seen of harm to fans.

I'm not a security researcher, so for your own setup, your host or your platform's support team is the right call.

— Sly