Skip to main content
    Insights · SEO

    SEO News Week 44: PHP2Shell and Google's 503 Advice

    9 min read
    Quick answer:

    The critical PHP2Shell vulnerability forced many websites offline on October 21, 2026. For emergency shutdowns like this, Google recommends returning an HTTP 503 status code instead of timeouts, 404s or 500s, and not for longer than one to two days. Search Engine Roundtable also reported unconfirmed ranking volatility on October 20, 21 and 24, while Google updated its content-control documentation and is testing new Business Profile features.

    At a glance

    UpdateWhat's changingWho it affectsAction neededSource + date
    PHP2Shell and the 503 statusCritical PHP flaw; Google recommends a 503 during shutdownsEvery PHP-based site (WordPress, Typo3, Joomla, Drupal)High, right awaySearch Engine Roundtable, Search Engine Journal, ZDFheute/dpa, October 21, 2026
    Ranking volatilityUnconfirmed movement on October 20–21 and October 24Anyone relying on organic trafficMedium, monitorSearch Engine Roundtable, October 21 and 25, 2026
    "Control what you share" documentationExisting controls, including the Search generative AI control, listed in one placeSites with sensitive content or AI concernsLowGoogle Search Central, October 21, 2026
    Google Business Home and new reportsBeta in the U.S. and U.K.; new performance reports in testingLocal businessesLow, keep an eye on itSearch Engine Roundtable, October 22 and 23, 2026
    AI Overviews on commercial keywords88 percent of the U.S. keywords studied show an AI OverviewOnline stores, comparison and review sitesMediumSemrush, October 21, 2026; Search Engine Land, October 22, 2026

    PHP2Shell: why Google recommends a 503 status during shutdowns

    PHP2Shell is the name given to two critical security vulnerabilities in the PHP scripting language, tracked as CVE-2026-109618 and CVE-2026-109619. According to The Record on October 21, 2026, the PHP project rates both at 9.2 out of 10. They let attackers run their own code on a server without logging in.

    According to Search Engine Roundtable on October 21, 2026, PHP versions 5.4 through 8.5.11 are affected. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive regular security updates. According to The Record, security firm Detectify estimates that roughly half of all PHP websites run on those older versions.

    Germany's Federal Office for Information Security (BSI) rated the situation at warning level 3 (orange), according to ZDFheute and dpa on October 21, 2026. The BSI advised operators to take servers completely offline if in doubt. The German city of Mainz took its public websites offline as a precaution. According to The Record, Cloudflare is already seeing attacks.

    Google's John Mueller responded the same day. Anyone taking a site down for unplanned PHP updates should, in Mueller's words, "use HTTP 503 instead of letting responses time out." He also considers 404 or 500 responses the worse choice. The 503 can be served outside of PHP, for example through a DNS redirect or a content delivery network (CDN), a network of servers placed in front of your site.

    Search Engine Journal put Google's documentation in context on October 21, 2026. A 503 should not stay in place for longer than one to two days. If Googlebot sees 503 responses for the same URL over several days, Google may drop that URL from its index. A Retry-After header tells crawlers when to come back. For longer closures, Google recommends an indexable placeholder home page that returns a 200 status.

    What does this mean for your business?

    Most trades, restaurant and service-business websites run on WordPress, and therefore on PHP. According to Malwarebytes on October 21, 2026, updating WordPress or its plugins is not the same as updating PHP; your host or administrator has to apply that fix. If you must take your site down, use a 503 for hours, not weeks. Stroe Media recommends checking your PHP version in your hosting panel today instead of waiting for your host's email.

    Unconfirmed ranking volatility on October 20, 21 and 24

    On October 21, 2026, Search Engine Roundtable reported noticeable Google ranking movement on October 20 and 21. On October 25, 2026, it reported significant volatility on Saturday, October 24. So far, this has only been reported by Search Engine Roundtable, with no official confirmation from Google.

    According to Search Engine Roundtable, the tracking tools do not paint a consistent picture. Based on an analysis by SEO consultant Glenn Gabe, Ahrefs, Semrush and Sistrix dated the drops differently in some cases. Gabe also observed two websites in an especially sensitive money or health niche that disappeared from search results and returned about a week later.

    What does this mean for your business?

    There is no confirmed core update. Still, compare your performance from October 19 to 25 with the previous week in Google Search Console. If you see drops, rule out technical causes first, such as a shutdown related to PHP2Shell.

    Google's "Control what you share" documentation brings controls together

    On October 21, 2026, Google revised its help page "Control what you share with Google Search." According to the official Google Search Central documentation changelog, the page now lists existing options in one place: the robots meta tag, the data-nosnippet attribute, the X-Robots-Tag HTTP header and the Search generative AI control.

    Search Engine Roundtable clarified on October 21, 2026, that Google is not introducing a new feature. Google describes the change as bringing the page in line with the options currently available. On October 23, 2026, Google also clarified its URL structure best practices on hyphens and underscores.

    What does this mean for your business?

    The page is now the central reference for controlling which content Google shows in snippets or AI features. Most small business sites need not act, unless you want to keep prices, internal documents or logged-in content out of search.

    Google Business Home and new reports in Business Profile

    Google has launched a new interface called Google Business Home. According to Search Engine Roundtable on October 22, 2026, which cites a Google help page, it brings Business Profile, Merchant Center, YouTube and Google Ads together in one place. The interface runs on Google's Gemini AI models and is a closed beta in the United States and the United Kingdom.

    On October 23, 2026, Search Engine Roundtable also reported a test of new performance reports in Google Business Profile. The reports show engagement, reviews, search trends, audience and recommendations. According to a report on October 20, 2026, appeals for removed reviews are taking longer because of high volume. So far, these updates have only been reported by Search Engine Roundtable, with no official confirmation from Google.

    What does this mean for your business?

    Google Business Home is not yet available in Germany. If you use Business Profile, Google Ads and YouTube, watch it, since managing them could move into one place. Expect longer waits on review appeals for now.

    AI Overviews appear on 88 percent of commercial searches

    Semrush published a study on AI Overviews, the AI-generated summaries above Google's search results, on October 21, 2026. It examined 400 commercial keywords in banking, ecommerce and software, measured in U.S. desktop search from September 2025 through August 2026.

    In August 2026, Google showed an AI Overview for 88 percent of these keywords, up from 45.75 percent in September 2025. Weighted by search volume, the share was 97.08 percent. For review-related searches, the share rose from 30.14 percent to nearly 90 percent. Search Engine Land covered the study on October 22, 2026, and notes that it is owned by Semrush. The study does not measure clicks or conversions.

    What does this mean for your business?

    The figures cover the U.S. and three industries, not the German market, but they still signal a direction for online stores and comparison or review pages. Stroe Media recommends spot-checking your core keywords in Germany for AI Overviews and structuring your content so it can be cited as a source.

    What you should do this week

    1. 1Check your site's PHP version in your hosting panel or with your host, and have it updated to 8.2.35, 8.3.36, 8.4.27 or 8.5.12.
    2. 2If your site runs on PHP 8.1 or older, schedule a move to a supported version with a firm date.
    3. 3Agree with your host that any emergency shutdown returns a 503 status with a Retry-After header, not a 404 or an error page.
    4. 4In Google Search Console, compare clicks and impressions from October 19 to 25 with the previous week.
    5. 5Manually check five important commercial keywords in Google Search for AI Overviews and note which sources are cited.

    Frequently asked questions

    PHP2Shell refers to two critical security vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. They became public on October 21, 2026, and let attackers run code on a server without logging in. The PHP project rates both at 9.2 out of 10. Germany's BSI declared warning level 3 (orange). The fix is PHP version 8.2.35, 8.3.36, 8.4.27 or 8.5.12.

    WordPress runs on PHP. According to Search Engine Roundtable, PHP versions 5.4 through 8.5.11 are affected. Updating WordPress or plugins does not close the gap; the PHP version on your server is what matters. You can usually see it in your hosting panel. If in doubt, ask your host directly.

    Google recommends the HTTP 503 status code for temporary shutdowns. John Mueller advises against timeouts, 404s or 500s. You can serve the 503 through DNS or a content delivery network. A Retry-After header tells crawlers when to return. According to Google's documentation, a 503 should not stay in place for longer than one to two days.

    Google's documentation advises against serving a 503 for longer than one to two days. If Googlebot sees 503 responses for the same URL over several days, Google may drop it from the index. For longer closures, Google recommends an indexable home page returning a 200 status as a placeholder. Crawling recovers automatically once the errors stop.

    As of October 26, 2026, Google had not confirmed a core update. Search Engine Roundtable reported unconfirmed ranking volatility on October 20 and 21 and on October 24. The tracking tools did not show a consistent picture. If you see drops, check technical causes such as server outages first and review your data in Google Search Console.

    Conclusion

    PHP2Shell is this week's key topic for site owners because it affects security and visibility at once. Updating PHP and shutting down cleanly with a 503 protects both your data and your rankings. The ranking volatility is unconfirmed and worth watching, but not overrating. The new Business Profile features have not reached Germany yet.

    Want to know whether your website is technically sound? Stroe Media reviews your site as part of our SEO services and can connect it with Google Ads. Get in touch through our contact form. For last week's updates, see SEO News Week 43.

    Sources

    1. Google Advice On Taking Sites Down When Fixing PHP2Shell, Search Engine Roundtable, October 21, 2026
    2. Google Reminds Sites To Serve A 503 During PHP Patch Downtime, Search Engine Journal, October 21, 2026
    3. PHP security flaw: millions of websites at risk (German-language article), ZDFheute (dpa), October 21, 2026
    4. Hundreds of websites taken offline as concern grows over two PHP vulnerabilities, The Record, October 21, 2026
    5. PHP2Shell: Why many websites had to go offline, Malwarebytes, October 21, 2026
    6. Google Search Ranking Volatility & Chatter Heats Up October 20 & 21, Search Engine Roundtable, October 21, 2026
    7. Google Search Ranking Volatility Heated October 24th, Search Engine Roundtable, October 25, 2026
    8. Latest Google Search Documentation Updates, Google Search Central, October 21, 2026
    9. Google Updates Control What You Share With Google Search With Existing Options, Search Engine Roundtable, October 21, 2026
    10. Google Business Profiles New Business Home, Search Engine Roundtable, October 22, 2026
    11. Google Business Profiles Tests New Advanced Performance Reports, Search Engine Roundtable, October 23, 2026
    12. Google Business Profiles Review Appeals Are Delayed Again, Search Engine Roundtable, October 20, 2026
    13. AI Overviews have nearly doubled across five commercial search modifiers, Semrush, October 21, 2026
    14. Google AI Overviews nearly double for commercial keywords: Study, Search Engine Land, October 22, 2026

    Author: Stroe Media Editorial Team, Last updated: October 26, 2026

    Back to overview