A single flaw in shared code turns ordinary websites into open doors, and cash registers for those selling the locks.

Two critical flaws in PHP — the programming language running roughly 70% of all websites — were leaked publicly on 20 October before a patch existed. PHP is the engine under WordPress, online banking portals, and e-commerce checkouts. Attackers can run their own code on a server without a password. Shizuoka Bank, Mizuho, The 77 Bank, and Daiwa Securities all suspended online services on 21 October. The Japanese Bankers Association confirmed no impact to interbank settlements — but retail customers couldn't log in.

If you bank with a Japanese regional bank, your online account was offline on 21 October with no guaranteed return time. In the UK, the NCSC told every organisation running PHP to patch immediately or take systems offline. Client login pages, document upload portals, and scheduling tools attached to financial adviser sites running WordPress are all in scope. Versions older than PHP 8.2 have no official patch at all — their provider has nothing to install.

Law of the Trap: the trap isn't the hack. It's the dependency. Millions of ordinary people handed their financial access to platforms built on shared infrastructure that was never audited. Now the hole is public and the patch window is measured in hours. People feel helpless because they are — until this moment they didn't know PHP existed, let alone that their bank ran on it. What's being done to your head: the system makes you feel like a victim of random bad luck. It wasn't random. Outdated code sitting under critical services was a known category of risk.

PHP2Shell — CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10 — let an attacker take over any server running PHP 5.4 or later without a login. Details leaked on 20 October, one day before the patch was ready. Four governments — France, Denmark, Finland, and the Netherlands — pulled public-facing infrastructure offline rather than risk live exploitation. In the Netherlands that meant DigiD, MijnOverheid.nl, the Dutch parliament website, the Port of Rotterdam, five political party websites, and several hospital sites all went dark simultaneously.

DigiD is the Netherlands' national identity login — it's how Dutch citizens access government services, tax records, and healthcare portals. It was offline on 21 October. In the UK, the NCSC issued an emergency alert and its own website briefly went down. Censys data shows approximately 1.575 million hosts worldwide still running an unpatched PHP version as of disclosure. Versions below PHP 8.2 received no patch at all — those servers remain exposed until operators find an alternative fix or take systems down.

Law of Entropy: complex systems don't fail dramatically — they decay quietly until one trigger collapses everything at once. PHP has been losing market share for years and upgrading it was never prioritised because it still worked. That's the trap entropy sets. Four nations discovered on 21 October that their entire public digital layer was balanced on ageing, unaudited code. The psychological play on citizens: digital public services feel permanent and solid. They're not. They're built on the same open-source foundations as a small business blog.

When PHP2Shell's details leaked on 20 October, Cloudflare had WAF rules — a web application firewall is a digital bouncer that checks traffic before it reaches your site — deployed nine hours before public disclosure. By 3:02 a.m. UTC on 21 October, every Cloudflare customer including free users was shielded against known attack vectors. Cloudflare's CTO publicly called it a stopgap only, and urged patching immediately. Cloudflare stock closed up 6% at $307.79. Datadog rose 7%. CrowdStrike and Palo Alto Networks also gained.

Cloudflare (NYSE: NET) was already up 78% since January before today's move, trading near 200x forward earnings. The 6% single-session gain added roughly $4bn in market cap. Datadog (NASDAQ: DDOG) gained 7% on the same session. These are high-multiple stocks — meaning investors are already paying a large premium for future growth. A crisis event reprices their strategic value fast. Cloudflare's Q2 2025 revenue was $512.3m, up 28% year-on-year. Analysts project revenue reaching $4.73bn by 2028.

Law of the Landlord: Cloudflare sits between attackers and millions of websites it doesn't own, and it charges rent for that position. Every new vulnerability that makes the internet less safe makes the landlord more valuable. The psychological play on retail investors: crisis creates urgency, urgency creates buying, buying inflates a stock already priced for perfection. The person chasing a 6% gap-up after a crisis headline is the one who arrives after the trade. The person who held for the thesis already banked it.