TL;DR Summary:
PHP2Shell Triggers Outages: Critical PHP vulnerabilities forced governments and major organizations offline for emergency patches, making server security and downtime planning urgent.Volatility Without Confirmation: Google rankings swung sharply, but no new algorithm update was confirmed, so traffic changes should be verified before being blamed on a core update.Search Data Gets Distorted: Google reportedly served altered results to data-scraping tools, meaning sudden rank changes may be tracking noise rather than real performance shifts.AI Visibility Surges: AI Overviews appeared for 88% of commercial keywords, yet the dramatic SERP expansion has not translated into meaningful increases in referral traffic.PHP2Shell Risk Forces Site Outages Amid Ranking Shift | Week of October 25 2026
No confirmed Google algorithm update rolled out this week, despite a sharp spike in ranking volatility and forum speculation. The most significant development was the emergency response to the PHP2Shell vulnerability, which forced governments and major organizations to pull sites offline starting around October 21. Alongside this, Ahrefs disclosed that Google is serving altered results to suspected data-scraping tools, and Semrush published new numbers showing AI Overviews now appear on 88% of commercial keywords.
PHP2Shell Vulnerability Triggers Emergency Patches and Outages
PHP issued emergency patches this week for two critical flaws, collectively referred to as PHP2Shell, that could let attackers compromise servers. Governments and major organizations took sites offline to apply fixes, with outages concentrated around October 21. Google issued specific guidance for site owners on how to handle taking a site down during emergency patching, covered by Search Engine Roundtable. For SEOs, this means planning downtime carefully — unplanned outages during crawl windows can affect indexing, and Google’s guidance addresses exactly this scenario.
Ranking Volatility Spikes Without a Confirmed Update
Barry Schwartz at Search Engine Roundtable reported that Google Search rankings became “super volatile again” on October 20–21, with industry chatter spiking to unusual levels in a 24-hour window. Site owners described collapsing Discover traffic, Google News stuck on old stories, and Search Console data running days behind. Several predicted a core update, but Google’s status dashboard has not confirmed one as of this writing. Treat this as unconfirmed — monitor your own traffic data rather than assuming a named update caused any changes you see.
Ahrefs Flags Google’s “Poisoned” Results for Data Tools
Ahrefs reported this week that Google is returning altered search results to suspected search-data collectors, affecting 5% to 20% of results depending on the provider. The company detailed its response in an October 22 update, saying it is filtering abnormal results, requesting replacements, and cleaning historical records. Research firm Nozzle found 77.9% of poisoned SERPs had their usual sites restored within three days. If your rank tracking shows sudden, unexplained swings this week, cross-check against a second tool before reacting — the discrepancy may be Google’s anti-scraping defense, not an actual ranking change.
AI Overviews Cover 88% of Commercial Keywords, Traffic Stays Flat
A Semrush study published October 21–22, based on 400 U.S. desktop keywords across banking, ecommerce, and software, found Google AI Overviews appeared for 88% of commercial keywords in August — nearly double the 45.75% recorded in September 2025. Despite that visibility jump, ChatGPT referral traffic sits at just 0.62% of Google organic traffic, according to separate studies cited in the same coverage. This confirms AI Overviews are reshaping what SERPs look like for commercial queries far faster than they’re sending measurable visitors to sites. Visibility in an AI Overview does not currently translate to click volume.
September Spam Update Still Shapes October Interpretation
The September 2026 spam update finished rolling out on October 8. Some in the SEO community said the rollout “felt like” a core update, even though Google never classified it as one. This history matters because it has primed forum discussion to interpret ordinary October volatility, including the October 20–21 spike, as evidence of a new unannounced update. No such update has been confirmed, and the two events — the spam update rollout and this week’s volatility — remain separate and unconfirmed as connected.
What to do this week
Check your server logs and hosting dashboard for any PHP version below the patched release, and confirm with your host whether PHP2Shell patches have already been applied to your environment.
Compare your rank-tracking tool’s data from October 20–23 against a second source, such as Google Search Console’s own position data, to rule out Ahrefs’ reported “poisoned results” effect before concluding you lost or gained rankings. For a deeper cross-check, tools like Labrika integrate directly with Google Search Console, letting you reconcile your rank tracker’s numbers against indexing and position data before assuming a real ranking change occurred.
Pull your top 20 commercial keywords and check in Google Search directly whether an AI Overview now appears where it didn’t in September, then note whether your organic click-through rate from Search Console changed for those same queries over the same period.
Hold off on any major technical changes tied to speculation about a “core update” this week — check Google’s Search Status Dashboard directly before attributing traffic swings to an algorithm change that has not been confirmed.
