PHP2Shell: what it is and how to check your website

PHP2Shell is the name for two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619, that can let an attacker run code on a web server without logging in. If your website runs on WordPress, Drupal, Joomla or anything else built on PHP, the fix is to get PHP updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, all released on October 21.

The story broke on X this morning. @wiz_io announced it as "a decade-old PHP Core vulnerability," rated CVSS 9.2, and said it affects roughly 70% of the internet. Half an hour later @OpenAI posted its side: its models helped researchers find the flaws under an effort it calls Patch the Planet, and it spent two months lining up maintainers and security vendors so fixes were ready before details went public. Wiz CTO @amiluttwak kept his post short: "Most severe vulnerability found using AI ever," followed by "Patch today."

Why AI is part of this story

The bugs aren't new. What's new is how fast they turned into working attacks. In a follow-up post, Wiz says frontier models (its own Wiz Atlas, OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon) were used to "hunt down and chain these 10-year-old flaws" in under a week. Wiz gives Gemini 4 Argon the most credit. Its write-up says one researcher working with those models did in a week what would have taken a top team months, and that the models adapted exploits to different PHP versions and server setups in hours.

That speed is the worrying part. We wrote a few weeks ago that a free AI model now writes exploits, and that the time between "bug found" and "bug used" keeps shrinking. PHP2Shell shows the same thing on a much larger scale. The coordinated release was even moved up a day, because details leaked on October 20.

What the flaws do, in plain terms

Both bugs are about PHP cleaning up badly after a request crashes. In one, a request that runs PHP out of memory can leave half-built data behind, and the next request on the same worker can read it. That leftover memory can hold passwords or tokens from other requests. In the other, internal state survives after its memory is freed and gets reused by a later request. Chained together, they give an attacker code execution. Wiz showed it working, without a login, against the latest WordPress, Drupal and Joomla images.

The flaw is in PHP, not in your theme or plugins. Updating WordPress or every plugin you have does not fix it.

How to check your website

1. On WordPress, go to Tools, then Site Health, then the Info tab, and open "Server." Your PHP version is listed there.
2. On shared hosting, look in the control panel for a PHP version or PHP settings page. Most hosts show the version there and let you change it.
3. If a host or agency manages the site, email them today with two questions: which PHP version runs it, and whether the October 21 security release is on. Linux distributions got the patches in advance, so plenty of hosts may already be done.

Then compare what you find against this table, built from the php.net release notes and Patchstack's advisory:

If you are on 8.1 or older, this is the push to upgrade. Patchstack says PHP put out minimal backports for 7.4, 8.0 and 8.1, but only for people who build PHP from source, and that is not most small business sites.

Is anyone attacking it yet?

Yes, at least a little. Tenable reports that Cloudflare's CTO saw early attacks, and Patchstack says hosting partners flagged active exploitation this morning, though its own data showed mostly probing by early afternoon UTC. If your site sits behind Cloudflare, it deployed WAF rules on every plan, free included, before disclosure. Cloudflare itself calls that an extra layer, not a fix. Config tweaks like turning off session.upload_progress lower the risk, but PHP's own release notes say they do not make an install safe. Only the update does.

What this means for a small business

Most owners have no idea which PHP version their site runs, or who is supposed to update it. That gap matters more now that AI can turn old bugs into working attacks in a week. If you are paying for a site, part of what a small business website costs should be someone who answers "are we patched?" the same day.

If you're not sure who owns updates on your site, or which of your systems would be exposed in a week like this, New Face Design's free process audit will map what you run and who maintains each piece.