October 28, 2026
On October 20, a bug that had been sitting inside PHP for more than a decade became the most urgent problem on the internet. Within a day, government websites across Europe were switched off on purpose, Cloudflare was pushing emergency firewall rules, and hosting companies were patching servers through the night.
The flaw now goes by the name PHP2Shell. If your business runs a website on WordPress, WooCommerce, Laravel, Magento, Drupal or almost any PHP framework, the PHP2Shell vulnerability is your problem too, even if nobody has told you yet.
In this blog we will cover, what actually happened, why this one is different, and what you should be doing about it this week.
What is the PHP2Shell vulnerability?
PHP2Shell is the nickname for two critical flaws in the PHP interpreter itself, tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a CVSS v4.0 score of 9.2 out of 10. Both can let an attacker run their own code on your web server without a username, a password or any kind of login. That’s what “unauthenticated remote code execution” means in practice: a stranger sends a crafted request, and your server does what they say.
The two bugs work differently. The first involves how PHP handles running out of memory while it is still setting up a request, which can leave internal data half-built and later treated as valid. The second lets leftover state from one request survive in memory after it should have been cleared, so the next request handled by the same worker trips over it.
What makes this serious is where the flaws live. They sit in PHP, not in WordPress, not in a plugin, not in your custom code. According to Wiz Research, which reported the bugs, every PHP version back to 5.4 is affected by at least one of them. Its team demonstrated full takeovers of fresh WordPress, Drupal and Joomla installs, and showed that even a bare “Hello World” page on a vulnerable PHP version could be exploited. Wiz also showed attackers could read PHP worker memory, which often holds passwords, tokens and API keys, without needing to run code at all.
Wiz compared the flaws to Heartbleed and Log4Shell. That comparison isn’t hype this time.
How a Planned Fix Turned Into an Emergency
Details of the flaws leaked online on October 20, ahead of the coordinated date. The PHP security team responded the same day with an advance notice of a security release for October 21 at 14:00 UTC, while reserving the right to ship earlier if exploitation appeared. Security firm watchTowr publicly confirmed within hours that the leaked bugs were real.
Then came the precautionary shutdowns. The Netherlands’ National Cyber Security Centre took its own website offline, and others followed: DigiD, MijnOverheid, the Dutch House of Representatives, the Port of Rotterdam and the national football association KNVB, among others. Government teams in Finland, France and Denmark pulled public-facing sites as well, CNBC reported, and CERT-EU urged agencies to take affected sites down until they could patch. Governments decided a dark website was safer than a live one running PHP. Sit with that for a moment.
Cloudflare CTO Dane Knecht said the company was already seeing early attacks and rolled out WAF rules for every customer, free plan included, while calling them a stopgap. Those rules only help if your origin server accepts traffic exclusively from Cloudflare, which plenty of setups don’t.
PHP shipped the fixes on schedule in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Where Things Stand a Week Later
The question has moved from “could this be exploited?” to “how widely is it being exploited?”
Amazon’s threat intelligence team reported that attackers began targeting PHP2Shell four days before any patch existed. On October 24, a detection lead at Perplexity confirmed successful remote code execution against a honeypot running Apache mod_php on PHP 8.4.26. Two days later, CISA added both CVEs to its Known Exploited Vulnerabilities catalog and gave US federal agencies until Thursday, October 29, to secure their systems.
The exposure numbers are uncomfortable. Censys data cited by Cybernews puts the count of still-vulnerable PHP services at 32.5 million, with more than 10 million in the US alone. A research lab in Delft separately logged over 50,000 PHP2Shell exploitation requests from more than 600 IP addresses across 70 countries.
There is a counterpoint, and it’s worth being fair about it. As of October 26, SC Media reported no public confirmation of reliable, large-scale exploitation. That’s a window, not a guarantee. Bugs like this have a long tail, and the people scanning for unpatched servers are very patient.
AI Found the Bug Before Anyone Else
Most coverage has focused on the scramble. The more important story is how these flaws were found in the first place.
Calif, a California-based AI red-teaming firm, started auditing PHP’s source code on July 30 at the PHP Foundation’s request, using OpenAI’s GPT-5.6 Sol through OpenAI’s Patch the Planet initiative. It found the first issue in August. Wiz Research, working independently, found the same flaws on August 19 using its Wiz Atlas platform together with Google’s Gemini 4 Argon and GPT-5.6 Sol. By Wiz’s own timeline, a working attack against WordPress was confirmed two days after that first discovery, and the bugs were reported to PHP on August 24.
It took just two days to go from a flaw hidden for over a decade to a working attack on the world’s most popular CMS.
PHP Foundation security engineer Volker Dusch told the Wall Street Journal it was the most severe issue PHP had faced in more than a decade, per The Next Web. OpenAI, in comments reported by Fortune, called it one of the most impactful security issues in recent memory and acknowledged that the same AI capabilities helping defenders can help attackers build exploits just as fast. The company also expects discoveries on this scale to rise sharply over the coming months.
For a business owner, the lesson here isn’t “AI is scary.” It’s that the gap between a flaw becoming known and someone weaponizing it is collapsing. Patch routines built around a quarterly maintenance window were designed for a slower internet, and that internet is gone.
Is Your PHP Environment Patched and Secure?
Get expert help with PHP audits, legacy code upgrades, and security patching so the next emergency fix is a routine afternoon.
Is Your Website Affected by This PHP Security Vulnerability?
Short answer: if your site runs on PHP and its server hasn’t been updated since October 21, assume yes.
Patchstack’s advisory notes that every PHP install serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Mod_php is considered the riskiest because the attack can fire before any application code runs. Sites built on WordPress, Drupal, Magento, Joomla, Laravel and other PHP applications are all exposed if the PHP version underneath is vulnerable.
One misconception keeps coming up. Updating WordPress core or your plugins does nothing here, because the fix lives at the server level. If you’re on shared or managed hosting, your provider has to update the PHP runtime. Some hosts, SiteGround and InMotion among them, moved before the patch even landed. Others have said very little. Ask yours directly.
Older versions are where it gets messy. PHP 8.1 and earlier get no official fix from the PHP project, although some Linux distributions and paid extended-support vendors have backported patches. PHP 8.2 itself reaches end of life on December 31, 2026, so patching 8.2 today buys you roughly two months.
What to Do This Week
Start with an inventory, because you can’t patch what you’ve forgotten about. Production servers are the obvious ones. Staging sites, old campaign microsites, Docker containers and third-party tools that quietly bundle PHP are where things slip through. CISA has warned that PHP often isn’t directly visible since it ships inside other software.
Next, update every one of those installs to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to your Linux vendor’s patched package. Restart all PHP workers afterward and confirm the running version, not just the installed one.
If you can’t patch today, PHP lists partial mitigations that reduce exposure without making a server safe:
- Set session.upload_progress.enabled=0 in php.ini or your FPM pool config (not through ini_set() or .user.ini), then restart every worker.
- On PHP 8.5, also set fatal_error_backtraces=0.
- Keep post_max_size low, around 8M if you don’t accept uploads.
For a high-risk site, maintenance mode until the update lands is a defensible call. The UK’s NCSC has given similar advice.
Then check whether anyone got in before you patched. Wiz suggests watching for unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, oversized or malformed PHPSESSID cookies, and PHP workers restarting without explanation. None of these prove a breach. But because PHP2Shell can leak memory, rotating passwords, API keys and tokens stored on any suspect server is cheap insurance.
And please, skip the unofficial “PHP2Shell fix” plugins and copy-pasted snippets doing the rounds. They aren’t verified, and a few of them cause more problems than they solve.
The Bigger Lesson For Businesses Running PHP
PHP isn’t going anywhere. It still powers roughly 70% of websites by Wiz’s estimate, and honestly, the ecosystem handled this incident about as well as anyone could hope: an advance notice, coordinated fixes across four branches, distribution backports, and hosts acting before the official release.
What changed is the clock. When AI models can take a bug from discovery to working exploit in days, “we’ll upgrade PHP next quarter” stops being a plan. Version upgrades, dependency hygiene and knowing exactly what’s running where used to be housekeeping. They are security controls now.
This is also where a lot of businesses get stuck. The sites most likely to be sitting on old PHP are the ones nobody has touched in years, with legacy code that breaks on PHP 8.4 and a custom plugin whose original developer left long ago. At Primotech, our development team helps businesses audit their PHP environments, move legacy applications onto supported versions and set up maintenance processes, so the next emergency patch is a routine afternoon rather than a crisis.
Conclusion
The PHP2Shell vulnerability won’t be the last flaw AI pulls out of software everyone assumed was safe, and the time between disclosure and attack will only get shorter. If your website runs on PHP, confirm your server is on a patched version today and put a firm date on your move to PHP 8.4 or 8.5. Treat this one as the warning shot.
FAQs
1.) Does updating WordPress fix PHP2Shell?
No. PHP2Shell is a flaw in the PHP runtime on your server, not in WordPress core or its plugins. Your hosting provider or server admin has to update PHP itself, so if you’re on managed hosting, a quick email asking which PHP version you’re on right now is worth sending today.
2.) Which PHP versions are safe from PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all released on October 21, 2026, contain the fix. Branches 8.1 and older get no official patch, though some Linux vendors and paid support providers have backported one. PHP 8.2 also hits end of life on December 31, 2026, which makes it a short-term stop at best.
3.) Is Cloudflare enough to protect my site?
Only partly, and only for now. Cloudflare’s WAF rules block known exploit patterns on all plans, but the company itself describes them as a stopgap. They also only work if your server refuses traffic that doesn’t come through Cloudflare, which many setups never configured.
4.) How do I check which PHP version my site is running?
Your hosting dashboard (cPanel, Plesk and similar) usually shows the active PHP version under its PHP settings. On a server you manage, php -v gives the command-line version, but the version serving web pages can differ, so a temporary phpinfo() page that you delete straight after is the more reliable check.
5.) Did AI really find these PHP flaws?
Yes. Calif used OpenAI’s GPT-5.6 Sol to find the first issue, and Wiz independently found the same flaws using Google’s Gemini 4 Argon, GPT-5.6 Sol and its own Wiz Atlas platform. Both teams also used AI to adapt and test exploits across PHP versions, which is a big part of why security teams are rethinking how fast they patch.
