Security

PHP2Shell: the AI-found PHP flaw and what small business websites must do now

PHP2Shell lets attackers take over PHP sites like WordPress without a login. Here is how to check your site, what to ask your host and why AI sped it up.

By AgentPlaybook Real Estate · Published Oct 23, 2026 · 5 min read

PHP2Shell is the name for two critical flaws in PHP, the language that runs WordPress, WooCommerce, Drupal, Joomla and a large share of small business websites. The PHP project shipped fixes on October 21, 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 and told everyone running PHP to "update now" (PHP Foundation). The bugs were found and turned into working attacks with help from frontier AI models, and attackers moved quickly too. It has been the biggest tech story of the week: Wiz's write-up reached 450 points on Hacker News, and our count of X posts mentioning PHP2Shell or the PHP vulnerability topped 41,000 on each of October 21 and October 22.

If your business has a website, here is what happened, how AI changed the timeline, and the short list of things to do today.

What PHP2Shell is

Two bugs in PHP itself

The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619. The PHP Foundation says both can let an unauthenticated attacker run code on the server under the right conditions, and that the real severity score is 9.2, not the 10.0 that circulated online before release (PHP Foundation). In plain terms, both bugs involve PHP mishandling memory after a request hits an error, such as running out of memory, and then trusting leftover data on a later request (Cloudflare).

Why almost every PHP site is in scope

Wiz Research, one of the teams that reported the bugs, says every PHP version released in the last decade is affected by at least one of them, going back to PHP 5.4. Its team showed remote takeovers without a login on the latest WordPress, Drupal and Joomla container images, and separately showed it could read passwords, tokens and API keys from server memory (Wiz). Wiz stresses that the problem sits below the application, so "even a simple 'Hello World' application" on an affected version can be vulnerable.

How AI changed the timeline

Found by researchers working with frontier models

The root cause had been suspected for a while. The PHP Foundation says a contractor spotted the first signs of the out-of-memory problem in 2024, but no clear attack path was found and work on a fix stalled, which it calls "a structural failure" (PHP Foundation). Security firm Calif, auditing PHP under OpenAI's Patch the Planet program, reported an unconditional remote code execution on August 11, 2026, and Wiz followed on August 24 (PHP Foundation). OpenAI says Calif identified the flaw using GPT-5.6 Sol, and that Wiz independently discovered both vulnerabilities (OpenAI). Wiz says it used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, and that "a single researcher completed in a week what previously would have taken a world-class team months of work" (Wiz).

Attackers did not wait for the patch

The disclosure did not go to plan. The CVE IDs leaked on October 20, Calif mistakenly published a demo video, and the release was pulled forward a day to October 21 at 14:00 UTC (10:00 a.m. Toronto time), according to the PHP Foundation. Amazon's threat intelligence team says it saw a PHP2Shell exploit attempt against its honeypots on October 17, four days before disclosure, and that the bug "is now seeing broad exploitation attempts in the wild" (AWS).

CJ Moses, chief information security officer of Amazon Integrated Security, draws the lesson for everyone in the same post: AI-assisted analysis makes it cheaper to turn a patch into a working exploit, so for critical internet-facing flaws, patch timelines should be "in hours", not 7 or 30 days.

Who is already protected

Many owners will find their host has done the work. Cloudflare says its free and paid web application firewall (WAF) plans have blocked php2shell by default since October 21 at 3:02 a.m. UTC, but still tells customers to patch PHP (Cloudflare). The U.S. Chamber of Commerce's small business guide warns that "not every plan is covered automatically" and that you should not assume your host has handled it (CO—).

Old PHP is the big gap. PHP 8.1 and older no longer get official security fixes, and the Chamber guide cites a report that about 35% of WordPress sites run unpatched PHP versions. Malwarebytes adds that abandoned websites and unsupported applications may stay exposed if nobody maintains them (Malwarebytes).

What we did not verify

We did not test any exploit or scan any site, and we have not confirmed the patch status of any particular host. We also could not independently check the 70% PHP market-share figure, which comes from Wiz and Cloudflare. Follow your host's own status page for confirmation.

What this means for small businesses

Most owners can handle this with one message to their host or developer. Do it today:

1. Find your PHP version. In WordPress go to Tools > Site Health > Info > Server, or check your hosting panel. Patched releases are 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer. Some hosts patch without changing the number, so ask if yours looks old (CO—).
2. Ask your host in writing. Is the fix for CVE-2026-109618 and CVE-2026-109619 installed, not just scheduled? Were PHP and the web server restarted? Are test and old sites covered? Did they look for signs of attack back to October 17?
3. Do not count on a WordPress update. The Chamber guide says the WordPress security team has no update planned for this, because the fix lives in PHP on the server.
4. If you can't patch today, go offline briefly. The Chamber guide says CISA, the NSA and the FBI advise taking unpatched systems offline. A few hours in maintenance mode costs less than a hijacked store. A WAF helps, but only as a stopgap.
5. Rotate passwords and keys after patching. Because one bug can leak memory, reset admin and hosting passwords, then ask your developer to replace payment and email-marketing API keys.
6. Ignore "PHP2Shell fix" plugins. Unofficial fixes from forums or cold emails may contain malware, the guide warns.
7. Get off old PHP. Move to 8.3 or newer; PHP 8.2 support ends on December 31, 2026.

The free prompts below help you audit your site, write a clear incident note for staff or customers, and list who has access to what. If you plan to use an AI agent for maintenance tasks like this, the AI time savings calculator shows whether it's worth it, and the prompt grader checks your instructions before you run them. For more on agent security, see our pieces on prompt injection in email and Meta Muse share links.

Frequently asked questions

What is PHP2Shell?

It is the nickname for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, rated 9.2. They can let an attacker run code on a server without logging in. They were fixed on October 21, 2026.

Is my WordPress site affected by PHP2Shell?

Probably, unless your server runs PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a host-patched build. Wiz demonstrated attacks on the latest WordPress, so check your PHP version and ask your host.

Does updating WordPress fix PHP2Shell?

No. The flaw is in PHP, not WordPress, so the PHP software on the server must be updated and restarted. Your host does this on managed plans; on a VPS you do it yourself.

Was PHP2Shell found by AI?

AI did much of the heavy lifting. Calif found a critical flaw using OpenAI's GPT-5.6 Sol, and Wiz says it used Gemini 4 Argon and GPT-5.6 Sol alongside its own tools. Human researchers and PHP maintainers reported, verified and fixed it.

Is PHP2Shell being exploited?

Yes. Amazon says it saw an attempt on October 17 and broad exploitation attempts after the October 21 patch.

Sources

• Wiz Research: PHP2Shell, AI uncovers critical RCE vulnerabilities
• The PHP Foundation: Today's PHP security release
• OpenAI: Patch the Planet
• AWS Security Blog: PHP2Shell exploitation prior to public disclosure
• U.S. Chamber of Commerce CO—: What small business owners need to do
• Malwarebytes: Why many websites had to go offline
• Cloudflare: Protections against php2shell
• Hacker News: PHP2Shell discussion

How we report: every fact, number and quote above comes from the linked sources, which we read before publishing. Product details can change quickly during previews, so check the vendor page before you buy. Spotted an error? Tell us via the link on our home page.