PHP2Shell: Two Critical PHP Flaws Found With AI Put Millions of Websites at Risk
PHP released emergency security updates on Wednesday, October 21, fixing two critical flaws that can let an attacker run code on a web server without logging in. Wiz Research, which helped find them, says every PHP version released in the past decade is affected by at least one flaw, going back to PHP 5.4.
Researchers have nicknamed the flaws PHP2Shell. If you run a PHP website, the advice is simple: update now.
What Was Patched
The fixes arrived in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to Quartz. The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and each scores 9.2 on the CVSS v4.0 severity scale.
Wiz says the bugs stem from how PHP handles fatal errors, especially out-of-memory errors. Quartz adds that PHP says every installation serving web requests is at risk, with the highest risk for those using Apache’s mod_php.
Why the Reach Is So Wide
Wiz says PHP powers 70% of websites, including WordPress, Drupal, Joomla and MediaWiki, the software behind Wikipedia. The flaws sit in PHP itself, not in any one application. Wiz showed that even a simple “Hello World” program can be vulnerable on an affected version.
The researchers demonstrated attacks that run code without logging in on WordPress, Drupal and Joomla, using their latest container images. They also showed that attackers could read passwords, tokens and API keys from PHP’s memory without taking over the server.
TechCrunch reports that WordPress has said the flaw is not specific to its software. It also notes that PHP 8.1 and older versions are no longer supported, so those sites have more updating to do.
How AI Found the Flaws
Wiz says it used its own research agent, Gemini 4 Argon and GPT-5.6 Sol throughout the work. TechCrunch adds that a separate security firm, Calif, worked on the same problem through OpenAI’s Patch the Planet initiative.
The vulnerable code had been in PHP for more than a decade. Wiz argues that what AI changed was the ability to turn the weaknesses into working exploits. It says one researcher finished in a week what would once have taken a world-class team months, and that models helped adapt exploits to different targets in hours.
The timeline shows the care taken. Wiz found the first flaw on August 19 and reported it to PHP on August 24. PHP acknowledged the reports on September 21, and patches shipped on October 21. Unite.AI reports that the CVE IDs briefly leaked online on October 20, so PHP moved its release up by a day. No technical details leaked.
What to Do Now
Wiz says applying the PHP security update is the only complete fix. Wiz also thanked providers including Cloudflare, AWS, Microsoft, Akamai and Fastly for preparing mitigations for customers who cannot patch immediately.
The steps below are our own advice, not part of the reporting.
First, find out which PHP version your site runs. In WordPress, the Site Health screen shows it under Tools. Second, ask your host whether it has installed the patched release, or update it yourself if you manage your own server. Third, take a fresh backup before you update, and test your site afterward. Our guide to backing up your data properly explains how.
While you wait, Wiz suggests watching for warning signs. These include unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, oddly large or malformed session cookies, and unexplained PHP worker churn.
What It Signals
Wiz compares PHP2Shell to Heartbleed and Log4Shell, and argues it could mark a turning point for the AI era. Its point is that complexity may no longer protect old bugs from being exploited. That is Wiz’s view, and the company also sells security products.
It is a useful reminder either way. For more on this theme, read our guide on protecting yourself from AI-powered cyber threats and our roundup of the worst cyberattacks and data breaches of 2026.
