Could an AI-assisted security discovery affect the technology behind nearly 70% of the world’s websites, including WordPress websites that appear fully updated?
Security researchers using artificial intelligence have uncovered two critical vulnerabilities in PHP, the server-side programming language behind WordPress, Drupal, Joomla, and millions of other websites.
Collectively known as PHP2Shell, these flaws could allow unauthenticated attackers to execute malicious code on vulnerable web servers.
The AI-assisted discovery prompted an emergency cybersecurity response and the release of PHP security patches on October 21, 2026, following reports that vulnerability details had leaked ahead of the scheduled release. (Source)
Both vulnerabilities carry a critical CVSS v4.0 severity score of 9.2.
Although PHP powers a significant portion of the internet, the widely reported 70% figure does not mean that every PHP-powered website is vulnerable or has already been compromised.
PHP2Shell at a Glance
| Detail | Information |
| Vulnerability name | PHP2Shell |
| Disclosure and patch release | October 21, 2026 |
| CVE identifiers | CVE-2026-109618 and CVE-2026-109619 |
| Severity | Critical — CVSS v4.0 score of 9.2 for both |
| Affected technology | PHP runtime |
| Affected versions | PHP releases from 5.4 onward, including unsupported branches; upstream fixes are available for PHP 8.2, 8.3, 8.4, and 8.5. Vendor backports may also be available. |
| Potential impact | Unauthenticated remote code execution; potential theft of sensitive data and further server compromise |
| Patched PHP versions | 8.2.35, 8.3.36, 8.4.27, and 8.5.12 |
The U.S. National Vulnerability Database lists CVE-2026-109618 and CVE-2026-109619, enabling security teams to track the vulnerabilities by standardized identifiers.
What is PHP2Shell?
PHP2Shell refers to two critical memory-safety vulnerabilities in the PHP runtime that could enable attackers to execute arbitrary code remotely without first authenticating to an affected website.
Unlike a vulnerability confined to a particular WordPress plugin, theme, or application, PHP2Shell affects the underlying PHP engine responsible for processing server-side requests.
The vulnerabilities arise from weaknesses in how PHP manages memory during certain execution and cleanup operations.
When these operations leave memory in an unsafe state, attackers may be able to manipulate program execution through specially crafted requests.
Successful exploitation could allow malicious code to run with the privileges of the affected PHP worker process, potentially exposing website files, application credentials, or other accessible server resources.
The National Security Agency’s October 21 advisory warned that PHP2Shell could allow attackers to take control of affected servers without prior access or authentication.
How Did AI Help Researchers Discover PHP2Shell?
AI-assisted security research played a significant role in identifying the PHP2Shell vulnerabilities.
Security researchers at Calif, OpenAI, and Wiz uncovered the vulnerabilities. Wiz reported using Wiz Atlas, Google’s Gemini 4 Argon, and OpenAI’s GPT-5.6 Sol during its research; Calif’s work was associated with OpenAI’s Patch the Planet initiative. (Source1 , Source 2)
AI-assisted analysis helped researchers investigate complex memory-handling behavior in PHP, including execution paths and interactions that may be difficult to identify through ordinary software testing.
However, describing the flaws as AI-assisted discoveries does not mean an AI system independently completed the entire investigation.
Human researchers remained responsible for validating the findings, understanding their security implications, and coordinating disclosure and remediation. PHP maintainers led the development and release of the security fixes.
The incident demonstrates how AI-assisted analysis can contribute to identifying serious vulnerabilities in widely deployed software, while human expertise remains essential for validation, coordinated disclosure, and remediation.
CVE-2026-109618 and CVE-2026-109619: What Makes Them Dangerous?
Although both vulnerabilities affect memory safety in the PHP runtime, they arise from different underlying conditions.
Security analyses describe use-after-free conditions during out-of-memory error handling and request cleanup, including functionality associated with upload progress and request parsing. Website owners should rely on the official PHP security advisory for the authoritative technical description and remediation guidance.
In general terms, unsafe memory states can occur when PHP handles failed memory allocations, exits execution contexts, or cleans up data associated with completed requests. If later requests processed by the same PHP worker encounter stale or invalid references, attackers may be able to interfere with PHP execution.
Both vulnerabilities can lead to unauthenticated remote code execution under vulnerable conditions, although their memory-handling mechanisms differ.
The seriousness of these vulnerabilities comes from their location within PHP itself, potentially exposing applications that would otherwise be considered properly maintained.
Why Could PHP2Shell Affect the Technology Behind Nearly 70% of Websites?
The global concern surrounding PHP2Shell comes from PHP’s widespread adoption.
W3Techs estimates that PHP is used by 69.3% of websites whose server-side programming language is known. This measure reflects PHP’s prevalence, not the percentage of websites confirmed vulnerable to PHP2Shell or successfully compromised.
PHP supports content management systems, ecommerce platforms, business applications, and custom websites across many industries.
Because the vulnerabilities exist in PHP’s runtime rather than in a single application, the potential impact extends across multiple website platforms and hosting environments.
However, not every PHP-powered website runs an affected, unpatched version. Some hosting providers also deploy vendor-maintained packages containing backported security fixes.
The actual risk to an individual website depends on its PHP version, security patch status, server configuration, and exposure to malicious requests.
Which Websites and Platforms Are Potentially Affected?
PHP2Shell can affect applications that rely on vulnerable PHP runtimes, including:
- WordPress: Business websites, blogs, and WooCommerce stores running affected PHP versions.
- Drupal: Content management systems using vulnerable PHP installations.
- Joomla: PHP-based websites and applications.
- Custom PHP applications: Ecommerce platforms, customer portals, business tools, and other server-side services.
The vulnerabilities are also relevant to common PHP web-serving environments, including PHP-FPM, Apache with mod_php, PHP-CGI, and other integrations.
The exploitability of a particular deployment can vary depending on its configuration and request-processing behavior.
For WordPress users, an important concern is that updating WordPress core, plugins, and themes does not automatically update the server’s PHP runtime.
A fully updated WordPress installation could therefore remain exposed if its hosting environment uses an affected PHP build.
Our guide to WordPress remote code execution vulnerabilities explains the broader risks associated with unauthorized code execution in WordPress environments.
How Did PHP2Shell Trigger an Emergency Global Security Response?
The discovery of PHP2Shell prompted an urgent response from the PHP security team, hosting providers, cybersecurity companies, and government agencies.
Details of the vulnerabilities reportedly leaked ahead of PHP’s scheduled security release. The PHP security team subsequently released emergency updates on October 21, 2026, accelerating the remediation timeline.
The vulnerabilities’ severity and their presence in widely deployed server-side software increased the urgency of identifying affected systems.
Why Was the Disclosure & Patch Release Accelerated?
On October 20, 2026, the PHP project warned administrators about two critical vulnerabilities and an upcoming security release.
The vulnerabilities were rated 9.2 under CVSS v4.0, indicating critical severity.
Reports that information about the flaws had circulated ahead of the coordinated disclosure increased concerns about possible exploitation before organizations could complete patch deployment.
The security updates were released on October 21, 2026.
The accelerated response required hosting providers and server administrators to prioritize identifying vulnerable PHP installations and applying the newly available fixes.
The NSA’s official PHP2Shell advisory confirmed the October 21 patch release and urged organizations to prioritize systems relying on affected PHP versions.
Are Hackers Already Exploiting PHP2Shell?
Amazon Threat Intelligence reported an exploitation attempt against its MadPot honeypot network on October 17, 2026—four days before the vulnerabilities were publicly disclosed. Amazon said the attempt originated from an IP address associated with a commercial anonymization network.
Amazon also reported multiple proof-of-concept exploits appearing on October 21, the day PHP released its security updates.
These observations confirm at least one exploitation attempt, but do not establish a verified global count of successfully compromised websites.
As of October 22, 2026, the government sources reviewed for this article do not establish a verified global count of successful PHP2Shell compromises.
The NSA warned that malicious actors were likely to weaponize these vulnerabilities and recommended increased vigilance around internet-facing PHP services.
Its guidance includes enhanced logging, identifying vulnerable software, and promptly incorporating vendor security patches.
Organizations should investigate suspicious server activity while prioritizing remediation of exposed installations.
Network-level protections, including web application firewalls, may reduce exposure to certain exploit attempts, but they should not be treated as complete substitutes for updating PHP.
Where immediate patching is not possible, organizations should follow vendor guidance for temporary risk reduction. For CVE-2026-109619, disabling session.upload_progress.enabled has been reported as a partial mitigation for one known attack path. It does not replace installing the PHP security updates.
Has PHP2Shell Been Fixed?
Yes. Emergency PHP security updates addressing PHP2Shell were released on October 21, 2026.
However, systems running affected PHP installations may remain vulnerable until the appropriate updates have been installed and verified.
Which PHP Versions Are Vulnerable, and Which Versions Fix PHP2Shell?
The PHP project released fixes for its supported PHP branches:
| PHP branch | Vulnerable upstream releases | First fixed version |
| PHP 8.5 | Before 8.5.12 | 8.5.12 |
| PHP 8.4 | Before 8.4.27 | 8.4.27 |
| PHP 8.3 | Before 8.3.36 | 8.3.36 |
| PHP 8.2 | Before 8.2.35 | 8.2.35 |
PHP 8.1 and older branches have reached upstream end-of-life and do not receive direct fixes from the PHP project. Organizations using them should migrate to a supported release or confirm whether their operating-system or hosting vendor has issued a security backport.
Because vendors can backport security fixes without changing the upstream version number, the displayed PHP version alone may not establish whether an installation is vulnerable.
How Can Website Owners Check Whether They Are Still at Risk?
WordPress administrators can usually view the PHP version used by their website through:
WordPress Dashboard → Tools → Site Health → Info → Server
This provides a starting point for identifying an affected PHP installation.
Website owners should then contact their hosting provider or server administrator to confirm whether their active PHP runtime has received fixes for both CVE-2026-109618 and CVE-2026-109619.
The hosting provider should also verify that the relevant PHP processes and services are using the patched software.
WordPress security plugins and routine application updates cannot replace PHP runtime patches.
The NSA recommends temporarily taking affected systems offline when immediate updates are not feasible and appropriate mitigation cannot otherwise be completed.
For general guidance on maintaining WordPress software, see our WordPress security updates guide.
Website owners should also remember that patching PHP does not automatically remove malicious files, unauthorized administrator accounts, or backdoors installed during a previous compromise.
Where there is credible evidence of an intrusion, the affected environment may require a separate security investigation.
What the PHP2Shell Discovery Means for Website Security
The PHP2Shell discovery demonstrates how serious vulnerabilities in widely deployed software can create risks across numerous websites and applications.
AI-assisted research contributed to identifying the flaws, while emergency security updates provided a path to remediation.
For website owners, the immediate priorities are verifying PHP patch status, applying available vendor fixes, and investigating credible signs of compromise.
Concerned Your WordPress Website May Have Been Compromised?
At WP Hacked Help, we assist website owners with investigating suspicious activity, identifying malicious files, removing backdoors, and recovering compromised WordPress installations.
If your website shows signs of compromise following the PHP2Shell disclosure, our WordPress security team can help investigate and clean up an existing infection.
PHP runtime patching should also be completed through your hosting provider or server administrator.
Frequently Asked Questions
1. Who Is Responsible for Fixing PHP2Shell on a Hosted Website?
The hosting provider typically manages PHP security patches on shared or managed hosting. VPS and dedicated-server owners may be responsible for updates unless their hosting agreement includes server maintenance.
2. How Can I Tell Whether PHP2Shell Has Already Compromised My Website?
A PHP2Shell compromise may leave suspicious server logs, unexpected PHP files, unauthorized accounts, or unusual processes. These signs warrant investigation but do not independently confirm exploitation.
3. Can PHP2Shell Expose Customer Data or Website Credentials?
Successful PHP2Shell exploitation may allow attackers to access sensitive information available to the compromised PHP process, including website credentials, application files, or customer data.
4. Does a WordPress Malware Scanner Detect PHP2Shell Exploitation?
A WordPress malware scanner may identify malicious files or backdoors resulting from an attack, but it cannot reliably establish PHP2Shell exploitation or confirm that the server’s PHP runtime is patched.
5. Is Restoring a Website Backup Enough After a PHP2Shell Attack?
No. Restoring a backup does not fix a vulnerable PHP runtime. Administrators should patch PHP, verify the backup is clean, remove attacker persistence, and rotate compromised credentials before restoring normal operations.