PHP2Shell Explained: AI-Discovered PHP Flaws Put WordPress & Millions of Websites at Risk

A newly disclosed security issue called PHP2Shell has put website owners, hosting providers and security teams on alert.

The issue involves two critical vulnerabilities in PHP:

CVE-2026-109618

and:

CVE-2026-109619

The PHP project released emergency security updates on October 21, 2026 after researchers demonstrated that affected PHP installations could potentially allow an unauthenticated attacker to execute code remotely.

That matters because PHP is the technology behind a huge portion of the modern web and powers platforms including:

• WordPress;
• Drupal;
• Joomla;
• MediaWiki; and
• countless custom websites and web applications.

Security company Wiz says its researchers demonstrated PHP2Shell-related impact against WordPress, Drupal and Joomla environments.

But this is not fundamentally a WordPress plugin vulnerability.

The problem exists inside PHP itself.

That means even a WordPress installation with fully updated plugins, themes and WordPress core can still require action if the underlying server is running an affected PHP version.

The most important advice from the PHP development team is simple:

update PHP immediately.

Here is what PHP2Shell is, which PHP versions are affected, why artificial intelligence played such an important role in its discovery, and what WordPress and other website owners should do now.

What Is PHP2Shell?

PHP2Shell is the name being used for a group of critical security problems discovered in the PHP runtime.

The two primary vulnerabilities disclosed on October 21 are:

CVE-2026-109618

and:

CVE-2026-109619.

Both can potentially lead to:

remote code execution, or RCE.

Remote code execution is one of the most serious classes of software vulnerability because it can potentially allow an attacker to make a vulnerable server execute unauthorized code.

The PHP security team classifies the issues as critical.

Affected systems can potentially be targeted remotely without the attacker first having to log in.

That is why the PHP team issued emergency security releases rather than waiting for an ordinary maintenance update.

Is PHP2Shell a WordPress Vulnerability?

Not exactly.

This distinction is important.

PHP2Shell is:

a PHP vulnerability

rather than:

a vulnerability in WordPress core.

WordPress.org specifically says that no WordPress core update is required or planned to address these vulnerabilities.

Instead, the PHP software used by the web server must be updated.

WordPress itself is written primarily in PHP.

So if a WordPress site is hosted on a server using an affected PHP release, the underlying environment may need to be patched even if:

• WordPress is current;
• every plugin is current;
• every theme is current; and
• there are no known vulnerabilities in the site’s own code.

That is one reason PHP2Shell has attracted so much attention.

Which PHP Versions Are Affected?

The PHP project’s October 21 security releases identify these minimum patched versions:

PHP branch	Patched version
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35

If your server is running an earlier version within one of these branches, you should update.

Examples:

8.5.11 → update to 8.5.12 or newer

8.4.26 → update to 8.4.27 or newer

8.3.35 → update to 8.3.36 or newer

8.2.34 → update to 8.2.35 or newer

The PHP project says there are no complete mitigations that substitute for updating.

That makes patching the priority.

What if Your Website Uses PHP 8.1, 8.0 or 7.4?

This is potentially more complicated.

WordPress.org notes that PHP versions earlier than:

PHP 8.2

no longer receive regular security updates directly from the PHP project.

Some hosting vendors, operating-system distributions and control-panel providers may backport security fixes to older versions.

That means seeing an old version number does not always prove that a hosting provider has failed to apply a vendor security patch.

However, website owners should not assume they are protected.

If your website uses PHP 8.1 or older, ask your hosting provider:

“Is my PHP build protected against CVE-2026-109618 and CVE-2026-109619?”

For a long-term solution, moving to a currently supported PHP branch is generally preferable when your website software is compatible.

How to Check Your PHP Version in WordPress

WordPress makes it relatively easy to check which PHP version your website is using.

From the WordPress dashboard, go to:

Tools → Site Health → Info → Server

Look for:

PHP version

You can compare that number with the patched versions listed above.

For example:

If you see:

PHP 8.3.35

you should update to at least:

PHP 8.3.36.

If you see:

PHP 8.4.27

you have the release containing the original October 21 PHP2Shell fixes for that PHP branch.

However, remember that your hosting company may maintain customized builds or security backports.

When in doubt, ask your host to confirm your server’s specific patch status.

How to Check PHP From Your Hosting Account

Many hosting providers also show PHP information inside the hosting control panel.

Common locations include sections named:

• PHP Manager;
• PHP Selector;
• MultiPHP Manager;
• Server Information;
• Software;
• Developer Tools;
• Website Settings.

The exact wording depends on your host.

Do not change the PHP version blindly on a production website without checking compatibility first.

A major PHP upgrade can cause problems with outdated plugins, themes or custom code.

A safer process is usually:

1. Back up the website.
2. Confirm plugin and theme compatibility.
3. Test the new PHP version where possible.
4. Update the PHP runtime.
5. Check the website.
6. Check forms, checkout pages, logins and other important functionality.
7. Review server and application logs for errors.

If your hosting provider manages PHP automatically, contact the provider rather than attempting a server-level change yourself.

Is Updating WordPress Enough?

No.

Updating WordPress is good security practice, but it does not by itself fix PHP2Shell.

Likewise, updating:

• plugins;
• themes;
• security plugins;
• WordPress core;

does not replace updating the affected PHP runtime.

This is because the vulnerable code exists below the WordPress application layer.

WordPress.org explicitly tells website owners to check with their host and update PHP as soon as possible.

How Serious Is PHP2Shell?

Very serious.

The vulnerabilities received critical severity ratings.

Researchers demonstrated scenarios involving:

• unauthenticated remote code execution;
• memory exposure;
• unauthorized access to sensitive process data; and
• potential server compromise.

Sensitive process memory can potentially include information such as:

• authentication tokens;
• passwords;
• API credentials;
• certificates;
• application secrets.

That does not mean every vulnerable website has been hacked.

There is an important difference between:

vulnerable

and:

compromised.

A server running an affected PHP version may have been exposed to the vulnerability.

That alone does not prove someone successfully exploited it.

Does an Old PHP Version Mean My Website Was Hacked?

No.

An affected version indicates potential exposure.

It is not evidence of a successful attack.

To determine whether a website was actually compromised, administrators may need to review:

• web-server logs;
• PHP logs;
• authentication logs;
• file changes;
• administrative accounts;
• scheduled tasks;
• hosting-provider security alerts;
• WAF events;
• unusual outbound connections;
• unexpected processes.

If you have reason to believe your site was compromised, consider involving your hosting provider or a qualified incident-response professional.

Do not rely only on a WordPress malware scanner to determine whether a server-level PHP vulnerability was exploited.

How Did AI Help Discover PHP2Shell?

This is one of the most important parts of the story.

Wiz says the underlying weaknesses had existed in PHP for years.

The challenge was turning complicated memory-safety problems into practical demonstrations of exploitability.

According to Wiz, frontier AI models dramatically reduced the amount of specialist work needed to:

• analyze the vulnerabilities;
• debug failures;
• adapt research across PHP environments;
• validate exploitability;
• test fixes.

Wiz says its research used several AI systems, including:

Gemini 4 Argon

and:

GPT-5.6 Sol.

The researchers describe PHP2Shell as an example of how artificial intelligence can change vulnerability research.

Historically, an extremely complicated memory-corruption flaw could be technically present but very difficult to turn into a working exploit.

AI can potentially reduce that complexity barrier.

That is important for defenders—but also concerning because similar capabilities could eventually help attackers adapt exploits faster.

AI Is Changing Cybersecurity Economics

PHP2Shell illustrates a broader shift.

AI systems can increasingly:

• inspect large codebases;
• find suspicious patterns;
• reason about program behavior;
• automate testing;
• debug failures;
• help reproduce security problems;
• verify patches.

In defensive security research, those capabilities can help teams discover vulnerabilities before attackers do.

But the same general improvement in AI reasoning and tool use also changes the threat environment.

As AI becomes increasingly capable of taking multi-step actions with tools, cybersecurity teams need to plan for a world where both attackers and defenders can automate more of their work.

Elite Era Trends explains this broader shift in our guide to What Is Agentic AI?

Internal link: What Is Agentic AI? How It Works, Examples & AI Agents vs Generative AI

Could AI Agents Hack Websites Automatically?

AI can increasingly assist with security research and automate parts of complicated workflows.

But headlines claiming AI can simply “hack any website automatically” should be treated cautiously.

Real-world security depends on:

• software versions;
• server configuration;
• permissions;
• security controls;
• network architecture;
• WAF protection;
• patch levels;
• the specific vulnerability.

PHP2Shell is significant precisely because researchers demonstrated that AI substantially reduced the effort needed to understand and adapt a difficult vulnerability.

That does not make every website automatically vulnerable to every AI system.

The practical lesson is that organizations may have less time between:

vulnerability discovery

and:

large-scale attack attempts.

Were Attackers Already Targeting PHP2Shell?

Cloudflare says it observed attack traffic targeting the vulnerabilities around the public disclosure period.

The company deployed web-application firewall protections before the full public disclosure and says its customers using applicable WAF protections were protected against known PHP2Shell attack patterns.

This reinforces an important security principle:

patching and network-level protection should work together.

A WAF can provide valuable protection while administrators update systems.

But a WAF should not be treated as a permanent substitute for patching the underlying PHP installation.

Does Cloudflare Protect Against PHP2Shell?

Cloudflare says it deployed PHP2Shell WAF protections for its customers.

That can provide an important additional security layer.

However, Cloudflare itself still recommends administrators update PHP.

The safest model is:

patched PHP + WAF + monitoring + backups

rather than relying on only one security control.

Website owners using other hosting or CDN providers should ask whether comparable protections have been deployed.

Are WordPress.com Sites Affected?

Automattic says websites hosted on its managed infrastructure were protected against the two original PHP2Shell vulnerabilities.

Automattic specifically listed platforms including:

• WordPress.com;
• WordPress VIP;
• WP Cloud;
• Pressable;
• Tumblr;
• other Automattic infrastructure.

That does not mean every self-hosted WordPress website is automatically protected.

If you run WordPress through another hosting provider, confirm the host’s PHP patch status.

Important October 23 Update: A Related PHP Issue

There is another development website owners should watch.

On October 23, Cloudflare updated its PHP2Shell guidance with information about:

CVE-2026-115560.

Cloudflare says the related issue involves PHP’s session upload-progress functionality and can affect even the October 21 patched releases, including PHP 8.5.12.

Cloudflare says its existing WAF protection covers known exploitation attempts when PHP’s default upload-progress field name is used.

A PHP follow-up fix is expected through a subsequent regular release.

This does not mean website owners should avoid installing the October 21 patches.

You should still immediately protect against:

CVE-2026-109618

and:

CVE-2026-109619.

Instead, treat the newer advisory as another reason to:

• keep PHP updated;
• monitor security announcements;
• keep WAF protection enabled;
• follow instructions from your host or PHP vendor.

Because this story is developing quickly, website owners should check the latest PHP and hosting-provider advisories rather than assuming one update permanently resolves every related issue.

What Should WordPress Website Owners Do Now?

Here is a practical defensive checklist.

1. Check Your PHP Version

Go to:

Tools → Site Health → Info → Server

and note the PHP version.

2. Compare It With Patched Releases

For the original PHP2Shell vulnerabilities, minimum patched releases are:

8.5.12

8.4.27

8.3.36

8.2.35

3. Contact Your Host

If you cannot confirm your patch level, ask your hosting provider directly whether your server is protected against:

CVE-2026-109618

and:

CVE-2026-109619.

Also ask whether any additional action is recommended regarding newer PHP advisories.

4. Back Up Your Website

Maintain a recent off-site backup of:

• website files;
• databases;
• configuration;
• other important data.

A backup should not exist only on the same server it is protecting.

5. Keep Your WAF Enabled

If your provider or CDN offers web-application firewall protections, keep them enabled.

Do not disable emergency security rules simply because your site appears to be functioning normally.

6. Update WordPress Too

PHP2Shell itself requires a PHP fix, but ordinary WordPress security still matters.

Keep:

• WordPress core;
• plugins;
• themes;

updated.

7. Remove Software You Do Not Use

Delete abandoned or unnecessary:

• plugins;
• themes;
• test applications;
• old staging sites;
• unused administrative tools.

Every unnecessary component increases your attack surface.

8. Review Administrator Accounts

Check for unexpected WordPress administrator users.

Remove accounts that:

• no longer belong to employees;
• belong to former contractors;
• are unknown;
• are no longer needed.

9. Use Multi-Factor Authentication

Require MFA wherever practical for:

• WordPress administrators;
• hosting accounts;
• domain registrars;
• CDN accounts;
• cloud infrastructure;
• email accounts.

10. Monitor for Further PHP Updates

PHP2Shell is an evolving incident.

Do not assume that installing one patch means you never need to check the issue again.

Monitor:

• PHP security announcements;
• your hosting company;
• your CDN/WAF provider;
• WordPress.org security notices.

What You Should Not Do

Do not download random PHP2Shell exploit scripts and run them against your production website.

Even when your intention is defensive, exploit code can:

• crash systems;
• damage data;
• trigger security controls;
• violate hosting agreements;
• create legal problems if tested against systems you do not own.

For most website owners, confirming the PHP version and receiving patch confirmation from the hosting provider is safer than trying to exploit the vulnerability yourself.

Professional penetration testing should be done only on systems where clear authorization exists.

How to Ask Your Hosting Provider About PHP2Shell

If you are unsure what to ask, use a message like this:

“Please confirm whether the PHP environment hosting my website has been patched against CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), and whether you recommend any additional action for the newer related PHP security advisories.”

Ask the host to confirm:

• the PHP branch;
• whether security fixes were installed;
• whether a vendor backport is being used;
• whether WAF protections are active;
• whether a PHP restart is required.

Does Using a Security Plugin Protect WordPress?

A WordPress security plugin can still be valuable.

Depending on the product, it may help with:

• malware scanning;
• login protection;
• file-change detection;
• firewall rules;
• brute-force protection;
• account monitoring.

But a WordPress plugin runs at the application layer.

PHP2Shell affects the underlying PHP runtime.

Therefore:

a security plugin does not replace the PHP security update.

Use application security as one layer—not the only layer.

Does Changing Your WordPress Password Fix PHP2Shell?

No.

Changing passwords does not patch the vulnerability.

However, if you have evidence that a site was actually compromised, rotating credentials may become part of incident response.

That can include:

• WordPress administrator passwords;
• hosting credentials;
• database passwords;
• API keys;
• application secrets;
• SSH credentials.

Do not rotate secrets blindly while leaving a compromised server uncontrolled.

If compromise is suspected, first preserve evidence and follow an incident-response plan.

PHP2Shell vs. Log4Shell: Are They the Same?

No.

They are different vulnerabilities affecting different technologies.

However, the names are being compared because both issues highlight the risks created when a vulnerability exists deep inside software used by a large number of systems.

Log4Shell affected the widely used Log4j Java logging library.

PHP2Shell affects PHP itself.

The common lesson is that a vulnerability in foundational infrastructure can create widespread exposure even when website owners did nothing obviously wrong.

Why PHP2Shell Matters Beyond WordPress

The larger story is not only about PHP.

PHP2Shell demonstrates what may become a defining cybersecurity problem of the AI era:

AI can make technically difficult security research faster and more accessible.

That benefits defenders.

Researchers can potentially:

• identify hidden vulnerabilities earlier;
• evaluate large codebases;
• build better security tests;
• validate fixes faster.

But it may also shrink the window organizations have to patch before attackers adapt public research into real-world campaigns.

This creates a new requirement:

patch faster, monitor continuously and assume that complicated vulnerabilities may become practical sooner than they once did.

Our broader guide to AI agents for small businesses explains how AI systems increasingly connect reasoning with external tools and multi-step workflows.

Internal link: AI Agents for Small Business: 15 Practical Uses in 2026

And our ChatGPT Chrome Extension guide discusses why granting AI systems browser and tool access requires careful permissions and human oversight.

Internal link: ChatGPT Chrome Extension 2026: Open Tabs, Side Chat & Browser Control

Frequently Asked Questions

What is PHP2Shell?

PHP2Shell is the name used for critical PHP security vulnerabilities disclosed in October 2026 that can potentially allow unauthenticated remote code execution and sensitive memory exposure.

What are the PHP2Shell CVE numbers?

The two main vulnerabilities are:

CVE-2026-109618

and:

CVE-2026-109619.

Is WordPress vulnerable to PHP2Shell?

PHP2Shell exists in PHP rather than WordPress itself. A WordPress website running on an affected PHP environment can therefore potentially be exposed.

Do I need to update WordPress?

You should always keep WordPress updated, but PHP2Shell specifically requires patching the underlying PHP runtime. WordPress.org says no WordPress core update is required specifically for these PHP vulnerabilities.

What PHP versions fix PHP2Shell?

For the October 21 vulnerabilities, the PHP project released:

PHP 8.5.12

PHP 8.4.27

PHP 8.3.36

PHP 8.2.35

or newer releases within those branches.

How do I check my PHP version in WordPress?

Go to:

Tools → Site Health → Info → Server

and look for your PHP version.

Does an affected PHP version mean my website was hacked?

No. Vulnerability does not equal confirmed compromise. It means the environment may have been exposed and should be patched.

Does Cloudflare protect against PHP2Shell?

Cloudflare says it deployed WAF protections against known PHP2Shell attack techniques. Website owners should still update PHP because a WAF is not a substitute for patching.

Does a WordPress security plugin fix PHP2Shell?

No. The issue is in PHP itself. WordPress security plugins can provide additional protection but do not replace the server-level PHP update.

Was PHP2Shell discovered using AI?

Wiz says frontier AI models played a significant role in the research, exploitability analysis, testing and validation process.

Did ChatGPT discover PHP2Shell?

It would be inaccurate to attribute the discovery to ChatGPT alone. Wiz says multiple AI systems and human security researchers were involved, including Gemini 4 Argon and GPT-5.6 Sol.

Can AI hack websites automatically now?

AI can increasingly automate portions of security research and attack workflows, but whether a website can be compromised depends on the actual vulnerability, software, configuration, permissions and security controls.

Should I run a PHP2Shell exploit against my own site?

Most website owners should not. Confirm the installed PHP version and patch status with your hosting provider instead. Exploit testing should be performed only in properly authorized and controlled environments.

PHP2Shell is one of the most important website-security stories of 2026.

The two primary vulnerabilities:

CVE-2026-109618

and:

CVE-2026-109619

affect the PHP runtime and can potentially enable unauthenticated remote code execution.

For the October 21 fixes, PHP website owners should use at least:

PHP 8.5.12

PHP 8.4.27

PHP 8.3.36

or:

PHP 8.2.35

depending on the branch.

WordPress users can check their PHP version through:

Tools → Site Health → Info → Server.

If you do not manage PHP yourself, contact your hosting company and ask them to confirm that your server is protected.

Most importantly:

do not assume that updating WordPress plugins alone fixes PHP2Shell.

The patch has to reach the PHP environment underneath the website.

PHP2Shell also illustrates something bigger.

AI is changing cybersecurity.

The same technology helping defenders find deeply hidden software flaws can potentially reduce the time and specialist expertise required to understand and adapt attacks.

For website owners, that means patching quickly, maintaining backups, using layered security and following trusted security advisories are becoming more important—not less.