On October 21, 2026, the PHP project shipped an emergency security release that affects practically every WordPress site on the internet. Two critical vulnerabilities — CVE-2026-109618 and CVE-2026-109619, collectively nicknamed PHP2Shell — can let an attacker run code on your server without logging in, and they were found with the help of frontier AI models. If you run WordPress, this is not a plugin problem you can wait out. It is a flaw in the language underneath WordPress, and updating WordPress itself will not protect you. Here is what happened, why it is different from a normal security scare, and exactly what to do.

What happened, and why everyone is patching at once

According to the PHP project’s official security advisory, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two memory-safety vulnerabilities in PHP’s core engine, both rated CVSS v4.0 9.2 — critical. The disclosure had a messy start: the CVE numbers and partial details leaked online on October 20, a day before the planned release, forcing the PHP security team to move the coordinated disclosure forward. That is why patches, warnings from security firms, and reports of scanning activity all arrived within hours of each other — the usual orderly patch window collapsed.

The scale is what makes this one stand out. The PHP project says every installation that serves web requests is at risk — PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed — and it considers the risk highest on servers running Apache with mod_php, where a demonstrated exploit can fire “before any application code runs.” Security researchers demonstrated working takeovers against current WordPress, Drupal and Joomla installs. Independent scans reported that only about a third of the PHP servers whose versions could be identified were running a branch covered by the security update, with PHP 7.4 — long past end of life — still the most commonly seen version. One estimate put roughly 69% of identifiable internet-facing PHP servers on versions that will never receive an official fix.

The two flaws, in plain language

You do not need a computer science degree to understand the shape of this bug — and understanding it matters, because it explains why the usual defenses fall short.

• CVE-2026-109618 — remote code execution via out-of-memory corruption. PHP has long reacted to running out of memory by aborting its work abruptly. The flaw is that this abort can happen while PHP is halfway through setting up a request’s internal data — for example while parsing an upload — and the cleanup that follows can then treat that half-built data as if it were valid. An attacker who can trigger the memory failure can corrupt PHP’s internals.
• CVE-2026-109619 — remote code execution via stale global state. Under certain error conditions, PHP keeps references to internal state whose backing memory has already been freed when the request ends. A later request handled by the same worker process can then reuse that stale state before normal initialization resets it — leaking sensitive data from the server’s memory or corrupting it into an exploit.

Security researchers emphasize a crucial point: even without a full takeover, these bugs can expose server memory holding passwords, authentication tokens, API keys and certificates. And because the flaws live in the PHP runtime itself — not in WordPress, a theme, a plugin, or your own code — the attack surface is anything that speaks HTTP to PHP. WordPress.org has confirmed that no WordPress update is required or planned for this issue: the fix is the PHP update alone.

Why PHP2Shell is different from a typical plugin vulnerability

Most WordPress compromises start with something you can control: an outdated plugin, a weak password, a misconfigured server. PHP2Shell needs none of those. A fully updated WordPress install on an unpatched PHP is still exposed. That inversion of the usual responsibility model is the uncomfortable part — site owners did everything right at the application layer and still need to act.

Three properties make it unusually serious:

1. It sits below your application. The exploit can run before WordPress code loads, particularly under mod_php. Your security plugins, your firewall rules inside WordPress, and your login hardening are all downstream of the bug.
2. It is ancient. The vulnerable code paths trace back years — researchers say the flaws affect every PHP release back to 5.4, which shipped in 2012. A decade-old bug class hiding in the engine of a large share of the web is why several firms have compared the response to the patching mobilizations of past internet-wide incidents.
3. There is no complete workaround. PHP’s advisory is explicit: partial mitigations exist for specific attack paths, but updating is the only safe choice. Configuration tweaks buy exposure reduction, not safety.

The AI angle: found by frontier models, in days instead of months

What makes PHP2Shell a landmark moment for the industry is not just the bug but how it was found. Wiz Research — which coined the PHP2Shell name — says it used its Wiz Atlas autonomous research tool alongside Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. Separately, the security firm Calif found the same class of flaw using GPT-5.6 Sol under OpenAI’s Patch the Planet program, the coordinated-disclosure initiative OpenAI runs with the security community. Wiz describes the work as an inflection point: a single researcher, guided by frontier models, completed in about a week what might once have taken a team of specialists months — including adapting working exploits across multiple applications in hours.

That is a genuinely two-sided development. The same capability that let defenders find and patch a decade-old engine bug before (they hope) attackers did also lowers the cost of building attacks once details circulate. It is worth remembering that the CVE details leaked before the patch was ready, and within a day multiple firms reported seeing exploitation attempts and scanners probing for the flaws. The lesson for everyone else is the familiar one, sharpened: patching speed is now competing directly with machine-speed attack development.

For readers following the AI-security beat, this lands right next to the themes we covered in our recent piece on Microsoft’s AI agent security controls: the industry is simultaneously handing powerful agents to users and racing to contain what powerful agents can do.

What WordPress site owners should do right now

Work through this checklist today, not this week. Ordered by importance:

1. Find out your PHP version. In your WordPress dashboard, go to Tools → Site Health → Info → Server, and note the PHP version. That single number decides everything that follows.
2. Update PHP to a fixed release. The safe versions are PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, per the official advisory. On most shared or managed hosting you do not update PHP yourself — you change it in the hosting control panel (cPanel, Plesk, or your host’s dashboard) or you ask your host to apply it. Do this first, then confirm the version in Site Health actually changed.
3. Check whether you are on a branch that gets fixes at all. If Site Health says 8.1 or older, the PHP project will not ship you a fix — those branches are end of life. The project published minimal source backports for 7.4, 8.0 and 8.1 to help people building from source or working with LTS vendors, but the practical move for a site owner is to plan a PHP upgrade to 8.2 or newer with your host. Note that PHP 8.2 itself reaches end of life on December 31, 2026, so 8.3 or 8.4 is the better target. (WordPress 7.2, currently in beta, is moving the ecosystem forward — our WordPress 7.2 Beta 1 overview covers what to test, and PHP compatibility is one of the things worth checking.)
4. Back up before you switch versions. Jumping PHP branches can break older plugins or themes. Take a full backup first — files and database — and if your host offers a staging environment, test the PHP switch there.
5. If you manage the server yourself, update and restart everything. Install the patched PHP packages, then restart every PHP worker — PHP-FPM pools, Apache, or LiteSpeed processes. Stale worker processes keep the vulnerable code loaded, so an unrestarted worker stays exposed. Verify the running version through a real web request, not just the package manager.
6. Treat partial mitigations as exactly that — partial. PHP’s advisory lists exposure-reducing settings such as memory_limit=-1 set where applications cannot override it, smaller post_max_size values, and disabling session.upload_progress.enabled, followed by worker restarts. These blunt specific attack paths; they do not fix the bugs. Use them as a stopgap while you get the real update applied, and follow the advisory’s cautions — for instance, hiding diagnostics with error_reporting or @ does not help.
7. Assume your credentials may have been exposed if your site was unpatched during the window. Because one impact class is server-memory disclosure, rotate critical secrets as a precaution once patched: WordPress salts in wp-config.php, database passwords, hosting/API keys stored on the server, and admin passwords. Turn on two-factor authentication if you have not.

Which PHP version is safe? A quick reference

FAQ

Will updating WordPress, my theme, or my plugins fix this?

No. The flaw is in the PHP runtime underneath all of them. Keep everything updated as usual, but the fix that matters here is the PHP version your server runs.

I am on managed or shared hosting. Am I already safe?

Possibly — many managed hosts applied emergency patches on October 21. But verify: check Tools → Site Health → Info → Server and confirm the PHP version is at or above the fixed releases listed above. Do not assume.

Does a web application firewall or Cloudflare protect me?

WAF rules can blunt some attack shapes, and Cloudflare reported seeing early attack attempts — but PHP’s own advisory is clear that only updating is a complete fix. A firewall is a speed bump here, not a solution.

How do I know the patch actually took?

After your host applies the update, the PHP version shown in Site Health must read 8.5.12+, 8.4.27+, 8.3.36+ or 8.2.35+. On self-managed servers, also confirm the workers were restarted, since a stale process keeps serving with the vulnerable build.

What if my host cannot or will not update PHP?

That is a serious signal about the host. Ask specifically about LTS vendor backports for your PHP branch — reputable providers had these ready. If neither an update nor a backport is available, moving the site to a host that maintains its PHP stack is the honest answer; an unpatched server on the open internet is a liability.

Was my site already hacked?

There is no single way to know from outside. After patching, look for unfamiliar admin users, unknown files or plugins, unexpected scheduled tasks, and outbound traffic spikes. If anything looks wrong, treat it as a compromise: restore from a known-clean backup, rotate all secrets, and get professional help.

The bigger picture

PHP2Shell will be studied less as a PHP story than as an AI story. A decade-old memory-safety flaw in one of the web’s foundational languages was found and weaponized by researchers directing frontier models — and the same models are now in the hands of attackers scanning the internet for unpatched servers. The patch race that followed, compressed into a single day by a leak, is the new normal: vulnerability research is accelerating on both sides of the line.

For site owners, though, the takeaway is refreshingly old-fashioned: know your stack, keep the layers under your application updated, and verify rather than assume. Check your PHP version today. The tools you need are already in your WordPress dashboard and your hosting panel — including the free utilities on WebReOn Tools for day-to-day site work — and the whole job, for most shared-hosting users, is a version switch and a confirmation. The internet’s worst week of 2026 for PHP is only dangerous for the people who sit it out.