PHP2Shell: The AI-Found PHP Flaws That Threaten Millions of Websites — A WordPress Owner’s Action Guide
Two critical PHP flaws (CVE-2026-109618, CVE-2026-109619) found with frontier AI models can let attackers take over WordPress sites without logging in. Patches are out — here is what to check and do now.



