PHP2Shell Vulnerability: What Happened, Who's at Risk, and How to Fix It

On October 21, 2026, parts of the internet switched themselves off on purpose. Government services in the Netherlands and Finland went dark, the Internet Archive briefly disappeared, and Wikimedia disabled some of its tools. Nobody had hacked them yet. Their operators just didn't want to find out what would happen if they stayed online.

The reason was the PHP2Shell vulnerability: two critical flaws in PHP, the language behind roughly 70% of websites with a known server-side language, including WordPress, Drupal and Joomla. What makes this one different from routine patch noise is how it surfaced. AI models helped researchers turn a weakness that had sat in PHP's engine for more than a decade into a working attack, in days rather than months.

In his Sky News report on the PHP crisis, technology correspondent Rowland Manthorpe asks the uncomfortable follow-up: if AI can do this for defenders, what happens when attackers have the same tools? This guide answers both halves. First, what PHP2Shell is and exactly what to do about it. Then, why security researchers think it's the start of something bigger.

If you only read one line, make it this: update PHP on your server, not your plugins. WordPress updates won't fix this.

What is the PHP2Shell vulnerability?

PHP2Shell is the name for two critical vulnerabilities in the PHP engine, CVE-2026-109618 and CVE-2026-109619, disclosed on October 21, 2026. Both are rated CVSS 9.2 and can let an unauthenticated attacker run code on a web server or read its memory. Because the flaw is in PHP itself, a fully updated WordPress site is still exposed until PHP is patched.

The fix is to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your Linux vendor's patched package) and restart every PHP worker.

PHP2Shell at a glance

What actually went wrong inside PHP

Both flaws share one root cause: PHP doesn't always clean up properly when a request crashes. If a request hits a fatal error, especially running out of memory, PHP can wipe that request's memory but leave internal pointers still aimed at it. The next request handled by the same worker process can then pick up that stale state and treat it as real.

Picture a restaurant where a waiter is pulled away mid-order. The table gets reset, but the old order ticket stays pinned in the kitchen. If the next customer can scribble on that ticket before anyone notices, the kitchen cooks whatever it says. In PHP2Shell, the attacker deliberately crashes a request, then fills the freed memory with their own data so PHP acts on it.

Here's how the two CVEs break down:

• CVE-2026-109618, RCE via out-of-memory corruption. If a request hits PHP's memory_limit at exactly the wrong moment, PHP can leave half-initialized data behind and later treat it as valid. On Apache with mod_php, PHP's advisory says remote code execution was demonstrated with default settings.
• CVE-2026-109619, RCE via stale global state. A fatal error can leave internal state pointing at memory that belonged to a previous request. A later request on the same worker then uses that freed memory, a classic use-after-free.

Wiz Research also showed a memory-leak variant that copies chunks of a worker's memory into a PHPSESSID cookie. It works even on sites that never start a PHP session. That memory can hold passwords, authentication tokens, API keys and certificates from other visitors' requests.

Why your own code can't protect you

This is the detail that changes your to-do list. According to Wiz, even a simple "Hello World" script on an affected PHP version can be vulnerable. Its researchers demonstrated unauthenticated code execution on the latest WordPress, Drupal and Joomla container images, not because those platforms were flawed, but because PHP underneath them was.

That's why WordPress has no update planned for this. Your theme, plugins and security plugin are irrelevant here; the only thing that matters is the PHP build on the server. Wiz described the findings as ranking "among the most severe vulnerabilities discovered in PHP, and arguably in software history."

How AI found a flaw that hid for more than a decade

The bug wasn't new. What changed in 2026 was the cost of proving it was dangerous.

The PHP Foundation says a core developer spotted the first signs of the out-of-memory problem back in 2024, while fixing an issue from PHP's first external security audit in years. An exploit was theorized, but nobody found a concrete path to remote code execution. Every proposed fix carried trade-offs, and the work stalled for months. The Foundation now calls that delay a structural failure, caused by its decision process and lack of resources.

Exploiting the flaw was the hard part. It meant chaining several bugs and adapting to each server's memory layout through repeated testing and debugging. Wiz says that work sat at the edge of what human researchers could practically do. With frontier models, its team built and adapted working exploits across multiple applications in hours. In Wiz's words, one researcher finished in a week what would previously have taken a world-class team months.

The models named publicly are OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon, alongside Wiz's own AI research tooling. Calif's audit ran under OpenAI's Patch the Planet program. One nuance most headlines skip: Cybernews reports that a human researcher at Calif identified the flaw, with AI speeding up the research. The more accurate story is that people aimed AI at a hard target, and AI made the hardest step, weaponizing it, cheap.

PHP2Shell discovery and disclosure timeline

How the disclosure went sideways

Coordinated disclosure is supposed to give defenders a head start. With PHP2Shell, that head start mostly evaporated in the final 48 hours.

The leak. Around 15:00 UTC on October 20, the two CVE IDs started circulating on forums and social media, with a wrong release time and a wrong 10.0 severity score. PHP responded by publishing its pre-announcement that evening and pulling the release forward from October 22 to October 21 at 14:00 UTC.

The video. After the pre-announcement, Calif mistakenly published a video showing its proof of concept working against several targets. It was deleted, but copies spread, and the PHP Foundation says it helped accelerate public exploit development.

The early patch. At 07:41 UTC on October 21, more than six hours before the coordinated release, Chainguard published built images containing the fix. That let anyone study the patch in binary form while most PHP users were still waiting.

The attackers were already moving. Amazon's security team logged an exploitation attempt against a decoy server on October 17, from an anonymized IP address. Amazon CISO CJ Moses has since said PHP2Shell is being broadly exploited in the wild, and urged teams to investigate activity back to October 17. Cloudflare CEO Matthew Prince described the escalation on X: thousands of attempts in the 10 hours before disclosure, tens of thousands in the first 45 minutes after, hundreds of thousands within two hours, and millions by that night.

Cloudflare's emergency firewall rules went live at 03:02 UTC on October 21 for every plan with its WAF, including Free, and it reported attackers changing payloads to slip past them. Agencies including the NSA, the FBI and CERT-EU told organizations to patch immediately or take unpatched systems offline. That advice is why so many sites went dark the same day.

The practical lesson: for a critical bug in widely used software, the gap between disclosure and mass exploitation is now measured in minutes.

Why so much of the web is still exposed

A patch existing and a patch being installed are two very different things. PHP2Shell lands on an ecosystem that is unusually slow to update, for reasons that have little to do with negligence.

Old versions are everywhere. By W3Techs' June 2026 figures, PHP ran on 70.8% of websites with a known server-side language, but PHP 8 on only 43.4%. Most of that gap is sites on PHP 7 and PHP 5, branches the PHP project stopped patching long ago. Even inside PHP 8, W3Techs' February 2026 data showed 8.1 and 8.0, both now unsupported, on about 31% of PHP 8 sites. Security firm CyCognito says that among exposed assets disclosing a PHP version, the large majority run an end-of-life branch.

No official fix for older branches. PHP 8.1 and older get no new release from the PHP project. Given the severity, its security team did publish minimal source backports for 7.4, 8.0 and 8.1, and Linux distributions and LTS vendors ship their own. But a small business on an old shared server rarely knows any of that exists.

The site owner often doesn't control PHP. On shared or managed hosting, the host decides when PHP updates. Many businesses had their site built by an agency or freelancer who has since moved on, and nobody inside the company knows which PHP version runs it, or who to ask.

Upgrades break things. Jumping from PHP 7.x to 8.x can break old themes, plugins and custom code. That fear is exactly why so many sites stay frozen, and why a two-minute patch on a modern stack becomes a two-week project on a legacy one.

There is good news for some. Automattic said sites on WordPress.com, WordPress VIP, WP Cloud and Pressable were already protected. If you're on a host like that, your main job is confirming it in writing.

Am I affected? How to check your PHP version properly

If your site runs on PHP and nobody has updated PHP since October 21, 2026, assume you're affected. Then confirm it using whichever method fits your setup:

1. WordPress dashboard. Go to Tools → Site Health → Info, then open the Server section. It shows the PHP version actually serving your site.
2. Hosting control panel. cPanel's MultiPHP Manager or Select PHP Version, and Plesk's PHP settings, show the version per domain.
3. Command line, with a catch. php -v reports the command-line PHP binary, which can differ from the PHP-FPM or mod_php build serving web traffic. Check the FPM binary directly, or load a temporary phpinfo() page and delete it immediately afterwards.
4. Linux distribution packages. Ubuntu, Debian and Red Hat often backport security fixes without changing the upstream version number. A distro build can show an older-looking number and still be patched, so check your vendor's security notice rather than comparing against 8.3.36.
5. Containers. Check which base image your PHP containers use, then rebuild from a patched image and redeploy. A running container doesn't update itself.

What your version means

How to fix PHP2Shell: a step-by-step plan

Updating PHP is the only complete fix. PHP's own release notes say there are no complete mitigations; everything else just buys you time.

1. Update PHP to a fixed release. Install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution's patched package. On managed hosting, ask your host which version you're on and when it was patched, and get the answer in writing.
2. Restart every PHP worker. Restart PHP-FPM pools, Apache (for mod_php) and LiteSpeed. Workers that started before the update keep running the vulnerable code until they're replaced.
3. Handle older branches deliberately. On PHP 8.1 or older, use your vendor's backport or the PHP project's source patches for 7.4, 8.0 and 8.1. Treat that as a stopgap and plan an upgrade. PHP 8.2 itself reaches end of life on December 31, 2026, so if you're upgrading anyway, aim for 8.4 or 8.5.
4. Apply temporary mitigations if you can't update today. PHP's advisory lists configuration changes that block specific attack paths (shown below). They reduce exposure; they don't make the server safe.
5. Keep a web application firewall in front. Cloudflare and other providers shipped PHP2Shell rules. A WAF only filters traffic routed through it, though, so make sure your origin server doesn't accept direct connections that bypass it.
6. Leave session upload progress off for now. On October 23, PHP advised setting session.upload_progress.enabled=0 until its next regular bugfix release, to close an unlikely extra code-execution path. If you already set it, keep it.
7. Look for signs you were hit, back to October 17. Wiz suggests watching for unusual multipart requests followed by memory-limit errors or repeated HTTP 500s, oversized or malformed PHPSESSID cookies, and unexplained PHP worker churn. Also check for new admin users and unfamiliar PHP files in upload folders.
8. Rotate secrets if you were exposed. Because PHP2Shell can leak process memory, change database passwords, API keys, payment gateway credentials and, on WordPress, the security keys and salts in wp-config.php.

Temporary mitigations from PHP's advisory

Set these in php.ini or the FPM pool configuration, then restart every worker. Changes made with ini_set() or a .user.ini file don't count, because they apply too late in the request.

; Temporary PHP2Shell mitigations. These are NOT a fix.

; CVE-2026-109619: blocks the confirmed session upload-progress path
session.upload_progress.enabled = 0

; CVE-2026-109618: keep request bodies small
; 8M if your site has no file uploads, 32M if it needs them
post_max_size = 8M

; CVE-2026-109618: remove the controllable memory-limit failure.
; Set this as php_admin_value[memory_limit] = -1 in the FPM pool
; so applications can't put a limit back.

; PHP 8.5 only: blocks the confirmed fatal-backtrace path
fatal_error_backtraces = 0

Removing the memory limit means one runaway request could exhaust the server, so PHP recommends a container or cgroup memory limit as the safety boundary. Don't substitute RLIMIT_AS or RLIMIT_DATA, which PHP warns can trigger the vulnerable failure. Full details are in the official PHP security advisory.

If you'd rather not touch the server yourself, our WordPress development team works on exactly this kind of stack.

Taking your site offline to patch? Use a 503 to protect your rankings

If you take your site down to patch PHP, make the server return HTTP 503 Service Unavailable, not a 404 and not a maintenance page that returns 200. Google Search Central posted exactly this reminder on LinkedIn on October 21, a few hours after the patches shipped, opening with "Don't forget the 503!"

The status code decides what Google does with your pages while you work:

A few practical rules keep the damage close to zero:

• Keep it short. Google's guidance on pausing a website suggests a 503 for an urgent outage of a day or two. Longer than that, keep a limited but indexable version of the site online.
• Add a Retry-After header so crawlers know roughly when to come back.
• Don't return a 503 for robots.txt. Google says that blocks all crawling of the site.
• Check Search Console afterwards. The Crawl Stats report shows host status and response codes. Expect crawling to ramp back up gradually rather than instantly.

This is the part of PHP2Shell most security write-ups ignore, and it's where security and SEO meet. If an emergency patch window dented your indexing, a technical SEO audit will show which URLs dropped and why.

Why PHP2Shell could be just the beginning

The Sky News report's central point is that AI is getting dramatically better at finding critical software flaws, and that capability won't stay with defenders forever. The evidence from the past week backs that up.

Discovery is accelerating. Mother Jones cites Epoch AI data showing major vendors and open-source projects once reported a couple of dozen critical vulnerabilities a month; a typical month now sees around 600. OpenAI said the PHP flaws were among several significant vulnerabilities it has found and expects similar findings to rise sharply. A day after PHP2Shell, attention had already moved to Node.js, which shipped fixes for 10 vulnerabilities on October 21.

Fixing is the bottleneck, not finding. The PHP security team has published 15 CVEs since July 1 and worked through more than 100 reports that proved invalid, duplicated or unreproducible. AI can find a bug in hours. Deciding how to fix a decade-old design choice without breaking millions of sites still takes a small number of experienced engineers, and the PHP Foundation says there are too few of them. OpenAI president Greg Brockman has argued the current process is too slow and manual for what's coming.

Attackers are already using AI. In the same week, The Information reported that hackers largely automated attacks on 400 Latin American financial institutions using commercial AI models. Microsoft separately disclosed a China-aligned group running AI-driven attacks with an open-source platform, according to Fortune.

Closed-weight vs open-weight models: why the clock matters

The most capable models today are closed-weight. Their makers control access, keep safeguards in place and give the strongest cyber capabilities to vetted defenders first, through programs like OpenAI's Daybreak and Anthropic's Project Glasswing. That is roughly how PHP2Shell was found and fixed before details went public.

Open-weight models are different. Anyone can download them, and their safeguards can be stripped out. Experts quoted by Mother Jones say they have consistently trailed the best closed models by about 6 to 12 months. The worry is simple: what only well-resourced defenders can do today, any attacker may be able to do within a year.

That turns patching from a hygiene task into a race. Wiz frames PHP2Shell alongside Heartbleed in 2014 and Log4Shell in 2021: incidents that changed how the industry thinks about shared infrastructure. Its argument is that when AI makes complex exploits cheap, complexity stops being a meaningful defense. Bugs once filed as too hard to exploit become live targets.

What website owners should take away from PHP2Shell

The sites that got through October 21 calmly weren't the ones with the fanciest security tools. They were the ones where someone already knew what was running and who was responsible for updating it.

• Your server software is part of your website. Most owners track their domain renewal and ignore their PHP version. PHP2Shell shows the version on the server matters more than anything in the dashboard.
• Keep a simple inventory. For every site: the host, the PHP version, who has server access, and who patches it. If that list takes you more than ten minutes to write, that's your first fix.
• Put patch times in writing. Your hosting or maintenance agreement should say how fast critical security updates get applied. "As soon as possible" isn't a number.
• Retire end-of-life versions on a schedule. PHP 8.2 loses security support on December 31, 2026. Sites stuck on PHP 5 or 7 often can't be upgraded in place and need a rebuild; our website redesign and migration services exist for exactly that situation.
• Treat a WAF as a seatbelt, not the brakes. Cloudflare's rules helped on day one, but attackers were already tweaking payloads to get past them. Only the patch closes the hole.
• Shrink your attack surface. Fewer plugins, fewer exposed admin paths and fewer forgotten staging sites mean fewer places for the next bug to land.

A word on going headless: moving your front end off WordPress reduces what's exposed, and our comparison of WordPress vs headless CMS walks through the trade-offs. But a headless WordPress back end still runs PHP. It helps most when that back end is kept off the public internet, not as a substitute for patching.

Frequently asked questions

What is PHP2Shell in simple terms?

PHP2Shell is a pair of critical bugs in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619. They let an attacker crash a request in a specific way, then reuse the leftover memory to run code on the server or read sensitive data. They affect PHP 5.4 through 8.5.

Is WordPress affected by PHP2Shell?

Yes, any self-hosted WordPress site running on an unpatched PHP version is exposed. WordPress has no update planned because the flaw is in PHP, not WordPress. Automattic said sites on WordPress.com, WordPress VIP, WP Cloud and Pressable were already protected.

Which PHP versions fix PHP2Shell?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix both vulnerabilities. Linux distributions ship their own patched packages, which may keep an older-looking version number. PHP 8.1 and older need a vendor backport, the PHP project's source patches, or an upgrade.

Do I need to update my WordPress plugins or theme?

Not for PHP2Shell. The vulnerability lives in the PHP engine, so plugin and theme updates don't touch it. Keeping them updated is still good practice, but only a PHP update closes this hole.

Was PHP2Shell found by AI?

It was found by human researchers at Calif, OpenAI and Wiz who used AI models heavily, including OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon. AI's biggest contribution was turning a long-known, hard-to-exploit weakness into working exploits in hours instead of months.

Am I safe if my site is behind Cloudflare?

Safer, not safe. Cloudflare deployed PHP2Shell firewall rules on all WAF plans, including Free, but attackers were already modifying payloads to evade them. Traffic that reaches your server directly also bypasses the WAF entirely. Patch PHP regardless.

Will taking my website offline to patch hurt my SEO?

A short outage won't, if your server returns a 503 status code. Google keeps indexed pages during temporary 5xx errors but removes pages that return 404. Keep the downtime to a day or two and add a Retry-After header.

Should I change my passwords after PHP2Shell?

If your site ran unpatched PHP while exposed to the internet after October 17, 2026, yes. PHP2Shell can leak server memory, which may contain passwords, tokens and API keys. Rotate database credentials, API keys and, on WordPress, your security keys and salts.

Is PHP still safe to use?

Yes, a patched and supported PHP version is as safe as any mainstream web language. The real risk is unpatched and end-of-life versions. The PHP Foundation has expanded its security team in 2026 and is asking companies that depend on PHP to help fund that work.

The bottom line

The PHP2Shell vulnerability is serious, but the fix is not complicated: update PHP, restart its workers, check your logs back to October 17, and rotate secrets if you were exposed. The sites at real risk are the ones nobody is watching, running old PHP on servers whose owners don't know they exist.

The bigger story is what PHP2Shell signals. AI just made a decade-old, "too hard to exploit" bug practical to weaponize, and researchers expect many more findings like it. The organizations that cope will be the ones that treat patching as a routine, fast process rather than an occasional emergency.

Not sure which PHP version your site runs, or who's responsible for updating it? Get a free website audit from KodRank. We'll check your stack, flag anything end-of-life, and help you plan patch windows that don't cost you rankings.

— Written by

Hidayatul Haq

Founder, KodRank · SEO Strategist

Hidayat is the founder and CEO of KodRank and a top-rated SEO strategist who has delivered 150+ projects across the globe— spanning technical audits, crawl-budget recovery, on-page optimization, and full-scale organic growth programs for founders, agencies, and in-house teams.