On October 21, 2026, the PHP Foundation released emergency patches for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS score 9.2). They allow remote code execution on a server with no account or authentication required. The problem is in PHP itself: millions of sites are affected, including WordPress.
What happened
- August 19–24: According to Recorded Future, Wiz Research discovers the first flaw using AI-assisted tools, confirms remote code execution against Drupal then WordPress, and privately reports everything to the PHP team on August 24. PHP acknowledges receipt on September 21.
- October 20: The PHP Foundation announces an out-of-cycle security update for the following day at 4 p.m. (Paris time), covering two flaws rated 9.2 out of 10. Technical details leak on Hacker News, and security firm watchTowr says it reproduced one of the flaws.
- October 21, 4:29 a.m.: An archive containing information about the flaws is uploaded to VirusTotal.
- October 21, around 9:30 a.m.: Patchstack receives several active exploitation reports from partner hosting providers (9:34 a.m.). Cloudflare also observes attacks (from 9:43 a.m.) and protects all its customers with firewall rules, including the free tier, as a temporary measure.
- October 21, 3:52 p.m.: PHP releases patched versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, slightly ahead of the announced time.
- Throughout the day: At the request of ANSSI, the French Ministry of the Interior takes all its sites into preventive maintenance. Government agencies in other European countries do the same. The NSA and CERT-EU advise taking offline any sites that cannot be patched immediately.
Proof-of-concept exploits are circulating on GitHub, but their reliability varies: some rely on assumptions that their authors have since invalidated. According to Recorded Future, by the end of October 21, public information did not allow the full extent of successful compromises to be assessed.
Why this is serious
PHP powers roughly 70% of websites whose server technology is known: WordPress, Drupal, Joomla, Magento, Laravel, and many custom applications.
The flaws are not in a plugin or a CMS. They are in the PHP engine itself. Updating WordPress or your application is therefore not enough: it is the version of PHP installed on the server, or provided by your host, that must be patched. Even a very simple site may be vulnerable.
The mechanism, simply explained
When a request causes PHP to crash (out of memory, fatal error), the engine does not finish its cleanup. The next request can then reuse a memory area that the attacker filled themselves. No account or user click is required.
Once the server is compromised, an attacker can read configuration files, steal database credentials, modify data, install a backdoor, or pivot to the rest of the network. Wiz researchers also demonstrated that passwords, tokens and API keys present in memory could be read without even executing code. The affected code dates back to PHP 5.4 : over ten years ago.
How many servers are exposed?
Two independent internet scans give an order of magnitude. They do not count actually vulnerable servers and do not measure the same thing : their figures cannot be added together.
| Scan | What is counted | Total | Unsupported branches |
|---|---|---|---|
| Modat | PHP services displaying a readable version, seen in the 10 days before October 20 | 4.38 million services, across 1.89 million hosts | ~79% of services with a readable version; PHP 7.4 alone: 878,761 services |
| VirusTotal | IP addresses running PHP on October 21, version displayed or not | ~5.1 million IPs, of which 1.1 million display their version | ~758,000 IPs (branches 5.4 to 8.1), vs 272,000 on a supported branch |
Two takeaways. First, the bulk of exposed PHP runs on end-of-life branches that will receive no official patch: PHP 7.4, discontinued in 2022, accounts for more than any supported branch on its own. Second, roughly four out of five servers do not reveal their version, so scans miss a large portion of the exposed surface.
A compromise can also extend beyond the web server: among the PHP hosts identified by VirusTotal, around 394,000 also expose SSH, 233,000 MySQL, and 68,000 remote desktop (RDP).
The role of AI
These flaws went undetected for over ten years. It was the latest generation of AI models that made it possible to find them. According to sources, the companies Calif and Wiz reported them to the PHP team in August, relying in particular on OpenAI's GPT-5.6 Sol model. Wiz also indicates having used Gemini 4 Argon.
The important point is not the discovery, but the exploitation. Turning these bugs into a working attack requires chaining several flaws, then adapting the exploit to each version of PHP and each configuration. This used to take a team of experts months. Wiz claims that a single researcher, assisted by AI, did it in a week, and that adapting to a new target now takes hours.
The window between a vulnerability disclosure and the first attacks is shrinking. This time, attacks were observed before the patch was even released. The same tools also help defenders find and fix flaws before attackers do.
What to do
- 1.Inventory your PHP versions: every site, server, old project, subdomain and admin interface. PHP often hides behind CMS platforms or third-party software that do not mention it.
- 2.Install a patched version: PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or your Linux distribution's or hosting provider's patched package (its version number may differ).
- 3.Restart PHP processes (PHP-FPM, Apache with mod_php, persistent services), otherwise the old version remains active in memory.
- 4.Look for signs of intrusion, going back before the patch was released: attacks were reported from the morning of October 21, and exploitation happens below the application layer. From October 20 onwards, look for unusual web requests, PHP process crashes, unexpected commands, modified files, and new admin accounts. If you find a compromise, launch an incident response and rotate all credentials that may have been exposed. The patch does not clean an already-compromised server.
PHP 8.1 and older
These branches no longer receive regular official updates. PHP has released minimal patches for branches 7.4, 8.0 and 8.1, and some distributors offer adapted patches. Ask your hosting provider for confirmation, then plan a migration to a supported branch.
If you cannot update right away, temporary measures reduce the risk: disable session.upload_progress in your PHP configuration, block multipart/form-data requests at the web server or application firewall level, and limit request sizes.
- None of these measures fully fixes the flaws. Only the update does.
- Blocking multipart breaks file uploads and media additions in WordPress.
- A CMS's maintenance mode does not protect: PHP processes the request before the application.
For a site that can neither be patched nor protected, both CERT-FR and CERT-EU consider taking it offline temporarily.
What about a WordPress site on shared hosting?
On shared hosting, you do not control the server: it is the hosting provider that applies the PHP engine patch. Your role is to verify that it has been done.
- Check the PHP version used by your site in your hosting provider's control panel, and select the most recent branch compatible with your theme and plugins.
- Follow your hosting provider's communications on PHP2Shell and request written confirmation if nothing is published.
- Keep WordPress, your theme and your plugins up to date, but don't rely on this: it does not replace the PHP patch.
- Make a full backup before any version change, and test the site afterwards.
While waiting for their own updates, some shared hosting providers are relying on temporary protections such as CloudLinux's Imunify360.
PHP2Shell is a reminder of a simple truth: the most dangerous vulnerabilities don't always come from sophisticated attacks. They were dormant in ten-year-old code, found in a matter of weeks by a researcher with AI assistance. Patching is the only real answer. Temporary measures, firewalls and maintenance modes buy time, not security.