On October 21, 2026, the PHP project released emergency fixes for two critical flaws that researchers nicknamed the PHP2Shell vulnerability. Both let an attacker run code on a web server without logging in, and both sit inside PHP itself rather than in a single plugin or theme. Wiz estimates PHP powers about 70 percent of websites, WordPress among them. AI models helped find the bugs, some European government sites went offline, and Wikimedia pulled several systems as a precaution. The only complete fix is a PHP version update, and the person responsible for your server needs to apply it. Here is the PHP vulnerability explained, along with the steps to take next.
What Is the PHP2Shell Vulnerability?
PHP2Shell is the label for two bugs, CVE-2026-109618 and CVE-2026-109619. Both score 9.2 out of 10 on the CVSS v4.0 severity scale.
Both involve what happens when PHP hits trouble mid-request, such as running out of memory. It stops processing, but its internal state doesn’t always get cleaned up. The first bug corrupts memory after an out-of-memory error. The second leaves stale request data behind when a worker is reused for the next visitor.
Researchers demonstrated remote code execution, file reads, crashes and leaks of server memory, which can hold passwords and API keys. With Apache’s mod_php, a single unauthenticated request can trigger the attack before your site’s own code even runs.
The risk is real. PHP’s official security announcement urges immediate updates, Amazon’s honeypot network logged an exploit attempt on October 17, and watchTowr reports attacks in the wild.
How Did OpenAI Help Discover the PHP Security Flaws?
According to OpenAI, the security firm Calif used the GPT-5.6 Sol model to identify a critical flaw during an audit funded through OpenAI’s Patch the Planet initiative. Wiz independently found and reported both bugs. OpenAI then led a two-month coalition of maintainers and security providers while the PHP team built the fixes.
The root cause had surfaced before. The PHP Foundation says a first warning sign appeared during a 2024 external audit, but nobody could turn it into a working exploit. In August 2026, researchers found a path to remote code execution.
Wiz said frontier models let one researcher finish in a week what once took a skilled team months. OpenAI calls the head start a “Defender’s Window” and admits the same capability can help attackers write exploits. This time the window ran short, because details leaked and PHP moved its release up by a day.
Why Were Wikipedia and Other Services Affected?
Wikipedia runs on MediaWiki, software written in PHP. The Wikimedia Foundation told Newsweek the issue affects all known PHP versions and is not specific to Wikimedia. Every system it supports, plus the volunteer-run ones that use PHP, is exposed, and the Foundation took a number of systems down as a precaution until they could be patched. You can read the Wikimedia incident update for their own wording.
Wikimedia wasn’t alone. Reuters reported that government websites in the Netherlands and Finland went offline, and local administrations in France disconnected sites as well.
Using PHP isn’t the problem. Running an unpatched version of it on an internet-facing server is.
Which Versions of PHP Are Affected?
The flaws reach back to PHP 5.4 and run through 8.5.11. Fixed releases are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Older branches get less help. PHP supplied minimal source backports for 7.4, 8.0 and 8.1, which no longer receive regular releases, and distributions such as Ubuntu have pushed patched packages. If your provider offers no backport, upgrade to a supported release. PHP 8.2 reaches end of life on December 31, 2026, so a newer branch is the better long-term target.
Every setup serving web requests is in scope, including PHP-FPM, Apache with mod_php and LiteSpeed. PHP states that no configuration tweak fully closes the hole. Cloudflare’s firewall rules buy time, but the patch removes the flaw.
How Can Website Owners Protect Their Websites?
Solid PHP website security starts with a short routine. Work through this list in order:
- Check the current PHP version: Open your hosting control panel or ask your host. Running php -v over SSH only reports the command-line version, which can differ from the one your website uses.
- Install the applicable security patch: On shared hosting, switch to a fixed release in the panel or ask your provider to confirm it has patched. On a VPS, update through your package manager and restart PHP-FPM or Apache, since running processes keep the old code in memory. Sites on custom builds may need help from a website development service.
- Back up the website before updating: Copy files and database, and store the copy away from the server. Our guide to website maintenance explains how often to do this.
- Test plugins, themes, forms and key website functions: Old plugins sometimes break on a newer PHP branch. Submit a contact form, log in and run a test checkout.
- Review server logs and security alerts where appropriate: A patch doesn’t evict an attacker who already got in. Look for strange POST requests, unfamiliar files in upload folders and admin accounts you didn’t create. Rotate passwords and API keys if your host flags a memory leak risk. A technical SEO service can also catch injected spam pages and crawl errors in Search Console.
If you can’t patch right away, put the site in maintenance mode. The NSA and the Dutch NCSC both advise isolating exposed PHP applications.
Does This Vulnerability Affect WordPress Websites?
Yes, in a specific way. WordPress is built on PHP, and Automattic said researchers demonstrated attacks against current WordPress installs. Updating WordPress core, your theme or your plugins does not fix this problem, because the weakness lives in the server’s PHP runtime.
Hosting matters here. Automattic said WordPress.com, WordPress VIP, WP Cloud and Pressable sites were already protected, and those customers don’t need to act. A self-hosted site, or one on a third-party shared host, is different. Ask your provider which PHP version is live.
Good WordPress website security has always focused on plugins, passwords and logins. PHP2Shell shows the server layer deserves the same attention. Drupal, Joomla and Magento sit in the same position.
FAQs
What is the PHP2Shell vulnerability?
It’s the nickname for CVE-2026-109618 and CVE-2026-109619, two critical flaws in PHP’s engine. Attackers can use them to run code on a server without logging in. PHP released fixes on October 21, 2026.
Is my website at risk from the PHP security issue?
That depends on your PHP version and your host. Any site on PHP 5.4 through 8.5.11 without the fix is exposed. Managed WordPress platforms may have patched already, so confirm with your provider before assuming either way.
How do I check my website’s PHP version?
Your hosting panel lists it, usually under a PHP settings page. In WordPress, open Tools, then Site Health, then the Info tab and look under Server. Your host can also confirm it in writing.
Can a PHP update affect my website?
Occasionally. A patch-level move inside the same branch, such as 8.3.35 to 8.3.36, rarely causes trouble. Jumping to a newer branch is riskier because outdated plugins may stop working, so back up first and test afterward.
Who should update the PHP version of a website?
Whoever controls the server. On shared hosting that is the provider, though you may have a version selector in your panel. On a VPS or dedicated server, your developer or system administrator handles it. Owners should ask for confirmation once it’s done.
Conclusion
The PHP2Shell vulnerability is serious because it hits the engine under millions of sites, and the fix is a version update rather than a plugin tweak. Check your PHP version today, patch it, test your key pages and keep an eye on your logs. If you run an older branch, treat this PHP security update 2026 as the push to move to a supported release.
