PHP2Shell Explained: AI Just Found a Bug That Puts 70% of Websites at Risk

Here’s the short version: researchers used AI to find a flaw in PHP — the language that quietly runs about 70% of the web — and it lets an attacker take over a server without a single password. The bug is called PHP2Shell, it scores a scary 9.2 out of 10 on the severity scale, and PHP has already shipped emergency patches.

If your site runs on WordPress, Drupal, Joomla, Laravel, or basically anything that touches PHP, read this, then go update your server. Like, today.

What is PHP2Shell?

PHP2Shell is the name given to a pair of critical vulnerabilities sitting inside PHP itself — not in WordPress, not in some dodgy plugin, but in the core engine.

• CVE-2026-109618 — a memory-corruption bug triggered by how PHP handles running out of memory
• CVE-2026-109619 — a “stale global state” issue that lets data leak across requests

Both carry a CVSS v4.0 score of 9.2 — about as close to “drop everything and patch” as it gets. The name is a nod to the classic “webshell,” the tool attackers drop onto a server to run commands. PHP2Shell effectively hands them the keys without the login part.

Who found it?

This is where the story gets interesting. The bugs were found by a joint effort from:

• Wiz Research (Sagi Tzadik, Shir Tamari, Nir Ohfeld, Tomer Schwartz)
• OpenAI Codex Security (Amy Burnett)
• Calif (Ryan A.)

Yes — an AI model helped hunt down a vulnerability that affects nearly three-quarters of the web. That’s the part people will be talking about. Depending on how you feel about AI, it’s either exciting or slightly terrifying.

Why this one is different

Most PHP vulnerabilities live in a specific app or plugin. You patch WordPress and move on. PHP2Shell doesn’t work that way — the flaw is in the PHP runtime itself, so even a plain “Hello World” page on a vulnerable server can be attacked. Your own code being bulletproof doesn’t save you.

Here’s what an attacker can do:

• Run commands on your server without any authentication
• Read the server’s memory — passwords, API keys, auth tokens, even SSL certificates belonging to other people’s requests
• Steal data via memory disclosure without even getting code execution first (which makes it sneaky — security tools look for malicious code, not quiet memory reads)

The researchers proved it by taking over fresh WordPress, Drupal, and Joomla installs using their latest official container images. Not old versions — the current ones.

Who’s actually at risk?

Short answer: basically everyone running PHP. Every PHP setup that serves web requests is in the blast radius, including:

• PHP-FPM
• Apache mod_php (the worst — a working exploit fires before your app code even runs)
• php-cgi
• FrankenPHP
• LiteSpeed

And it goes deep: the flaws affect nearly every PHP version back to PHP 5.4. In India, where a huge chunk of blogs, small businesses, and even enterprise sites run on WordPress over shared hosting, that’s a lot of servers quietly running on borrowed time.

How to fix it

There’s exactly one real fix: update the PHP runtime on your server. Not your theme, not your plugins — the PHP version itself.

PHP branch	Fix it with
8.5	8.5.12
8.4	8.4.27
8.3	8.3.36
8.2	8.2.35

A few things worth knowing:

• PHP 8.1 and older no longer get official updates. The team published source backports for 7.4, 8.0, and 8.1 if you’re stuck building from source or waiting on a vendor.
• PHP 8.2 hits end-of-life on December 31, 2026 — if you’re still on it, this is your sign to move.
• Updating WordPress or Laravel does not update PHP underneath it. That comes from your host, your server package, or your container image.
• After updating, restart Apache, PHP-FPM, and any long-running PHP workers. A patched version still running old processes does you no good.
• Linux distro packages may carry the fix under an older-looking version number — check the changelog for the CVE, not the version string.

If you can’t update right now

PHP-FPM has a small silver lining: it shuts a worker down when a request fails early in setup, which makes full exploitation harder (though not impossible). Apache mod_php is the highest risk, so if you’re on mod_php and can’t patch, temporarily switching to FPM buys you time while you sort things out. But realistically? Patch. That’s the move.

The bigger picture

PHP2Shell landed fast because details leaked a day early — the patch shipped October 21, 2026 at 14:00 UTC, right before a planned October 22 disclosure. The PHP team moved quickly, and that’s genuinely good. But with exploit attempts already emerging, the window for everyone else is shrinking.

Then there’s the AI angle that’s going to dominate the conversation: the same technology people worry about is now being used to find and patch holes before the bad guys do. PHP2Shell might be the first big proof of that — but it won’t be the last.

PHP2Shell: FAQs

What is PHP2Shell in simple terms?

It’s a critical security flaw in PHP that lets an attacker run commands on a web server without any password or account. It got its name because it works like a webshell — but without the login step.

Does PHP2Shell affect WordPress sites?

Yes. WordPress runs on PHP, and the flaw is in PHP itself, so any WordPress site on a vulnerable PHP version is exposed — regardless of which plugins or themes it uses.

What’s the severity of PHP2Shell?

Both underlying flaws (CVE-2026-109618 and CVE-2026-109619) carry a CVSS v4.0 score of 9.2, which is classified as critical.

How do I fix PHP2Shell?

Update your server’s PHP runtime to a patched version (8.5.12, 8.4.27, 8.3.36, or 8.2.35), then restart Apache/PHP-FPM and any PHP workers.

Who discovered PHP2Shell?

The vulnerabilities were found by researchers at Wiz, OpenAI Codex Security, and Calif, with AI assistance playing a key role in the discovery.

What happens if I don’t patch?

Attackers can take full control of your server, steal passwords and API keys from memory, or quietly read sensitive data — and exploit attempts have already started.

So — is your site on a patched PHP version yet? Check your host and drop a comment if anything’s unclear.