PHP2Shell Explained: How AI Found the PHP Flaw Exposing 70% of Websites, and How to Patch Yours

If your website runs on WordPress, WooCommerce, Drupal, Joomla, Laravel or any other PHP software, it was probably exposed to a critical security flaw this week. On 21 October 2026 the PHP project shipped an emergency update for two vulnerabilities, now known as PHP2Shell, that can let an attacker take over a server without logging in. This guide explains what happened, how AI tools found the bug, and how to patch your site today.

What PHP2Shell actually is

PHP2Shell is the name for two flaws in the core PHP language itself, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated critical (CVSS v4 score 9.2).

• CVE-2026-109618 is a memory-corruption bug triggered when PHP runs out of memory while handling a crafted upload (multipart) request. It can also leak process memory, which may include passwords, session tokens and API keys.
• CVE-2026-109619 is a "use-after-free" bug, where PHP reuses leftover state from an earlier request. Paths involved include session upload progress, fatal-error backtraces and OPcache.

The key point is that the bug is in PHP, not in your plugin or theme. Wiz Research, one of the teams that found it, demonstrated remote code execution without authentication against WordPress, Drupal and Joomla. They also noted that even a simple "Hello World" page on an affected PHP version can be vulnerable. Every PHP release from version 5.4 onwards, covering more than a decade, is affected by at least one of the two flaws.

How AI found a bug that sat in PHP for 14 years

According to reporting by Fortune, the underlying weakness had existed in PHP for about 14 years, and a limited form of it was noticed in 2024 without being judged serious. AI changed that.

• 1 August 2026: Calif, a California-based AI red-teaming firm, found the first issue using OpenAI's GPT-5.6 Sol model, working under OpenAI's "Patch the Planet" initiative.
• 19 August 2026: Wiz Research independently found the vulnerability using Google's Gemini 4 Argon, GPT-5.6 Sol and its own Wiz Atlas tooling. Within two days the team confirmed working attacks against Drupal and WordPress.
• 24 August 2026: The findings were reported to the PHP security team, which began a coordinated fix in September.
• 20–21 October 2026: Details leaked early, so PHP moved its emergency release forward to 21 October.

What did the AI actually do? Memory bugs in a language runtime are buried deep in C code, and they behave differently on each PHP version, operating system and server setup. The models helped researchers reason through that code, and then helped turn a theoretical weakness into a working exploit. Wiz says the models also helped adapt the exploit to different PHP versions and memory layouts, detect attacks and validate the patch. The PHP Foundation has stressed that AI helped assess the reports, while humans made the decisions and wrote the fixes.

The uncomfortable lesson is that AI works for both sides. OpenAI called this "one of the most impactful security issues in recent memory." It also warned that the same capabilities can help attackers build exploits quickly.

Was 70% of the internet down?

No, and this distinction matters. The widely quoted "70%" figure is about exposure, not outage. Wiz notes that PHP powers roughly 70% of websites, so a flaw in PHP itself puts that share of the web at potential risk. WordPress alone runs about 40% of all websites.

There is no reliable figure for what percentage of the internet actually went offline. Here is what has been reported:

• Palo Alto Networks' initial analysis found about 22.6 million potentially vulnerable PHP instances online.
• Cloudflare reported tens of thousands of exploit attempts within 45 minutes of the news breaking, and millions by the evening of 21 October.
• Some government agencies in the Netherlands and Finland took websites offline as a precaution, and many operators briefly took sites down to patch.
• Amazon's threat intelligence team said the flaw is being broadly exploited, and it saw attempts as early as 17 October. Rapid7 said it had seen exploitation attempts but not yet confirmed successful in-the-wild attacks. Reports differ, so the safe assumption is that attackers are actively trying.

In short, a large share of the web was at risk, a much smaller number of sites went offline, and the real damage depends on how quickly owners patch.

Why this fix matters more than a routine update

Most security updates fix a bug in one plugin that only some sites use. PHP2Shell is different for three reasons:

• No login is needed. An attacker only has to send a crafted web request to your server.
• Full takeover is possible. Remote code execution means an attacker could read your database, steal customer data, install malware or use your server to attack others.
• There is no complete workaround. The PHP team, Wiz and Rapid7 all say that installing the patched release is the only full fix.

For a business, a breach of this kind is not just a technical problem. It can mean leaked customer records, payment pages being tampered with, a site blacklisted by Google, and regulatory obligations under India's Digital Personal Data Protection Act.

How to patch your website: a step-by-step checklist

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything older on those branches is vulnerable.

Step 1: Find your PHP version

• WordPress: go to Tools → Site Health → Info → Server.
• cPanel or Plesk hosting: look for "Select PHP Version" or "MultiPHP Manager".
• VPS or server access: run php -v. Your web server may use a different PHP-FPM binary than the command line, so check that too.

Step 2: Update based on how you host

• Managed or shared hosting: many hosts are patching automatically. Check your host's status page or ask support directly: "Is my account on PHP 8.x.y with the PHP2Shell fix?"
• Ubuntu, Debian, RHEL or similar: install your distribution's security update, then restart PHP-FPM and your web server. Distribution packages often backport fixes without changing the upstream version number, so confirm against your vendor's security notice rather than relying on php -v alone.
• Docker: rebuild your images from an updated PHP base image and redeploy. Restarting old containers is not enough.
• PHP 8.1 or older: these branches no longer get regular releases. Limited source backports exist for 7.4, 8.0 and 8.1, but the real answer is to upgrade to a supported version.

Step 3: Apply temporary hardening if you cannot patch today

These steps reduce risk but do not replace the update. They come from Rapid7's guidance:

• Set session.upload_progress.enabled=0 in php.ini or the FPM pool config. Setting it from application code is too late.
• Keep post_max_size modest (for example 8M) and set upload_max_filesize below it.
• On PHP 8.5, set fatal_error_backtraces=0.
• Turn on your CDN or WAF provider's PHP2Shell rule. Cloudflare, Fastly, Google and Vercel have all published mitigations.
• Restart all PHP workers after every change.

Step 4: Check for signs of compromise

Patching closes the door, but it does not remove anyone who already got in. Review logs for unusual multipart requests followed by memory errors or repeated HTTP 500 responses. Also look for oversized PHPSESSID cookies and unexplained PHP worker restarts. If you see suspicious activity, rotate database passwords, API keys and admin credentials.

Common mistakes while patching

• Updating WordPress or plugins and assuming you're safe. The bug is in PHP, so updating the CMS does not fix it.
• Forgetting to restart PHP-FPM, which leaves the old vulnerable process running.
• Patching production but not staging, test or old subdomains, which are often the easiest way in.
• Relying only on a firewall rule. WAF rules can be bypassed. They buy time, they are not a fix.

What this means for Indian businesses

A large share of small and mid-sized Indian business websites run on WordPress and WooCommerce on budget shared hosting. That is exactly the setup where the PHP version is easy to overlook. With festive-season sales underway, an online store is both at its busiest and at its most attractive to attackers. If an agency or freelancer built your site, contact them today and ask for written confirmation of the PHP version after patching.

Frequently asked questions

Is my site safe if it uses WordPress but not PHP?
WordPress always runs on PHP, so every self-hosted WordPress site needs the PHP update. Fully hosted WordPress.com plans are patched by the provider.

Will updating PHP break my website?
Moving to the patched release within the same branch (for example 8.3.x to 8.3.36) is a security fix and rarely breaks anything. Jumping from 7.4 to 8.x is a bigger change that should be tested on staging first.

Are sites built with React, Node.js or Python affected?
Not directly. PHP2Shell affects servers running PHP. However, many businesses also run a PHP blog or admin tool next to their main app, so check every server you own.

How do I know if I was hacked?
Look for the warning signs listed above, unknown admin users, modified files and unusual outbound traffic. If in doubt, get a security review.

Need help securing your site?

If you are not sure which PHP version your servers run, or you need help with patching, a hardened migration or a full security check, talk to the WebNest Studio team. You can also explore our development services.