The makers of PHP, the scripting language behind a huge share of the world’s websites, have disclosed two critical security vulnerabilities that let attackers run their own code on unpatched servers — without needing to log in. The flaws, discovered with the help of frontier AI models and nicknamed PHP2Shell, were disclosed on Wednesday, October 21, 2026, and emergency patches are available now. Website owners are being told to update immediately.
Both flaws are rated CVSS 9.2 (critical) by the PHP project and allow unauthenticated remote code execution — the most dangerous class of web vulnerability. Every PHP version released in the last decade, back to version 5.4, is affected by at least one of the flaws, according to researchers at Wiz, the cloud-security company that co-discovered them. (The PHP project itself states that “all PHP installations serving web requests” are at risk, without naming an earliest version.)
What are the two flaws?
The PHP security advisory tracks the flaws as CVE-2026-109618 (“RCE via OOM corruption”) and CVE-2026-109619 (“RCE via stale global state”). In simple terms, both are memory-safety bugs in PHP’s core engine: under certain conditions, PHP’s cleanup routines can be tricked into treating corrupted or already-freed memory as valid — letting an attacker hijack the server process with a single crafted web request.
At greatest risk, the PHP project says, are setups running PHP as mod_php under Apache: researchers demonstrated an exploit where “an unauthenticated request can trigger the attack before any application code runs.” Installations using PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are also affected.
Wiz combined the bugs into a single exploit script it named “php2shell” — and demonstrated working unauthenticated attacks against WordPress, Drupal and Joomla sites. The crucial point: the flaws live in PHP itself, so the attacks do not depend on any bug in the website software.
Found by AI — and AI will accelerate attacks
The flaws had existed in PHP’s code for decades, Wiz says, but proving they were exploitable required “an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve.” Frontier AI models broke through that barrier: Wiz researchers used their own Wiz Atlas system plus Gemini 4 Argon and GPT-5.6 Sol, with Gemini 4 Argon making what the team calls “an invaluable contribution” to finding the bugs, building the exploit, detecting attacks and validating the patch.
The discovery was coordinated before disclosure with the PHP team, Cloudflare, OpenAI and Quarkslab. And the same AI capability cuts both ways: once patches are released, researchers warn, attackers can use frontier models to analyse the fix and build working exploits far faster than before. Security firm Sansec expected “mass attacks to start within 15 minutes of the release,” and Cloudflare reported seeing early attack traffic even before the public disclosure.
A “Heartbleed moment”?
Volker Dusch, a security engineer with the nonprofit foundation that manages the PHP project, called PHP2Shell “the most severe security issue that PHP has faced in more than a decade,” likening it to Heartbleed — the 2014 OpenSSL bug that forced a global race to protect hundreds of thousands of servers, in comments to the Wall Street Journal. Wiz drew the same parallel: “PHP2Shell could mark a similar turning point for the AI era.”
One caveat on the headline number: the “up to 70% of the world’s websites” figure comes from the Journal and from Wiz’s framing of PHP’s market share — it is not a figure published by the PHP project itself. It reflects how deeply PHP is embedded in the web, from blogs to e-commerce.
What should you do?
The PHP project is blunt: there are no complete mitigations — updating is the only safe choice. The fixed releases are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Versions 8.1 and older no longer receive official releases; the PHP team provided minimal source backports for 7.4, 8.0 and 8.1 for administrators who cannot upgrade immediately. The UK’s National Cyber Security Centre has also urged administrators to update.
The coordinated disclosure was originally planned for Thursday, October 22 — but details leaked on October 20, forcing the PHP project to pull the patches forward to Wednesday (releasing slightly ahead of its announced 14:00 UTC time). Whether widespread exploitation is already underway is still unclear: Cloudflare observed early attack traffic, while other firms including watchTowr and Huntress said they had not yet seen confirmed in-the-wild attacks as of Wednesday morning. Either way, the window between patch and exploit is measured in hours, not days.
If you run a website — especially on WordPress — contact your host or server administrator today and confirm you are on a patched PHP version.
Frequently asked questions
Is “PHP2Shell” the official name of the vulnerability?
No. “PHP2Shell” is a nickname coined by researchers — Wiz named its combined proof-of-concept exploit “php2shell” — and popularised by media coverage. The PHP project itself refers to the flaws by their CVE numbers.
Which PHP versions are affected?
Researchers at Wiz say every version since 5.4 is affected by at least one flaw; the PHP project says all installations serving web requests are at risk. Patches exist for the 8.2–8.5 lines; older versions need backports or upgrades.
Is my WordPress site at risk?
Yes, if the server running it uses an unpatched PHP. The flaw is in PHP itself, not WordPress — so even a fully updated WordPress install can be compromised through the underlying server. Ask your hosting provider which PHP version is installed.
Has PHP2Shell been exploited in the wild?
Cloudflare reported early attack traffic before public disclosure, but other security firms said they had not observed confirmed exploitation as of October 21. The situation is developing; assume unpatched servers are targets.
Sources
- The PHP Project — Security advisory: Critical remote code execution vulnerabilities, update now (php.net, 21 Oct 2026)
- Wiz Research — PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet (wiz.io, 21 Oct 2026)
- The Wall Street Journal — AI Just Found a Bug That Puts Up to 70% of the World’s Websites at Risk (21 Oct 2026)
- Cloudflare — PHP vulnerabilities WAF protection (blog.cloudflare.com, 21 Oct 2026)
- UK National Cyber Security Centre — Critical security issue affecting PHP (ncsc.gov.uk, 21 Oct 2026)
- Sansec — PHP2Shell research (sansec.io)
- BleepingComputer — PHP ships emergency patches for critical PHP2Shell flaws (21 Oct 2026)
Photo: NOIRLab/NSF/AURA/T. Slovinský via Wikimedia Commons (CC BY 4.0).
