PHP2Shell is the name for two critical flaws in PHP, the language behind WordPress and a large share of the web, disclosed on 21 October 2026. Tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 out of 10, they can let an attacker run code on a server without logging in. The fix is simple: update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or ask your host to confirm they have.
We are iklipse, a creative and marketing agency working across the GCC, Egypt, North Africa and the US. We build and look after websites for brands, and most marketing teams we meet have never been told what their site runs on. This week is a good week to find out.
Here is what was found and who found it.
The PHP security team published its advisory on 21 October, a day after warning that a critical release was coming. It lists two bugs. The first, CVE-2026-109618, is a remote code execution flaw triggered when PHP runs out of memory partway through handling a request. The second, CVE-2026-109619, comes from stale state that one request can leave behind for the next request on the same worker. Both are rated 9.2 on the CVSS v4.0 scale.
Researchers at Wiz, Calif and OpenAI are credited with the discovery, according to BleepingComputer. Wiz says nearly every PHP version going back to 5.4 carries at least one of the bugs, and that it built working proof-of-concept attacks against the standard container images of WordPress, Drupal and Joomla.
The PHP team says the risk is highest on servers using Apache with mod_php, where a demonstrated exploit fires before any of the website's own code runs. Other common setups, including PHP-FPM, php-cgi, FrankenPHP and LiteSpeed, are also affected, BleepingComputer reports.
AI helped find these bugs, and that changes the clock for everyone.
Wiz says it used its own tools alongside AI models from Google and OpenAI, and that the AI mainly cut the effort needed to chain bugs together and adapt exploits to different PHP versions and server setups. Its first bug was found on 19 August 2026, about two months before the patch.
The lesson for brand owners is about speed. Finding a serious hole in software as old and widely read as PHP used to take rare skill and a lot of time. With AI doing the slow parts, defenders find more, and so can attackers. The window between a bug becoming public and someone trying it on your site keeps getting shorter.
That window has already closed this time. Cloudflare's chief technology officer said the company saw early attacks against both flaws before the patches shipped, and the UK's National Cyber Security Centre told organisations to update immediately or take affected systems offline, both according to BleepingComputer.
Your brand website is probably in scope.
WordPress runs 39.6% of all websites, according to W3Techs data from 24 October 2026, and it runs on PHP. So do Drupal, Joomla, Magento and countless custom builds. If your site has a WordPress login page, a contact form plugin or a WooCommerce shop, PHP is underneath it.
We want to be careful here. A flaw in PHP does not mean your site has been hacked, and many managed hosts patch their servers within hours. The risk sits with sites on older PHP versions, sites on cheap shared hosting nobody checks, and campaign microsites built years ago and left running.
Here is a checklist a marketing team can run this week.
- List every site you own. Main site, country sites, microsites, landing pages. Old ones count most.
- Ask your host or developer one question in writing: which PHP version does each site run, and is it 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later? Get a yes or a date.
- Plan an upgrade for anything on PHP 8.1 or older. The PHP project no longer updates those versions. Some hosts and Linux vendors backport fixes, so ask, and treat "we don't know" as a no.
- Switch off what you no longer need. A microsite for a campaign that ended in 2023 is a risk with no upside. Archive it as a static page or take it down.
- Keep the firewall on. Services such as Cloudflare added temporary rules for PHP2Shell. They help while you patch. The PHP team is clear that only the update is a complete fix.
- Watch the signs. Wiz suggests looking for repeated server errors, unusually large session cookies and odd upload requests. If your analytics or uptime tool shows a sudden run of errors, tell your developer.
- Update WordPress, themes and plugins too. PHP2Shell is a server problem, and plugin updates will not fix it, but a patched server running a five-year-old plugin is still an open door.
Security belongs in the website plan, along with speed and SEO.
A hacked site is a brand problem before it is a technical one. Search engines can flag it, ad platforms can reject traffic to it, and customers who see a warning page rarely come back. When we build and run sites as part of digital marketing and SEO work, the hosting, PHP version and update routine go into the plan from day one, next to page speed and tracking.
If you are not sure what your sites run on, or you have a pile of campaign microsites nobody owns any more, talk to us. We can audit them, patch or retire them, and set up a simple routine so the next PHP advisory takes an afternoon.
Frequently asked questions about PHP2Shell.
What is PHP2Shell?
It is the nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, disclosed on 21 October 2026. They can allow unauthenticated remote code execution on servers running PHP.
Which PHP versions fix PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Versions 8.1 and older no longer receive official updates, so plan an upgrade.
Is my WordPress site affected?
WordPress runs on PHP, so it depends on the PHP version on your server. Ask your host to confirm the patched version is installed. Updating WordPress alone does not fix this.
Are there workarounds if I cannot update today?
The PHP team lists settings that reduce exposure, such as disabling session upload progress and adjusting memory and upload limits, and web firewalls have added rules. None of these make a server safe on their own. Updating PHP is the only complete fix.
Sources: PHP.net security advisory, Wiz Research, BleepingComputer, Help Net Security, W3Techs. Cover image: PHP logo by Colin Viebrock, via Wikimedia Commons (public domain).
