Last Updated: October 22, 2026
Hackers are already trying to exploit PHP2Shell, two critical flaws in PHP, the programming language behind roughly 70% of websites, including those built on WordPress. The PHP project released emergency fixes on October 21. The US National Security Agency (NSA) has told organizations to install them immediately or take affected systems offline until they can.
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and both are rated 9.2 out of 10 for severity.
What is PHP2Shell?
Both bugs allow unauthenticated remote code execution. In plain terms, an attacker can run their own code on a web server without logging in or needing a password.
According to the PHP project’s advisory:
- CVE-2026-109618 is a memory-handling bug. When PHP runs out of memory partway through a request, it can leave internal data half-built and then treat it as valid during cleanup.
- CVE-2026-109619 involves leftover data from a previous request. Memory that should have been cleared can be reused by the next request the same worker handles.
The NSA warns that flaws like these often give attackers a direct path into a server’s files or databases. That could mean stolen customer data, defaced pages or malware planted on a site.
Are hackers exploiting it?
Yes, attempts have started. Security firm watchTowr said on October 21 that it is seeing active exploitation attempts against both flaws. Cloudflare also reported early attack attempts before the patch went out. So far, no successful break-in at a specific company has been publicly confirmed.
The disclosure was rushed. Details leaked online on October 20, a day before the planned announcement, which forced PHP to move its emergency release forward.
Which PHP versions are affected?
Almost every PHP version from 5.4 onward is affected. These versions contain the fixes:
| PHP branch | Update to |
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
PHP 8.1 and older no longer get official updates. The PHP security team has published basic source code fixes for 7.4, 8.0, and 8.1, but only for people who build PHP themselves. If you run PHP 5 or 7, the safest move is to upgrade to a supported PHP 8 version.
The flaws affect every common way of running PHP on a server, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. PHP says mod_php setups face the highest risk because the attack can be triggered before any website code even runs.
AI helped find the bugs
The flaws were discovered with the help of AI. Researchers from Wiz, security firm Calif and OpenAI’s Codex Security team found them using AI models, including OpenAI’s GPT-5.6 Sol and Google’s Gemini 4 Argon. Calif’s work was part of OpenAI’s “Patch the Planet” program, which hunts for bugs in open-source software.
The researchers worked with the PHP team on the fixes before going public. Wiz has also warned that AI can cut both ways: now that the bugs are public, attackers can use AI tools to adapt exploits to different PHP versions much faster.
What should you do?
Not sure which PHP version your site uses? In WordPress, go to Tools → Site Health → Info → Server and look for “PHP version.” You can also find it in your hosting panel’s PHP settings or on the phpMyAdmin home page under “Web server.”
If you run your own server:
- Check your PHP version by running
php -vin the server terminal. - Update to one of the fixed versions above. Linux distributions received the patches in advance, so check your distro’s package updates first.
- If you can’t update right away, the NSA advises taking the server offline until you can.
- Check for signs of a break-in, such as unknown files in web folders, new user accounts or unexpected scheduled tasks.
PHP has also published temporary settings changes that reduce the risk. The project is clear that these do not replace updating.
If you run a WordPress site on shared or managed hosting:
WordPress says the flaws are in PHP itself, not in WordPress. That means the fix has to happen on the server. Most major hosts are rolling out patched PHP versions, and companies including Automattic, Cloudflare, AWS, and Microsoft tested the fixes before release. Check your PHP version using the steps above, or contact your host to confirm it has been updated.
The bottom line
PHP2Shell is one of the most serious web security issues of the year because PHP is everywhere. Attackers are already probing for unpatched servers, so if your site runs on PHP, update today.
New to web security? Read our guide on where to start with hands-on cyber security training.
Sources: PHP security advisory, NSA, watchTowr, The Hacker News, TechCrunch
