On 21 October 2026, PHP shipped emergency fixes for two critical bugs now known as PHP2Shell. Websites across the world went dark on purpose so they could patch. The flaws let an attacker with no login run code on a server, and they sit in almost every PHP version released since 5.4. AI models found them, and the BBC reported they have been described as the most significant flaws AI has ever found.
Here’s what broke, who found it, and what you should do if you run anything on PHP.
Key takeaways
- Two flaws, CVE-2026-109618 and CVE-2026-109619, are both rated 9.2 out of 10 (critical) on the CVSS v4.0 scale.
- Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all released on 21 October 2026.
- PHP 8.1 and older get no official fix. Only minimal community backports exist for 7.4, 8.0 and 8.1.
- Calif and Wiz found the bugs separately, both using AI models including OpenAI’s GPT-5.6 Sol.
- Pinboard, parts of Wikipedia, 4chan and many European government sites went offline as a precaution.
What is PHP2Shell, in plain English?
PHP is the server-side language behind WordPress, Drupal, Joomla, Magento and Laravel. W3Techs puts it on roughly 70 to 75% of websites whose server language can be identified. When PHP itself has a hole, almost the whole web has one.
PHP2Shell is two memory-safety bugs in the core engine. That means they don’t depend on the app running on top. According to the PHP security advisory:
- CVE-2026-109618: if PHP runs out of memory while it is still setting up a request, the cleanup step can treat half-built data as valid.
- CVE-2026-109619: some internal state can outlive the memory it points to. The next request handled by the same worker process can then use that stale state.
Picture a hotel room where housekeeping gets interrupted halfway through. The next guest walks in and finds the last guest’s keys still on the table. In the Wiz Research write-up, the team chained these bugs with a memory leak to get remote code execution (RCE: running their own commands on the server) on stock WordPress, Drupal and Joomla images. The leak alone can expose passwords, tokens and API keys, even if the site never starts a session.
How did AI find a bug hidden for over a decade?
Two teams got there separately. Fortune reports that Calif, a California AI red-teaming firm, found the first issue on 1 August 2026 using GPT-5.6 Sol as part of OpenAI’s Patch the Planet programme. Wiz found its first flaw on 19 August using its own Wiz Atlas tool plus Google’s Gemini 4 Argon and GPT-5.6 Sol.
Wiz reported the bugs to PHP’s security team on 24 August. Fixes were coordinated from 21 September. OpenAI’s Greg Brockman told Fortune the flaw had been in PHP for about 14 years. OpenAI called it “one of the most impactful security issues in recent memory.”
My take: this shows both sides of AI in security. The same models that helped find the bugs can help an attacker turn a messy, multi-step memory bug into a working exploit. Wiz said as much: “Pre-AI, this manual work would be difficult to implement and even harder to scale.”
Why did websites go offline?
Because the official advice said they could. The UK’s National Cyber Security Centre told organisations that couldn’t patch or mitigate fast enough to consider taking systems offline. CERT-EU suggested cutting internet-facing apps off from public networks until a fix was in.
Plenty of organisations did. Here is who reportedly went dark on 21 October 2026, according to Reuters (via RTÉ) and NBC News:
| Where | Who took services down |
|---|---|
| Netherlands | The National Cyber Security Centre, Port of Rotterdam, Overheid.nl, football body KNVB, several hospitals |
| Denmark | Municipal IT firm Kombit, including the national school platform |
| Finland | State IT provider Valtori’s public network services |
| France | All Interior Ministry websites, put into maintenance mode |
| Japan | Sakura Internet paused a database feature; daycare and gaming sites went offline |
| Global sites | Pinboard, parts of Wikipedia, 4chan, Something Awful, Archive.org |
Is PHP2Shell being exploited?
The reports don’t fully agree. CISA said it had “not observed exploitation” when it published its advisory. Cloudflare’s CTO Dane Knecht wrote on X: “We are seeing early attacks emerging.” Patchstack said it had “reports of active exploitation”, and Fastly’s Kelly Shortridge said attackers were probing targets.
Two details make things worse. CyberScoop notes that about 758,000 exposed servers run PHP branches with no upstream support (5.4 to 8.1), against 272,000 on supported branches. And NBC News reports the PHP Foundation said Chainguard broke the embargo by sharing patch details six hours early.
How to fix PHP2Shell on your server
Updating is the only complete fix. Wiz, PHP and Google all say so. In order:
- Find every PHP install. Start with internet-facing ones, and include appliances and hosted tools that bundle PHP.
- Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your Linux distro’s patched package. Then restart every PHP worker.
- If you can’t patch yet, PHP’s interim steps include setting
session.upload_progress.enabled=0in php.ini or the FPM pool, loweringpost_max_size, and on 8.5 settingfatal_error_backtraces=0. Changing these withini_set()doesn’t count. - Check for compromise. Look for odd multipart requests followed by memory-limit errors, bursts of HTTP 500s, oversized
PHPSESSIDcookies or workers that keep restarting.
On shared WordPress hosting, ask your host which PHP version you’re on, then update your plugins too. Patching is never the whole job, as we saw in our pieces on the Rank Math PRO backdoor and why patching NetScaler wasn’t enough.
What happens next
Expect a long tail. Big hosts and clouds, including Google Cloud’s App Engine standard for PHP 8.2 and up, patch automatically. Small shared-hosting sites and old servers stuck on PHP 7 or 8.1 will stay exposed for months. Censys’s Silas Cutler told NBC News it could take days just to learn how many sites were hacked.
PHP 8.6.0 RC4 already includes the fixes, with RC5 due on 5 November 2026. PHP 8.2 reaches end of life on 31 December 2026, so this is a good time to plan a move to 8.4 or 8.5.
FAQ
Which PHP versions are affected by PHP2Shell?
Every version from PHP 5.4 up to 8.5.11. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all published on 21 October 2026.
Is my WordPress site vulnerable?
If it runs on an unpatched PHP version, yes. The bug is in PHP itself, not WordPress, so updating WordPress alone won’t fix it. Ask your host to confirm your PHP version.
Who discovered PHP2Shell?
Calif and Wiz Research found it separately, both with AI help, including OpenAI’s GPT-5.6 Sol and Google’s Gemini 4 Argon. They coordinated the fix with PHP’s security team and OpenAI.
Your next step: run php -v on every server you own, and if the number is lower than those listed above, patch before you do anything else.
2 comments