Millions of websites using PHP could face serious security risks following the disclosure of two critical vulnerabilities that may allow attackers to execute commands on affected servers. Collectively known as PHP2Shell, the flaws were publicly disclosed on October 21, 2026, and each received a severity score of 9.2 out of 10.
The vulnerabilities have prompted warnings across the cybersecurity industry, with emergency security updates released to address the issue. PHP powers a large number of websites, including platforms built with WordPress, Drupal and Joomla, making the discovery a significant concern for website owners and hosting providers.
The attacks may not require hackers to know a user’s password. Cloudflare has reported early attempts to exploit the vulnerabilities, highlighting the need for administrators to review their systems and apply the available fixes promptly.
What Is PHP2Shell and How Does It Work?
PHP2Shell refers to two security flaws identified as CVE-2026-109618 and CVE-2026-109619. Both involve weaknesses in PHP’s memory-management processes that could cause vulnerable servers to behave unexpectedly when they receive specially crafted requests.
Under certain conditions, successful exploitation could lead to remote code execution (RCE). This would allow an attacker to run commands on an affected server without having to log in through the usual authentication process.
Because PHP is widely used to power websites and web applications, the vulnerabilities could affect systems running popular content management platforms. Even if a website’s WordPress, Drupal or Joomla software is up to date, it may remain exposed if its underlying PHP installation is vulnerable.
Which PHP Versions Are Affected? Check the Available Fixes
The PHP security team released emergency updates on October 21, 2026. Website administrators should check their installed PHP version and apply the corresponding security release.
| PHP version | Fixed version or recommended action |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
| PHP 8.1 and older | Upgrade to a supported version or obtain a verified vendor fix |
Older installations that no longer receive official security updates are a particular concern. Administrators should confirm that their hosting environment is running a supported version and that the appropriate patches have been installed.
How Did AI Help Discover PHP2Shell?
According to the article’s source information, OpenAI’s AI-assisted security initiative, Patch the Planet, helped researchers identify critical weaknesses in PHP. A researcher identified as Calif reportedly discovered one flaw using GPT-5.6 Sol.
Cybersecurity company Wiz independently identified and reported both vulnerabilities. The PHP maintainers then led the patching effort, with support from security researchers and infrastructure providers, including Cloudflare.
The discovery highlights how AI-assisted research can contribute to identifying software weaknesses, while independent security research and coordinated patching remain important parts of the response.
What Should Website Owners Do Now?
Website owners and administrators should take immediate steps to determine whether their systems are affected. Recommended actions include:
- Check the PHP version: Review the version running on the website and hosting server.
- Install security updates: Upgrade to the appropriate fixed release or apply a verified patch provided by the vendor.
- Review server logs: Look for unusual requests or suspicious activity, especially if the website was exposed before the update was installed.
- Contact the hosting provider: If PHP is managed by the hosting company, ask for confirmation that the relevant security fixes have been applied.
- Use version-checking tools carefully: OpenAI has published a PHP2Shell checker to help identify potentially outdated installations. However, its findings depend on the version information exposed by the server, so an inconclusive result does not guarantee that a system is safe.
Installing the correct security update is the essential step in addressing the vulnerabilities. A checker can help with identification, but it cannot patch a server or replace a proper security review.
PHP2Shell FAQs
1. What is PHP2Shell?
PHP2Shell is the name given to two critical PHP vulnerabilities that could allow attackers to execute commands on affected servers under certain conditions.
2. Can PHP2Shell affect WordPress websites?
Yes. WordPress websites running vulnerable PHP versions may be exposed even when WordPress itself has been updated.
3. Are hackers exploiting PHP2Shell?
Cloudflare reported early attacks around the time the vulnerabilities were publicly disclosed. The full extent of successful exploitation remains unclear based on the information provided.
4. Is a security fix available for PHP2Shell?
Yes. PHP released patched versions on October 21, 2026. Administrators should upgrade to the appropriate fixed release or obtain a verified patch from their vendor.
5. Can a PHP2Shell checker secure a website?
No. A checker can help identify potentially vulnerable installations, but it cannot fix the underlying issue. Website owners or hosting providers must apply the appropriate security updates.
Disclaimer: This article is intended for general informational purposes only and is based on the information provided about the PHP2Shell vulnerabilities. Security details, affected versions and available patches may change as further information becomes available. Website owners should consult official PHP security advisories and their hosting providers before taking action. This article is not a substitute for a professional security assessment.