On October 21, the PHP project shipped emergency fixes for two critical flaws that let an attacker take over a web server without logging in. Together they were named PHP2Shell. That evening, Cloudflare CEO Matthew Prince posted the numbers: "In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now."
Two days later, OpenAI president Greg Brockman posted that OpenAI had found a remote code execution flaw in "a widely-deployed compression library," calling it "an example that shows how complicated it can be to coordinate patching." Prince quoted it with a short warning: "This one maybe as bad or worse than the PHP ones. Get used to lots of patching."
That last sentence is the one for small business owners. PHP runs WordPress and a large share of small business websites, and AI is now helping researchers find serious flaws faster. Your website is probably not a target because of who you are. It is a target because of what it runs.
TL;DR
- PHP2Shell is two critical flaws (CVE-2026-109618 and CVE-2026-109619) in PHP itself, not in WordPress. Updating WordPress, themes or plugins does not fix it.
- The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no upstream fix.
- If someone else hosts your site, ask them four specific questions in writing. "We're on the latest version" is not an answer.
- AI is speeding up how fast flaws are found. Plan for frequent patching, and let AI help with the monitoring while a person owns the fix.
What is PHP2Shell?
According to BleepingComputer, the two flaws were discovered by researchers at Calif, OpenAI and Wiz, and affect PHP installations that serve web requests, including PHP-FPM, Apache with mod_php and LiteSpeed. Both can lead to remote code execution, meaning an attacker can run their own code on your server with the permissions of the web process. The PHP security team said the risk is highest for mod_php, where an unauthenticated request can trigger the attack before any application code runs.
WordPress published its own notice the same day. Its key line for owners: "These vulnerabilities are not specific to WordPress and affect any server that hosts a PHP application. No WordPress update is required or planned for these issues." The fix has to happen at the server level.
Why is AI part of this story?
Two reasons. First, OpenAI researchers were among those credited with finding PHP2Shell, and OpenAI separately disclosed the compression library flaw Brockman described. AI-assisted security research is finding serious bugs in old, widely used code.
Second, the window between disclosure and attack is shrinking. Prince's numbers show attempts in the thousands before the announcement and in the millions within a day. For a small business, the practical meaning is simple: the old habit of patching "when we get around to it" no longer works.
How do I check whether my website is affected?
Start by finding out what your site runs and who is responsible for the server.
| Your setup | Who patches PHP | What to do |
|---|---|---|
| WordPress on managed hosting | Your host | Ask your host the four questions below and get answers in writing |
| WordPress or PHP site on a server you or a contractor manage | You or your contractor | Update PHP to a fixed version and restart PHP workers |
| Site builder such as Squarespace, Wix or Shopify | The platform | Generally nothing for you to patch; check the platform's status page |
| Custom app in containers | Whoever builds the image | Update the PHP version in the base image, rebuild and redeploy |
| Old site nobody has touched in years | Unclear, which is the problem | Find out today who has server access, or take it offline until you do |
In WordPress, you can see your PHP version under Tools, then Site Health, then Info, then Server. Many hosting dashboards show it too. Be aware that Linux distributions sometimes backport fixes into packages with old-looking version numbers, so the version string alone may not tell you whether you are patched.
What should I ask my web host?
The guide at php2shell.live suggests asking a managed host four things in writing. We would use the same list:
- Which PHP branch and exact package version serves this site?
- Does that package contain the vendor fix or a distribution backport?
- When were the PHP-FPM, Apache or container workers restarted after the update?
- Are there other PHP pools, staging sites or containers on the same account that were not included?
The restart question matters. A patched package can sit on disk while old worker processes keep serving traffic. The staging question matters too, because a forgotten test copy of your site can be just as exposed as the live one.
What if my site sits behind Cloudflare or another firewall?
Cloudflare said it deployed web application firewall rules for the known exploit paths, available to all customers including free plans, and Brayden Wilmoth posted a one-click mitigation for sites behind it. He was also clear: "This reduces your risk but doesn't fix the vulnerabilities in PHP. We recommend updating PHP to a patched version."
A firewall buys you time. It does not replace the patch.
A patching routine for a small business
You do not need a security team. You need an owner, a list and a schedule.
- Keep a one-page list of what you run. Website, hosting provider, who has server access, WordPress plugins, and any other public-facing systems such as a client portal or booking tool.
- Name one person responsible. Often that is an outside web developer or IT provider. Put their name and response expectations in writing.
- Subscribe to the right alerts. Your host's status page, WordPress security news and your firewall provider's announcements. AI tools can summarize these for you each week.
- Set a rule for critical fixes. For a critical, actively exploited flaw, the target should be days, not months. Agree this with your host or developer in advance.
- Get proof, not reassurance. After a critical patch, ask for the version, the date and the restart confirmation, the same way you would ask a contractor for a photo of finished work.
- Remove what you do not use. Prince's advice in his first post was to upgrade PHP "or ensure it's removed if you're not using it." Old staging sites, unused plugins and forgotten subdomains are easy wins.
Where AI helps, and where it should not decide
AI is useful on the defensive side of this too. It can watch security feeds and summarize which alerts apply to your stack, draft the email to your host with the four questions, and compare the answer you get against what a good answer looks like.
It should not be the one deciding your site is safe. Patching changes a live system, and a wrong assumption about a version number or a missed staging site is exactly the kind of error a confident summary can hide. AI drafts, your team approves, and for security that means a named person confirms the fix with evidence.
Verdict
Verdict: Buy a simple patching routine now. If your website runs on PHP, confirm this week that PHP is on 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or a vendor backport, that workers were restarted, and that staging copies were included. If you are on PHP 8.1 or older, plan the upgrade or take the site offline until you can. Then assume more of these are coming, because AI is helping find them faster, and agree in writing who patches what and how quickly.
FAQ
What is PHP2Shell?
PHP2Shell is the name for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, in the PHP runtime. They can let an attacker run code on a web server without logging in. PHP released fixes on October 21, 2026.
Does PHP2Shell affect WordPress sites?
It affects any WordPress site running on an unpatched PHP server, because WordPress runs on PHP. WordPress itself does not need an update. The fix is updating PHP on the server.
Which PHP versions fix PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer get fixes from the PHP project, though some distributions and support vendors provide backports.
How do I check my site's PHP version?
In WordPress, go to Tools, then Site Health, then Info, then Server. Your hosting dashboard may also show it. Because of backports, ask your host to confirm the package includes the fix.
Is a firewall like Cloudflare enough?
No. Firewall rules reduce risk from known exploit paths, but Cloudflare itself recommends updating PHP to a patched version. Treat a firewall as extra time, not a fix.
Why are there suddenly so many critical vulnerabilities?
Part of the reason is that AI is helping researchers find flaws in old, widely used code. OpenAI researchers were among those credited with finding PHP2Shell, and expect more frequent patches as a result.
Can AI keep my website secure?
AI can monitor alerts, summarize which ones apply to you and draft requests to your host. A named person should still confirm each fix with evidence, because patching changes a live system.