PHP2Shell: What the PHP Emergency Means for Your Website

If your website runs on WordPress, it runs on PHP. On October 21, 2026, PHP shipped an emergency fix for two flaws that let an attacker take over a web server without logging in. If your site hasn't been updated, it is exposed.

What happened

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, nicknamed "PHP2Shell." Both are rated Critical. They live in PHP itself, the language underneath WordPress, Drupal, Joomla, Magento and Laravel, not in any single plugin or theme.

Researchers at Wiz, working alongside Calif and OpenAI, used AI models to turn long-hidden bugs into working attacks. Wiz showed it could take over the latest versions of WordPress, Drupal and Joomla without a password.

The disclosure didn't go cleanly. The vulnerability IDs leaked online on October 20, and PHP pushed its release up a day. Amazon's threat team says it saw an exploit attempt on October 17, four days before the fix went public.

Why updating WordPress doesn't fix it

This is the part most site owners miss. Updating WordPress, your theme or your security plugin does nothing here, because the flaw sits below all of them. WordPress.org has said no WordPress update is needed or planned. The fix is a PHP update on the server.

How to check your site in two minutes

1. Log into WordPress and open Tools → Site Health → Info → Server. Note the PHP version.
2. You're patched if it reads 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer in the same line.
3. On PHP 8.1 or older, you're on a version PHP no longer supports. Ask your host whether they've applied a backported patch. Don't assume.
4. Email your host and ask directly: "Has the PHP security fix of October 21, 2026 (CVE-2026-109618 and CVE-2026-109619) been applied to my server?"

What to do this week

• Get the PHP update applied. It's the only complete fix.
• Turn on a web application firewall. Cloudflare pushed rules for the known attack paths, including on its free plan. A firewall buys time; it doesn't replace the patch.
• Check whether anyone got in before you patched. Because attacks started before the fix, a patched site can still have a backdoor left behind. Look for unknown admin users, unfamiliar files and changed passwords.
• Rotate your keys. Wiz showed the flaw can leak passwords, tokens and API keys from server memory. Change admin passwords and any API keys stored on the site.

The bigger lesson

This won't be the last one. AI just made finding and weaponizing old bugs much faster. If your site depends on a server someone has to patch on time, every time, it's worth asking whether that's still the right setup for your business.

Not sure where you stand? The R&D Dept. will check your site and tell you plainly what it needs →

Sources: Patchstack · Codeable · Believemy · NCSC-NL · Recorded Future · Capital & Compute · Cyber Magazine