If your company website runs on WordPress, it runs on PHP, and this week PHP had its most serious security problem in years. On 21 October the PHP project shipped emergency patches for two critical flaws, CVE-2026-109618 and CVE-2026-109619, which researchers have named PHP2Shell.
According to BleepingComputer, both flaws let an attacker who is not logged in run code on the server with the web worker's permissions. They come from PHP leaving memory corrupted when a request ends abnormally, and they affect every PHP set-up that serves web pages, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team rates the risk highest for mod_php, where an attack can fire before any of the site's own code runs.
Found by AI, exploited within hours
Fortune reports that the bugs were found independently by several teams using AI. Calif, an AI red-teaming firm working with OpenAI, found the first part on 1 August using OpenAI's GPT-5.6 Sol. Wiz found it on 19 August using Google's Gemini 4 Argon, GPT-5.6 Sol and its own tools. The flaw had sat in PHP for 14 years.
Details leaked late on 20 October, before the planned announcement. Fortune reports that Cloudflare saw exploit attempts climb from tens of thousands in 45 minutes to millions by the evening of 21 October, and that AWS said the flaw was being broadly exploited. Cloudflare's chief technology officer, Dane Knecht, told BleepingComputer that attacks were getting through even with its firewall rules in place.
What to do
- Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.1 and older no longer get official fixes.
- On shared hosting, ask your host whether it has installed the 21 October builds. Your site's admin panel usually shows the PHP version.
- If you cannot patch yet, the PHP team's interim step for CVE-2026-109619 is to set session.upload_progress.enabled to 0 and restart PHP. It is partial protection only.
PHP core developer Gina Peter Banyard said no workaround fully blocks the attacks and that the official patches are the only permanent defence, according to BleepingComputer. The UK's National Cyber Security Centre told organisations to update immediately or take systems offline until they can.
