Two critical security vulnerabilities in PHP have triggered an urgent security response across the technology industry. Known collectively as PHP2Shell, the flaws could allow unauthenticated attackers to execute malicious code remotely on affected servers or access sensitive information stored in PHP process memory.
The vulnerabilities were disclosed publicly on 21 October 2026, when the PHP development team released security updates addressing both issues. What makes this discovery particularly significant is the role of artificial intelligence in the research. Security researchers used advanced AI models to help investigate weaknesses in PHP’s core engine and develop working exploits for flaws that had remained difficult to exploit for years.
The findings have attracted attention because PHP is estimated to power approximately 70% of websites worldwide. However, this figure describes PHP’s estimated reach across the web, not the percentage of websites confirmed to be vulnerable.
For website owners, developers, and hosting providers, the immediate priority is to identify affected PHP installations and apply the security updates.
Key Takeaways
- PHP2Shell refers to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619.
- Both vulnerabilities have a reported CVSS v4.0 severity score of 9.2.
- Successful exploitation can allow unauthenticated remote code execution and exposure of sensitive PHP process memory.
- PHP powers approximately 70% of websites, according to Wiz Research, highlighting the potential reach of the issue.
- AI-assisted security research played an important role in discovering and demonstrating the vulnerabilities.
- PHP released patched versions on 21 October 2026: 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- WordPress, Drupal, Joomla, and custom PHP applications may be affected when running vulnerable PHP environments.
- Updating the PHP runtime is the complete remediation. Updating WordPress plugins alone is not sufficient.
Table of Contents
What Is PHP2Shell?
PHP2Shell is the name given to a group of critical memory-safety vulnerabilities discovered in the PHP programming language.
PHP, short for Hypertext Preprocessor, is a server-side scripting language used to build websites and web applications. It processes requests on a web server, communicates with databases, and generates content delivered to visitors.
Popular platforms such as WordPress, Drupal, and Joomla rely on PHP. Many custom websites, online services, and business applications also use it.
The PHP2Shell vulnerabilities are particularly concerning because the weaknesses exist inside PHP itself rather than being limited to a specific website, plugin, or content management system.
An application can therefore have secure application code and still be exposed if its underlying PHP runtime is vulnerable.
Why Is It Called PHP2Shell?
The name PHP2Shell comes from the exploit script used by researchers to demonstrate remote code execution against affected PHP deployments.
The researchers demonstrated that the vulnerabilities could be used to execute code without requiring an authenticated application account in the tested environments.
The name is also used to describe the wider research into the two PHP security vulnerabilities.
How AI Helped Discover the PHP2Shell Vulnerabilities
One of the most interesting aspects of this security incident is how artificial intelligence contributed to vulnerability research.
Traditional vulnerability research often requires extensive knowledge of programming languages, memory management, debugging, and software architecture. Researchers may spend considerable time examining source code, identifying unusual behaviour, and developing reliable ways to demonstrate a security weakness.
AI tools can help researchers analyse complex code, explore possible failure conditions, and work through technical problems more quickly.
In the PHP2Shell investigation, multiple research teams used AI-assisted methods to investigate vulnerabilities in the PHP engine.
The Role of OpenAI and Patch the Planet
OpenAI announced its involvement in the coordinated security response through an initiative called Patch the Planet.
According to OpenAI’s announcement on 21 October 2026, security researcher Calif identified a critical flaw using GPT-5.6 Sol as part of the initiative.
OpenAI also reported that Wiz independently discovered and reported both vulnerabilities.
The PHP maintainers led the actual security fixes and releases, while OpenAI, Wiz, and other industry partners contributed research, technical support, and coordination.
The work involved preparing updates, checking proposed fixes, and helping hosting and infrastructure providers prepare protective measures before public disclosure.
Source: OpenAI: Patch the Planet and coordinated vulnerability disclosure
How Wiz Research Used AI
Wiz Research independently investigated weaknesses in PHP’s core engine.
Its published research describes the use of Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol during the investigation.
According to Wiz, AI assistance helped researchers understand complex memory-safety problems and develop working exploit chains.
Wiz reported that it demonstrated unauthenticated remote code execution against WordPress and Drupal before reporting its findings to the PHP security team.
This illustrates an important change in cybersecurity research: AI is becoming a practical tool for discovering and investigating weaknesses in widely used software.
Source: Wiz Research: PHP2Shell vulnerabilities
Why This Discovery Matters
AI-assisted security research does not mean that human security researchers are no longer necessary.
The PHP2Shell investigation involved researchers, software maintainers, security companies, infrastructure providers, and government agencies.
AI helped with parts of the research process, but people were still responsible for investigating the findings, coordinating disclosure, reviewing the fixes, and releasing protected software.
The wider lesson is that AI can help defenders discover weaknesses that may otherwise remain hidden for years. The same capabilities also create new challenges because attackers may use advanced AI tools to develop exploits more efficiently.
Why PHP2Shell Could Affect a Large Part of the Web
PHP is one of the most widely used programming languages for websites.
According to Wiz Research, PHP powers approximately 70% of websites worldwide. It is used by content management systems, e-commerce platforms, business applications, and custom web projects.
Some well-known PHP-based platforms include:
- WordPress
- Drupal
- Joomla
- MediaWiki, the software behind Wikipedia
This broad use explains why vulnerabilities in the PHP engine can have consequences beyond a single application.
Does 70% of the Internet Have a Vulnerability?
Not exactly.
The estimated 70% figure describes PHP’s use across websites. It does not establish that 70% of all websites were successfully exploited or remain vulnerable today.
The actual risk depends on the PHP version, server configuration, security patch status, and the software running on the server.
The important point is that PHP is used across a large number of online services, so administrators need to check their environments rather than assuming that only a particular CMS is affected.
Understanding the Two Critical PHP Vulnerabilities
PHP2Shell involves two vulnerabilities tracked under separate CVE identifiers.
Both relate to memory handling inside the PHP runtime.
| Vulnerability | Main issue | Potential impact |
|---|---|---|
| CVE-2026-109618 | Out-of-memory handling and memory corruption | Remote code execution and memory disclosure |
| CVE-2026-109619 | Stale internal state after memory is freed | Remote code execution through memory corruption |
Both vulnerabilities have a reported CVSS v4.0 score of 9.2.
CVE-2026-109618: Out-of-Memory Corruption
This vulnerability involves how PHP handles situations where a request runs out of available memory.
During an out-of-memory condition, PHP may interrupt normal request processing while some internal data structures are only partially initialised.
The cleanup process can then encounter invalid internal data.
Under certain conditions, this can lead to memory corruption and potentially allow an attacker to execute code remotely.
CVE-2026-109619: Stale Global State
The second vulnerability involves internal PHP state that can continue referring to memory after that memory has already been released.
If a later request uses this stale information before the relevant state is properly reset, PHP may access invalid memory.
This can create opportunities for memory corruption and remote code execution.
Why Are These Vulnerabilities So Serious?
Both flaws affect the PHP runtime rather than a specific application feature.
This means that replacing a vulnerable WordPress plugin or changing a website theme does not address the underlying problem.
The PHP runtime itself needs the appropriate security update.
For additional technical details, consult the official PHP security advisory.
Which PHP Versions Are Affected?
The security research identified affected PHP releases dating back to PHP 5.4, with nearly every version affected by at least one of the disclosed issues.
The PHP development team released the following initial fixed versions on 21 October 2026.
| PHP branch | Initial fixed version |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
These are the initial security releases for PHP2Shell. If a newer patched version is available for your branch, use the newer supported release.
What About PHP 8.1 and Older Versions?
PHP 8.1 and older versions are no longer supported by the upstream PHP project through normal security releases.
The PHP project has published source-level backports for certain older branches, but these should not be confused with ordinary supported binary releases.
Some hosting companies and operating system vendors may provide their own security patches.
If you are running an older PHP version, contact your hosting provider and confirm whether its package contains the required fix. Where possible, plan to migrate to a currently supported PHP branch.
PHP 8.2 Users Should Plan Ahead
PHP 8.2 received a security fix through version 8.2.35.
However, PHP 8.2 is scheduled to reach upstream end of life on 31 December 2026. Administrators should address the PHP2Shell issue immediately and plan an upgrade to a supported branch.
Source: PHP 2026 release archive.
How to Check Whether Your Website Is Vulnerable
Website owners should identify the PHP version actually serving their website.
Checking only the command-line PHP version may not be enough because a hosting environment can use different PHP runtimes for web requests and background scripts.
Method 1: Check Through Your Hosting Dashboard
If you use shared hosting, follow these steps:
- Sign in to your hosting account.
- Open the website management section.
- Find the PHP configuration or PHP version option.
- Check the PHP version assigned to your domain.
- Contact hosting support to confirm whether the PHP2Shell security fix has been applied.
- Repeat the process for other websites and applications in your account.
For Hostinger customers, the relevant PHP configuration options are available through hPanel.
Method 2: Check WordPress Site Health
WordPress administrators can inspect their PHP environment through the dashboard.
- Open your WordPress admin dashboard.
- Navigate to Tools → Site Health.
- Select the Info tab.
- Expand the Server section.
- Find the PHP version information.
- Ask your hosting provider to confirm the security patch status.
Remember that Site Health reports environment information. It does not independently verify every vendor-specific security backport.
Method 3: Check Through SSH
If you manage your own server, open a terminal and run:
php -v
This command displays the PHP version used by the command-line environment.
However, the website may use a separate PHP-FPM process or another web-server integration.
Check the actual runtime serving web requests and confirm that the relevant security package is installed.
Avoid leaving publicly accessible PHP information files on your server because they can reveal unnecessary configuration details.
What Website Owners Should Do Now
The PHP development team recommends updating to a fixed release. The UK National Cyber Security Centre also advises organisations to identify PHP installations and prioritise internet-facing systems.
Here are the practical steps website owners should follow.
1. Identify Every PHP Installation
Do not check only your main website.
Review PHP installations used by:
- WordPress websites
- Custom PHP applications
- Subdomains
- Development and staging servers
- Background workers and scheduled jobs
- Containers and bundled applications
2. Back Up Your Website
Before making changes, create a complete backup of your website files and database.
Confirm that you can access the backup if the update causes compatibility problems.
3. Install the Security Update
Update PHP to a supported fixed release.
If you use shared hosting, contact your provider if you cannot update the runtime yourself.
For self-managed servers, use the security packages and instructions provided by your operating system or PHP distribution.
4. Restart Relevant Services
After updating PHP, make sure the relevant web-serving processes and workers are running the patched runtime.
The exact restart procedure depends on your hosting environment.
5. Test Your Application
Check the homepage, login, forms, uploads, database connections, payment functions, and scheduled tasks.
Review server logs for unexpected PHP errors.
6. Investigate Possible Compromise
If your website was exposed while running a vulnerable PHP version, consider reviewing logs and looking for suspicious file changes, unknown administrator accounts, or unexpected background processes.
Applying a patch does not prove that an attacker never accessed the server before the update.
What Should WordPress Website Owners Know?
WordPress is one of the major applications built on PHP, so website owners should pay attention to the underlying PHP runtime.
A WordPress website can have:
- The latest WordPress core version
- Updated themes
- Updated plugins
- A security plugin
Yet it may still be exposed if the server runs a vulnerable PHP version.
Updating WordPress core or installing a security plugin does not replace the PHP security update.
For WordPress administrators, the priority should be checking the server runtime, confirming the patch with the hosting provider, and maintaining a recent backup.
What If Your Hosting Provider Cannot Update PHP Immediately?
Some website owners use shared hosting or managed platforms where they cannot directly install PHP packages.
In that situation, contact the hosting provider and ask for confirmation of its PHP2Shell remediation.
The PHP project states that updating is the only complete remediation. Temporary protections may reduce exposure, but they should not be treated as a permanent solution.
If an affected system cannot be updated or adequately protected, the NCSC recommends considering taking it offline until it can be secured.
If you cannot update immediately, assess the exposure and ask your provider for an approved mitigation plan.
Do not apply random firewall rules or PHP configuration changes from unverified sources.
What This Means for the Future of AI and Cybersecurity
PHP2Shell is an important example of how AI-assisted research may change the way software vulnerabilities are discovered.
For years, software security teams have examined source code, tested applications, and investigated memory-related problems. Some weaknesses are difficult to turn into reliable exploits because they require several technical conditions to work together.
Advanced AI tools can help researchers explore complex code paths, test ideas, and work through difficult technical problems.
The PHP2Shell investigation shows how these tools can support the discovery of vulnerabilities in software used across a large part of the web.
However, AI is not automatically a security solution.
The same technology can potentially help attackers understand software weaknesses and develop malicious tools. That makes responsible disclosure, coordinated patching, and effective security monitoring increasingly important.
The long-term benefit will depend on whether software maintainers and security teams can use these capabilities to find and fix vulnerabilities before criminals exploit them.
Frequently Asked Questions
What is PHP2Shell?
PHP2Shell is the name associated with two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. They can allow unauthenticated remote code execution under certain conditions.
Did AI discover the PHP2Shell vulnerabilities?
AI-assisted research played a significant role. OpenAI reported that Calif identified a critical flaw using GPT-5.6 Sol, while Wiz independently discovered and reported both vulnerabilities. PHP maintainers led the security fixes.
Does PHP power 70% of websites?
Wiz Research estimates that PHP powers approximately 70% of websites worldwide. This is an estimate of PHP’s usage, not a claim that 70% of websites were confirmed vulnerable to PHP2Shell.
Are WordPress websites affected?
WordPress websites can be affected when they use a vulnerable PHP runtime. The vulnerabilities exist in PHP itself, so updating WordPress plugins alone does not resolve them.
Which PHP versions fix PHP2Shell?
The initial fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Install a later patched release where available and check your provider’s guidance.
Can a hosting provider fix PHP2Shell?
Yes. A hosting provider that manages your PHP runtime can apply the security update. Ask the provider to confirm that the web-serving runtime is patched.
Is PHP2Shell still a concern after installing the update?
The PHP2Shell vulnerabilities are addressed by the security updates. However, if a server was exposed before patching, administrators should consider whether it was compromised and investigate suspicious activity.
Does a WordPress security plugin protect against PHP2Shell?
A WordPress security plugin is not a replacement for updating PHP. Some security providers offer temporary protections, but the underlying PHP runtime still needs the appropriate security fix.
Conclusion
PHP2Shell highlights the security risks that can emerge when vulnerabilities exist inside software used by a large part of the web.
The discovery also demonstrates how AI-assisted research can help security professionals investigate complex weaknesses and support the development of fixes.
However, the most important issue for website owners is not the technology used to discover the vulnerabilities. It is whether their servers are running a protected PHP version.
Check your PHP installations, confirm the security update with your hosting provider, and review any systems that were exposed before patching.
For developers and hosting users, applying the PHP security update should be a priority rather than something left for the next routine maintenance window.
Sources and Further Reading
- PHP: Official 2026 Security Release Archive
- OpenAI: Patch the Planet and Coordinated Vulnerability Disclosure
- Wiz Research: PHP2Shell Technical Investigation
- UK National Cyber Security Centre: Critical Security Issue Affecting PHP
- NCSC-NL: PHP2Shell Operational Information
- NHS England Digital: Critical Vulnerabilities in PHP
Editorial note: This article reflects information available on 2 November 2026. Security advisories and vendor-specific remediation guidance may change. Always check the latest official PHP and hosting provider instructions before modifying a production server.
