The maintainers of PHP, the programming language behind a huge share of the world's websites, released emergency security patches on Wednesday, October 21, 2026, for two critical vulnerabilities that could let attackers run their own code on web servers without logging in. The flaws, collectively dubbed PHP2Shell and trending per news coverage, are among the most serious internet-wide security issues in years — discovered with the help of artificial intelligence, disclosed a day early after a leak, and already drawing active exploit attempts.

Both flaws carry a CVSS v4.0 severity score of 9.2 out of 10, rated Critical. The fixes arrived as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If your website or web application runs on PHP, updating the server's PHP version is now the single most urgent security task.

What PHP2Shell actually is

PHP2Shell is the nickname for two related remote code execution (RCE) vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. In plain terms, both let an unauthenticated attacker — someone who has never logged in — send a crafted web request that tricks the PHP runtime itself into running the attacker's code on the server, with the privileges of the web worker process.

The underlying problems are memory-safety bugs in how PHP handles errors while processing a web request. The first flaw, CVE-2026-109618, corrupts PHP's internal memory when the server runs out of memory partway through setting up a request: the clean-up code can then treat invalid internal data as valid, and that corrupted state can be steered into running code. The second flaw, CVE-2026-109619, involves stale internal state — data belonging to one finished request surviving in memory after it has been freed, so a later request handled by the same worker can reuse that leftover state before it is reset, enabling heap use-after-free, memory disclosure and remote code execution.

What makes these flaws especially dangerous is where they sit. They are bugs in PHP itself, not in any website, plugin or theme. The PHP security team says every PHP installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest for mod_php — the common setup where PHP runs directly inside the Apache web server — because the team demonstrated an exploit where a single unauthenticated request triggers the attack before the website's own application code even starts running. That means no amount of good security in your WordPress plugins, your firewall rules or your application logic can save a vulnerable server: the attack lands underneath all of it.

How much of the internet is exposed

PHP remains the workhorse of the web, estimated to power as much as 70% of websites worldwide. It sits underneath WordPress — which runs a large share of all sites — plus Drupal, Joomla, Magento and countless custom applications. Updating WordPress or its plugins does not update PHP, because PHP runs at the server level beneath them. Palo Alto Networks counted more than 22.6 million internet-exposed PHP instances that could be vulnerable, and at the time the patches were published, more than a third of the web remained unpatched.

Official patched releases cover only PHP 8.2 and later. PHP 8.1 and older no longer receive regular updates from the PHP project, and while the team provided minimal source-level backports for PHP 7.4, 8.0 and 8.1 to help teams building from source or working with long-term-support vendors, huge numbers of sites run versions with no fix at all. One estimate put more than 800,000 internet hosts, serving millions of websites, on PHP branches too old to receive any official fix — with PHP 7 still running on around 27% of PHP sites and PHP 5 on about 7.7%, both effectively unpatched.

How artificial intelligence found the flaws

The discovery story is almost as significant as the flaws themselves. The bugs were first found in July 2026 by Calif, a digital-infrastructure security firm, working with one of OpenAI's most advanced models through OpenAI's "Patch the Planet" initiative — a programme pairing frontier AI models with human cybersecurity experts. Calif researcher Ryan Austin was hunting for vulnerabilities in collaboration with the programme when the model surfaced the flaw; on August 1 the firm reported it to Volker Dusch, a security engineer at the PHP Foundation, which began building and testing a patch internally.

Separately, Google's cloud security company Wiz independently discovered and reported the same vulnerabilities in August using its own AI-assisted tooling. A Wiz co-founder later described PHP2Shell as "the most severe AI vulnerability that was ever found," suggesting that humans on their own would probably never have discovered it. The incident joins a growing line of AI security incidents forcing the industry to rethink what automated research can uncover — and what it can break.

The patch itself was completed in early October, but releasing it safely took weeks: as Calif's Bruce Dang explained, pushing a fix out too early lets attackers reverse-engineer it, so the team tested thoroughly and scheduled a coordinated public release for Thursday, October 22. Those plans collapsed when Hacker News leaked news of the patch two days early, on Tuesday, October 20. The PHP team moved the release up and shipped the fixes on October 21 at 14:00 UTC (10:00 AM ET).

The scramble to patch

By the time the patches landed, the internet was already racing. Cloudflare said it had observed exploit attempts, including spikes of thousands of attempts, and reported that attackers were modifying their tactics to try to bypass the emergency protections the company had deployed. Cloudflare added complete HTTP transaction detection and response rules to its web application firewall, available to all customers including the free plan — but stressed, along with PHP itself, that a firewall is a mitigation, not the fix.

The severity triggered an unusually strong government response. The US Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent alert strongly urging organisations to patch immediately, advising that PHP-based systems which cannot be updated be taken offline until they can be patched. The NSA's Cybersecurity Collaboration Center gave similar advice. In Europe, CERT-EU and the UK's National Cyber Security Centre issued advisories the same day, recommending temporary isolation or shutdowns where immediate protection was not possible.

Ahead of the release, several organisations took the advice literally: the Dutch House of Representatives and the Netherlands' National Cyber Security Centre took their websites offline as a precaution, as did Finnish government web services and some university sites, according to security researchers and the International Cyber Digest. The shutdowns were precautionary — not breaches — and the sites came back online once patched. The episode fits a broader pattern of high-tempo attacks on digital infrastructure, following recent incidents such as the cyberattacks on Indian financial institutions.

What website owners must do right now

If you run a website, the steps are clear and urgent:

  • Check your PHP version. On WordPress, go to Tools > Site Health > Info > Server and look at the PHP version row. Your hosting control panel (cPanel, Plesk or similar) usually shows it too.
  • Update PHP immediately. Move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on your branch. On managed or shared hosting, contact your hosting provider and confirm the patch is deployed — GoDaddy and other major hosts published dedicated guidance, and many patched automatically.
  • Restart PHP workers after updating so the fixed version is actually the one serving your site, and verify the running version afterward.
  • On PHP 8.1 or older, upgrade to a supported branch or ask your distribution or long-term-support vendor for their patched build; the PHP project's own backports for 7.4, 8.0 and 8.1 are minimal source-only fixes, not ongoing support.
  • If you cannot patch now, follow CISA's advice: take the PHP-based systems offline or isolate them until you can, and keep WAF protections enabled in the meantime — they reduce exposure but do not fully fix the flaw.
  • Watch for signs of compromise. Because exploit attempts began before the patch, monitor for suspicious activity such as PHP worker processes launching shells or downloading tools.

Note the critical point that catches many website owners: updating WordPress, its plugins or its themes does nothing against PHP2Shell. The vulnerability lives in the PHP runtime on the server, so only a server-level PHP update fixes it. If your host offers a one-click PHP version switcher, confirm the selected version is one of the patched releases above.

What ordinary users should do

If you don't run a website, there is nothing for you to patch — the flaw is server-side. But it is a good moment to tighten your own defences while attackers are active: enable two-factor authentication on important accounts such as email and banking, use a unique strong password for each service, and be cautious of phishing emails impersonating "urgent password reset" notices — when changing a password, open the official site or app yourself rather than clicking a link. These steps, covered in our guide to protecting yourself online, cannot fix a server's PHP, but they reduce the damage if any site you use is compromised.

What happens next

The worst of the crisis — the race between the patch and the exploits — will be decided in the coming days as hosts finish rolling out fixes. The longer problem is the long tail: the hundreds of thousands of hosts on versions of PHP that will never receive an official fix, and the millions of websites whose owners may never learn that "update WordPress" was never the right instruction. PHP's team has said updating is the only complete fix, and security agencies agree.

PHP2Shell is also a milestone for AI-assisted security research: a flaw this deep in one of the internet's most battle-tested foundations, found by models rather than by humans alone, and disclosed on a timetable dictated by a leak rather than by the engineers. The internet got patched this time — barely ahead of the attackers. The question now is how many servers will actually take the patch.

Sources: BleepingComputer; CISA; USA Today; PHP security team / PHP Foundation; Cloudflare; GoDaddy; OpenAI and Calif; Google Wiz; CERT-EU; UK National Cyber Security Centre; Sansec.