I opened my news feed yesterday morning and felt that specific stomach-drop you get when a security story has your stack's name written all over it. Two critical vulnerabilities in PHP — not in a plugin, not in WordPress core, in the language runtime itself — found by AI, with attacks already in the wild. If you run WordPress, which most people reading this site do, this one is about you.
I've spent years building and maintaining WordPress sites, and I want to walk you through PHP2Shell the way I'd explain it to a fellow developer over coffee: what broke, why AI found it first, what it means for your sites, and exactly what to do about it before the weekend.
What PHP2Shell actually is
On October 21, 2026, Wiz Research disclosed two vulnerabilities in PHP's core engine, tracked as CVE-2026-109618 and CVE-2026-109619, alongside emergency PHP security updates. They've been dubbed PHP2Shell.
Both are memory-safety bugs. In plain English: PHP's engine mishandles memory in ways that let a remote attacker read sensitive data out of the server's memory — passwords, authentication tokens, API keys — or worse, execute their own code on the server. No login required. One of the flaws carries a 9.2 severity rating, deep in critical territory.
Here's the part that makes this a category of its own: the flaws aren't in WordPress, Drupal, or Joomla. They're in PHP itself — the runtime every one of those platforms runs on top of. Researchers demonstrated successful attacks against all three. Your site can have clean code, zero plugin vulnerabilities, and an up-to-date WordPress core, and still be exposed, because the weakness sits a full layer below your application. Clean application code does not protect you.
And the blast radius is enormous. PHP powers around 70% of the websites on the internet, and affected versions go all the way back to PHP 5.4 — software more than a decade old. That's not a bug; that's the foundation.
How AI found the bug (and what that tells us)
This is the detail that genuinely changed how I think about security work. Wiz didn't find PHP2Shell with a lucky manual audit. According to Wiz Research, frontier AI models did a meaningful share of the discovery: the team used Wiz Atlas alongside Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol. AI helped study the failures, refine exploitation techniques, and test the security patches — tasks that would otherwise have needed enormous amounts of manual testing and expert effort.
Think about what that means. Memory-safety bugs in a mature C codebase like PHP's engine are exactly the kind of thing humans have been hunting for decades with fuzzers and code review. Now AI systems can turn complex memory errors into working exploits faster than ever. The uncomfortable mirror image: the same AI tools that help defenders find vulnerabilities also lower the technical skill attackers need to build complex attacks. Wiz, Google, OpenAI, and AWS all worked on the response — and the discovery itself is a warning that offense and defense just got the same upgrade.
Why this hits WordPress owners hardest
Let me be blunt about the mental trap most of us fall into: the WordPress dashboard says everything is up to date — core, plugins, theme — so we feel safe. PHP2Shell bypasses that feeling entirely.
WordPress doesn't run your server's PHP; your host does. When the vulnerability is in the interpreter that executes every single request, a plugin update or a theme refresh changes nothing. As one security analysis put it, "a WordPress fix is the wrong frame" — the platform WordPress stands on needs urgent patching, and WordPress inherits the blast radius immediately because it runs on top of it.
That includes Elementor sites. Your page builder, your forms, your WooCommerce checkout — all of it executes through PHP. There is no plugin-level workaround for a runtime flaw. The fix has to happen at the server, container, or hosting layer.
The other uncomfortable truth: shared hosting is where most WordPress sites live, and there the PHP version is entirely your host's decision. Millions of site owners are waiting on a hosting provider to act — which is exactly why this article exists. You need to know what to ask for.
Amazon caught attacks before the disclosure
Here's the part that made me sit up straight. Amazon said its MadPot threat-intelligence system — which monitors suspicious activity on internet-facing infrastructure — detected exploitation attempts before the flaws were publicly disclosed. It's unclear how the attackers learned about the vulnerabilities early.
Read that again and let it sink in: somebody was probing for this before October 21. By October 21–22, exploit attempts were active in the wild. The gap between "patch available" and "patch applied" is the window attackers live in, and for PHP2Shell that window opened before most of us even knew there was a window.
This is why the coordinated response mattered. Wiz worked with the PHP development team, OpenAI, Google Cloud, AWS, Cloudflare, Microsoft, Automattic, Akamai, Fastly, Imperva, and Vercel. The companies built detection tools and published guidance plus temporary protections for systems that couldn't be patched immediately. When you see that many competitors cooperating, you know the industry considered this genuinely dangerous.
What to do right now — the honest checklist
Enough context. Here's what I'd actually do, in order, for every WordPress site I touch:
1. Find out what PHP version is actually serving your site. In WordPress, go to Tools → Site Health → Info → Server. Or check your hosting control panel. Write the number down. This is the single most important fact in this whole story, and most site owners have never looked at it.
2. Ask your host — in writing — whether they've applied the emergency PHP release. Don't accept "we're looking into it." You want confirmation that the patched PHP build is live on your server. If your host can't answer, that's information too.
3. If you manage your own server, patch the runtime and restart PHP. This is a package update plus a PHP-FPM (or Apache) restart — not a WordPress update. Do it during a low-traffic window, and back up first like you mean it.
4. Stay on your PHP branch; apply the patched minor version. Resist the urge to jump from PHP 7.4 to 8.3 in a panic. The safe move is the security release for the branch you're already running. A major-version jump without testing is how you trade a security problem for a broken-site problem — especially with older plugins and custom code. Test major upgrades on staging first.
5. Treat WAF rules as a bandage, not a cure. Your host or Cloudflare may offer virtual-patch rules. Use them as temporary shielding while you patch, not as a reason to skip patching.
6. If you genuinely cannot patch quickly, clean downtime beats unsafe uptime. Taking the site offline with a proper 503 status and Retry-After header is a legitimate, defensible tradeoff. A breached site costs more than a quiet afternoon.
One more thing: after patching, rotate anything sensitive that lived on that server — salts in wp-config.php, API keys, admin passwords. Memory-safety bugs can leak exactly those secrets, and you can't prove they didn't.
The bigger picture: security now moves at AI speed
I keep coming back to the meta-story here, because it changes the job. For years, the patch cycle had a comfortable rhythm: researchers found bugs with fuzzers over months, vendors shipped fixes, and site owners had weeks of grace. PHP2Shell compressed that. AI found the flaws, AI helped weaponize the analysis, and unknown attackers were probing before disclosure day.
The practical takeaway for people who build on WordPress: your security posture can no longer be "I'll update when the dashboard nags me." Runtime hygiene — knowing your PHP version, having a host that patches fast, keeping staging ready for upgrades — is now core site-owner work, not server-admin trivia. The dashboard-update reflex that served us for a decade doesn't cover the layer this attack hit.
Conclusion: patch the floor, not just the furniture
PHP2Shell is the rare vulnerability that humbles the whole stack. Not a plugin, not a theme, not your code — the floor everything stands on. Two memory-safety flaws, a 9.2 severity, a decade of affected versions, and attackers already knocking.
The good news: the fix exists, the industry coordinated on it, and the action items are simple if unglamorous. Check your PHP version, confirm the patched release, restart the runtime, rotate your secrets. It won't make a thrilling afternoon, but it's the difference between a site you own and a site someone else does.
I'll be watching how quickly the big hosts roll this out — that's the real test of the shared-hosting model.
FAQ
What is PHP2Shell?
PHP2Shell is the name given to two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) in PHP's core engine, disclosed October 21, 2026. Both are memory-safety bugs that can leak sensitive server memory or allow unauthenticated remote code execution. One carries a 9.2 severity rating.
Am I affected if my WordPress site is fully updated?
Possibly yes. The flaws are in PHP itself, not in WordPress core, plugins, or themes. A fully updated WordPress site on an unpatched PHP version is still exposed. What matters is the PHP version your host runs, not your WordPress version.
How do I check my PHP version?
In your WordPress dashboard: Tools → Site Health → Info → Server, where the PHP version is listed. Alternatively, check your hosting control panel (cPanel, Plesk, or your host's dashboard) under the PHP settings or server information section.
Will updating my plugins or WordPress core fix this?
No. Only updating the PHP runtime to the patched security release fixes it. On shared hosting, your host must apply it; on a VPS or dedicated server, you (or your sysadmin) must update the PHP package and restart the PHP service.
Should I upgrade to the latest PHP major version?
Not in a panic. Apply the patched minor release for the PHP branch you're already on — that's the safe, immediate fix. Major-version upgrades (e.g., 7.4 → 8.3) should be tested on a staging site first, since older plugins and custom code can break.
What if my host hasn't patched yet?
Ask them directly and get confirmation in writing. Use any available WAF virtual-patch rules as temporary shielding. If patching will take a long time and the site handles sensitive data, consider taking it offline with a proper 503 status until the runtime is patched — and rotate API keys, salts, and passwords afterward regardless.
