On October 21, 2026, the PHP project did something it almost never does: it shipped emergency security releases for every supported version of PHP at once. The reason was PHP2Shell — a pair of critical vulnerabilities that had been hiding inside PHP for roughly 14 years and that, in the worst case, let an attacker run their own code on a web server without even logging in.
Within hours, the NSA, the FBI and CISA were urging organizations to patch immediately or take vulnerable systems offline. The UK’s National Cyber Security Centre issued an alert. Japan’s prime minister publicly urged the country to patch. Several European governments pulled official websites offline as a precaution, and Wikimedia took some of its systems down too. This is the story of the worldwide PHP emergency — and how to tell whether your own site is safe.
What is PHP2Shell?
PHP2Shell is the name given to two related flaws, tracked as CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2 — about as severe as it gets. Together they allow unauthenticated remote code execution (an attacker with no account and no password can run commands on the server) and memory disclosure (leaking sensitive data straight out of server memory).
The flaws affect every PHP version from 5.4 through 8.5.11 — essentially the entire modern history of the language. The vulnerable code had been sitting in PHP for around 14 years. The flaw is at its worst on Apache with mod_php, still one of the most common ways PHP websites are served, which is why shared-hosting customers and WordPress site owners were told to pay particular attention.
What does remote code execution mean in practice? An attacker who exploits it can install a web shell, steal databases, deface pages, send spam from your server, or use your site as a stepping stone to attack others. Memory disclosure is quieter but just as dangerous: it can leak passwords, session tokens and private keys without leaving an obvious trace.
How AI helped uncover a 14-year-old flaw
The vulnerabilities were discovered in August 2026 by security researchers — reporting names the Calif team and researchers at Wiz — who were aided by AI models while hunting through PHP’s sprawling C codebase for memory-safety bugs. It is a sign of things to come: AI-assisted auditing is now finding the bugs that human reviewers missed for over a decade.
Details of the flaws leaked on October 20, forcing the PHP project’s hand. Emergency patched releases followed on October 21: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. There is one important catch: PHP 8.1 and older receive no fix at all. Those branches are end-of-life, so the only remedy is upgrading to a supported branch.
Why governments hit the panic button
What turned a software patch into a geopolitical event was scale. Palo Alto Networks’ Unit 42 estimated that around 22.6 million internet-exposed instances could be vulnerable. PHP powers an enormous share of the web — WordPress alone runs on PHP, and WordPress powers more than 40% of all websites.
The official response was swift:
- NSA, FBI and CISA urged organizations to patch immediately — or take vulnerable systems offline until they could.
- The UK’s National Cyber Security Centre issued its own alert.
- Japan’s prime minister publicly urged the country to patch.
- Several European governments took official websites offline as a precaution.
- Wikimedia took some of its systems down while it verified its exposure.
One reassuring note: at the time of disclosure, CISA said it had not observed active exploitation. Since then, the race has been between defenders patching and attackers reverse-engineering the fix to build exploits — a race the defenders only win by patching fast.
Is your website affected? Here’s how to check
If your website runs on PHP — WordPress, Drupal, Joomla, Magento, Laravel or most custom CMS platforms — check your PHP version today. On shared hosting, your control panel (cPanel’s MultiPHP Manager, Plesk, or your host’s dashboard) usually shows it. In WordPress, go to Tools → Site Health → Info → Server and look for the “PHP version” row.
Compare what you see against the patched releases: 8.5.12, 8.4.27, 8.3.36, 8.2.35. If your version is lower than the patched release for your branch, you are vulnerable. If you are on 8.1 or older, there is no patched version — you need to move to a supported branch.
For the record: Wikibusiness runs PHP 8.3.36 — the patched release for the 8.3 branch — as verified in our own Site Health check on October 23, 2026. This site is not affected by PHP2Shell.
What website owners should do right now
1. Check your PHP version. Use the steps above and write the number down.
2. Update PHP through your hosting provider. Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 depending on your branch, then make sure PHP is restarted (most hosts do this automatically; on a VPS you may need to restart PHP-FPM or Apache yourself).
3. Update WordPress, your themes and your plugins. A patched PHP version protects the interpreter, but outdated plugins remain the most common way WordPress sites get hacked.
4. Run a security scan. Use a scanner such as Wordfence to check for signs of compromise — especially if your site was running a vulnerable PHP version while the flaw’s details were public.
5. Beware of phishing riding the news. Every major security scare spawns fake “critical PHP update” emails. Only update PHP through your hosting control panel — never via a link in an email.
6. If you’re on PHP 8.1 or older, plan your upgrade now. There will be no security fix for these branches — for PHP2Shell or for anything that comes next.
Also this week: the eMudhra certificate scare
PHP2Shell wasn’t the week’s only infrastructure scare. Researchers also found that the eMudhra certificate authority had issued TLS certificates generated with absurdly small private keys — one was literally the number 4. A private key that small offers no security at all: anyone who guesses it can impersonate the site. Browser vendors moved to distrust the affected certificates, and the practical advice for everyone is simple: keep your browser updated, since browsers are where those distrust lists land.
Frequently asked questions
Is PHP2Shell being actively exploited?
At disclosure time, CISA said it had not observed exploitation. But with roughly 22.6 million potentially exposed instances and the patch now public, security teams assume working exploits exist or soon will. Patching is the only safe assumption.
Does PHP2Shell affect WordPress sites?
WordPress is written in PHP, so any WordPress site running on a vulnerable PHP version is exposed at the server level — regardless of which plugins or theme it uses. Updating WordPress alone does not fix it; the PHP interpreter itself must be patched by your host.
I’m on PHP 8.1 or older. What should I do?
There is no patched release for PHP 8.1 or earlier branches. Ask your host to move your site to PHP 8.2, 8.3 or 8.4 (at the patched point release), and test your site and plugins for compatibility first — preferably on a staging copy.
How do I check my PHP version?
On most hosts: cPanel → MultiPHP Manager, or your host’s dashboard. In WordPress: Tools → Site Health → Info → Server, then read the “PHP version” row. You can also ask your host’s support chat — they answer this question every day.
Will updating PHP break my website?
Patch-level updates (for example 8.3.x to 8.3.36) are designed to be safe and rarely break anything. Jumping branches (say 8.1 to 8.3) can break old plugins or themes, which is why you should test on staging and keep a backup.
What if my host doesn’t offer a patched PHP version?
Contact your host’s support and ask when the patched builds will be available — most major hosts deployed them within days of the October 21 releases. If your host can’t give you a timeline, that is a good reason to consider a host that takes security seriously.
The bottom line: PHP2Shell is a reminder that the internet runs on shared, aging infrastructure — and that a flaw can hide in it for 14 years before AI-assisted researchers dig it out. The fix exists, it is free, and for most site owners it is a few clicks in their hosting panel. If you haven’t checked your PHP version this week, do it now.
