AI found a flaw in the PHP behind 69% of websites. Ask your host today
PHP2Shell lets an attacker take over a PHP web server with one request, and it is already being exploited. For most firms the fix is one email this week.
| What happened | on 21 October 2026 PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619, two flaws that can allow unauthenticated remote code execution, each rated CVSS v4.0 9.2 (PHP security advisory, php.net) |
|---|---|
| No workaround | PHP says there are no complete mitigations and updating is the only safe choice; PHP 8.1 and older no longer receive updates from the project, which issued only minimal source backports for 7.4, 8.0 and 8.1 (php.net) |
| How AI was used | Wiz reported the flaws to PHP on 24 August 2026 after finding the first one on 19 August with its own tool plus Gemini 4 Argon and GPT-5.6 Sol, and says a single researcher completed in a week what would previously have taken a world-class team months (Wiz Research blog) |
| Already exploited | Amazon recorded a PHP2Shell exploitation attempt on its MadPot honeypots on 17 October 2026, four days before disclosure, and on 21 October said the flaw is now being broadly exploited in the wild (AWS Security Blog) |
| Which sites | Wiz demonstrated pre-login takeover on WordPress, Drupal and Joomla; the flaw is in PHP itself, so the application does not need its own bug (Wiz Research blog) |
| How much of the web | PHP is the server-side language of 69.3% of websites whose language is known; of those PHP sites, 26.9% run version 7 and 7.7% version 5, neither of which the PHP project still patches (W3Techs, 22 October 2026) |
| Government advice | the UK NCSC says organisations using any version of PHP are affected, and that a system which cannot be updated or mitigated should be considered for taking offline (NCSC, 21 October 2026) |
On 21 October 2026 the PHP project shipped emergency releases for two flaws, CVE-2026-109618 and CVE-2026-109619, that can let an attacker run their own code on a web server with a single request and no login. Security firm Wiz found them with help from Google's and OpenAI's models, and Amazon says the flaw, nicknamed PHP2Shell, is now being broadly exploited. PHP runs 69.3% of websites whose server language is known.
The verdict for a company with a few hundred staff is short. The AI part of this story changes nothing you do this week. The patch part changes a lot, and for most firms it is not an IT project; it is an email to whoever hosts your websites, sent today, asking for a written yes.
What actually happened
PHP is the language underneath WordPress, Drupal, Joomla and a long tail of older company sites, customer portals and supplier forms. Wiz found the first flaw on 19 August, confirmed it could take over Drupal and WordPress sites within two days, and reported it to PHP on 24 August. Linux distributions received the patches before the public release on 21 October.
It did not stay secret. Amazon's honeypots, servers left out as bait, logged an attempt to use the flaw on 17 October, four days before anyone outside the circle should have known. By the time the patch was public, working attack code was too.
Does the AI angle matter to an operator?
Not for this week's decision. What matters is the speed. Wiz says one researcher, working with AI models, did in a week what would have taken a world-class team months, and that the models made it practical to adapt the attack to many PHP versions. The same tools are available to attackers. The gap between a flaw being published and your site being tried has shrunk to hours.
The AI found the hole. What it changed for you is the clock: patching is now measured in hours, not maintenance windows.
Am I affected if my website is on WordPress?
Very probably, unless your host has already updated PHP. The flaw is in PHP itself, not in WordPress or a plugin, so a site with every plugin up to date is still exposed. Wiz demonstrated takeover of WordPress, Drupal and Joomla before login. A Shopify, Wix or Squarespace shop does not run your own PHP, so the platform carries this one.
Who has to do the work
It depends on who owns the server, and many firms do not know. There are three cases.
Managed hosting, where you pay a company to run WordPress for you: the host patches PHP. Your job is to get confirmation in writing that every site on your account now runs 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a distribution build carrying the fix.
A server you rent and an agency or freelancer looks after: the agency patches it, then restarts the web server and PHP workers, because Wiz notes the old code keeps running until they do. Ask them for the version number after the restart, per site.
Old sites nobody owns any more, such as a campaign microsite, a dealer portal from 2018, an intranet form: this is where the risk sits. W3Techs counts 26.9% of PHP sites on version 7 and 7.7% on version 5. The PHP project no longer patches either. Some Linux vendors sell extended fixes; otherwise the honest options are an upgrade or switching the site off. The UK's National Cyber Security Centre says to consider taking offline any system that cannot be updated or mitigated.
What it does not mean
It does not mean you need an AI security product. The fix is a free update from the PHP project. It does not mean the firewall settings PHP lists are enough; PHP says there is no complete workaround and they only reduce the risk. And it does not mean you are safe because the site holds nothing valuable: a taken-over server is a foothold inside the network it sits on.
What to do this week
Today, list every website and web form the company runs, including the forgotten ones; your domain registrar's account is the quickest place to start. Send one email per host or agency asking three things: which PHP version each site runs now, the date and time it was updated, and whether the web server was restarted afterwards. Any site on PHP 7 or older, or with no owner who can answer within a day, gets switched off until someone can. Then ask whoever reads your server logs to look back to 17 October, not 21 October, because that is the first known attack.