PHP2Shell Vulnerability Needs a PHP Engine Patch

Estimated reading time: 10 minutes

Key Takeaways

• Wiz says the flawed code sat in PHP for more than a decade. It also says AI-assisted research produced a working exploit in about one week.
• The two main flaws, CVE-2026-109618 and CVE-2026-109619, are rated 9.2 out of 10 (CVSS v4.0). Fixed PHP versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on October 21, 2026.
• Updating WordPress or plugins does not fix this. The PHP engine itself must be patched, so ask your host or infrastructure provider.
• A related bug, CVE-2026-115560, was disclosed on October 23 and is not fixed by the October 21 releases. PHP recommends setting session.upload_progress.enabled=0 for now.
• The sources show no confirmed in-the-wild exploitation. On October 25, Palo Alto Networks' Unit 42 retracted its earlier link between a European government agency incident and PHP2Shell.

The PHP2Shell vulnerability is a case where old code and new AI tools collided. Wiz says the flawed code had existed in PHP for more than a decade. It also says frontier-AI-assisted research produced a working exploit in about one week, where a world-class team would previously have needed months.

For founders and operators, the practical lesson is simple. Many sites run on PHP that a host or infrastructure provider manages. Updating WordPress or plugins does not fix a vulnerable PHP engine, so you need to verify the PHP runtime itself.

How AI Turned a Decade-Old Bug Into a Working Exploit in About a Week

PHP is an open-source programming language that runs on web servers. It builds the pages you see when you visit a site. Wiz says PHP powers about 70% of websites. That figure is Wiz's own estimate, not an independently audited measurement.

According to Wiz's blog post, the vulnerable code had existed for more than a decade. Wiz says AI-assisted research changed how fast someone could turn that old code into a working attack. Its timeline, all company-reported, looks like this:

• August 19, 2026: Wiz discovered the first PHP vulnerability using AI-assisted research.
• August 20: Wiz confirmed unauthenticated remote code execution against Drupal and WordPress in testing.
• August 24: Wiz reported the flaws to the PHP security team.
• October 21: PHP issued fixed releases.

Wiz names the tools it used as Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol. The BBC separately reported that researchers at Calif and Wiz used advanced AI tools developed by OpenAI. The sources do not line up on the exact toolset, so treat the tool list as company-reported.

The BBC also reported that details of the discovery leaked online. It said this forced PHP's developers to rush out their announcement. In a blog post quoted by the BBC, OpenAI said the incident shows how AI can uncover security flaws. It also said AI can help attackers rapidly develop offensive tools and exploits.

The one-week and "months previously expected" claims come from Wiz. They are not independently verified in the sources reviewed here.

Source: Wiz Research blog post, October 21; BBC report by Liv McMahon and Osmond Chia, "What is PHP and why did it spark a global cyber-security scramble?" (the briefing supplies no URL for the article itself).

What the PHP Remote Code Execution Flaws Actually Do

"Remote code execution" (RCE) means an attacker can run their own commands on your server from far away. "Unauthenticated" means they need no login first. Together, that is about the worst combination a web server can face.

The Canadian Centre for Cyber Security classified both flaws as use-after-free bugs. In a use-after-free bug, a program keeps using a piece of memory after it has released it. The Cyber Centre said unauthenticated arbitrary-code execution was possible. Unit 42 described both CVEs as CVSS v4.0 9.2 remote-code-execution vulnerabilities. CVSS is a standard severity score out of 10.

What Wiz demonstrated

Wiz reported two kinds of researcher demonstrations:

• Remote code execution against current WordPress, Drupal and Joomla container images.
• Memory disclosure from PHP worker processes, which contained passwords, tokens and API keys. This worked in a way that did not depend on the application.

These were demonstrations by researchers. They are not evidence of attacks in the wild. Wiz also says affected releases extend back to PHP 5.4.

Where the bug lives

Wiz and Cloudflare's technical analysis points to the PHP runtime, not WordPress, Drupal or Joomla code. That is why a plugin update cannot fix it.

The Canadian Cyber Centre said these setups are at risk when they serve web requests:

• PHP-FPM
• Apache mod_php
• php-cgi
• FrankenPHP
• LiteSpeed

It considers mod_php the highest risk. The demonstrated exploit can trigger before application code even runs.

The NSA said PHP2Shell could permit unauthenticated server takeover, data theft, service disruption and lateral movement. Lateral movement means an attacker hopping from one compromised system to others. Calif researcher Ryan Austin told the BBC it was "the most serious vulnerability I've ever found."

Source: Wiz Research blog post, October 21; Canadian Centre for Cyber Security advisory AL26-026; NSA advisory on critical PHP patches; Palo Alto Networks Unit 42 report; BBC report by Liv McMahon and Osmond Chia (no URL supplied).

Which PHP Security Patch to Install: 8.5.12, 8.4.27, 8.3.36 or 8.2.35

The PHP project released fixes for CVE-2026-109618 and CVE-2026-109619 on October 21, 2026. ENISA and its EU partners reported the PHP security team issued updates at 13:40 UTC that day. The BBC reported that the project said all PHP users are "strongly encouraged to update immediately."

The fixed versions are:

Your PHP branch	Fixed version
8.5	8.5.12
8.4	8.4.27
8.3	8.3.36
8.2	8.2.35

If you run an older version

PHP 8.1 and older fall outside the project's normal support window. Some Linux distributions and long-term-support vendors may still provide backported fixes. A backport is a fix copied back into an older version.

PHP also supplied minimal source backports for PHP 7.4, 8.0 and 8.1. These are source-code fixes, not ready-made packages. Most small businesses should not compile them by hand. Ask your host or vendor what they have shipped.

A planned deadline to know about

PHP 8.2 is scheduled to reach end of life on December 31, 2026. That is a plan, not something that has happened yet. If you are on 8.2.35 today, you are patched, but you will soon need a newer branch to keep getting fixes.

How to check your version

Your hosting dashboard, a support ticket or your developer can tell you the PHP version running in production. Do not rely on your WordPress version. WordPress runs on top of PHP and does not control which PHP engine your server uses.

Source: PHP Development Team 2026 news archive; ENISA and EU partners' joint statement, October 21; Wiz Research blog post, October 21; BBC report by Liv McMahon and Osmond Chia (no URL supplied).

PHP2Shell CVE-2026-109618 Pushed Governments and Sites Offline

The alert on October 21 disrupted services around the world, according to the BBC. Wikimedia, the group behind Wikipedia, took down a number of systems as a precaution. The BBC also reported that:

• The Finnish government took sites offline.
• Edinburgh council took sites offline.
• Some BBC pages were taken offline.
• The Netherlands' cyber-security agency pulled its website on Wednesday.

Many sites were back by Thursday, though others were still being taken down temporarily as organisations checked for exposure. The UK Government said some "limited" services might be offline for a time. It said 32 sites had been taken down as a precaution, none of them large public-facing services.

What official agencies said

The agencies gave similar advice:

• NSA: Inventory PHP-dependent internet-facing systems and patch immediately. Take systems offline if immediate mitigation is not possible. The NSA said the risks are "serious enough to require immediate patching across United States Government departments and agencies."
• ENISA and EU partners: Identify PHP-based applications, coordinate with providers and prioritize internet-facing systems.
• Canadian Cyber Centre: Upgrade or isolate exposed applications.
• UK National Cyber Security Centre: Consider temporarily taking sites offline if updates or temporary protections cannot be applied quickly enough, as the BBC reported.
• Japan: The BBC reported that Prime Minister Sanae Takaichi urged people to check whether their public websites ran on PHP.

Individual voices

Paul Spain, chief executive of Gorilla Cyber Security, estimated to the BBC that the flaw could affect "millions and millions" of websites. Jill Slay, a researcher at the University of Adelaide, said it would be "disastrous" if hackers or countries weaponised the flaw. These are individual views, not a measured count.

ENISA also referenced the EU Cyber Resilience Act, Regulation (EU) 2024/2847, in connection with vulnerability reporting.

Source: BBC report on the UK Government taking 32 sites offline; BBC coverage of the global containment effort; NSA advisory on critical PHP patches; ENISA and EU partners' joint statement, October 21; Canadian Centre for Cyber Security advisory AL26-026; UK NCSC guidance on the PHP issue.

The Follow-Up Bug CVE-2026-115560 and What a WAF Can Do

Patching on October 21 did not end the story. On October 23, PHP disclosed CVE-2026-115560, a related issue in a feature called session upload progress. It was not fixed by the October 21 releases.

The Canadian Cyber Centre added the CVE to its advisory the same day and also said the October 21 updates do not fix it. Cloudflare said it affects fully patched PHP releases.

How narrow the new bug is

The new issue requires an uncommon combination of two things:

1. Changes to the runtime's serialization handler, which controls how session data is stored.
2. Session upload progress being enabled.

Many sites will not have that setup. Still, PHP recommends setting session.upload_progress.enabled=0 until the next regular bug-fix release. This is a mitigation, not a full fix.

What Cloudflare did

A WAF, or web application firewall, is a filter that sits in front of your site and blocks suspicious traffic. Cloudflare says it deployed WAF protections starting October 21 at 03:02 UTC. They cover all customers using its WAF, including free customers.

Cloudflare also says it built full-transaction detection. That means it looks at both the incoming request and the origin server's response. The company also reported two observations:

• It observed attack traffic targeting customers.
• It saw payload mutation attempts, where attackers tweak their input to slip past protections.

Cloudflare says plainly that WAF protection is defense in depth and does not replace updating PHP. Defense in depth means stacking several protections, so no single one is your only safeguard.

All of this comes from Cloudflare itself. It is a company announcement, not independent analysis.

Source: PHP Development Team 2026 news archive; Canadian Centre for Cyber Security advisory AL26-026; Cloudflare blog on PHP vulnerabilities and WAF protection.

What Is Confirmed About Exploitation and What Is Not

Start with what the sources do not show. The BBC reported no successful exploits of the flaw so far. The Canadian Cyber Centre said that at the time of its October 21 advisory, no active exploitation had been identified, though conditions could change quickly. The sources reviewed here contain no independent confirmation of successful in-the-wild exploitation.

Attack traffic is not the same as a breach

Cloudflare reported attack traffic aimed at its customers. That shows people are probing, but it does not show a successful break-in. The sources do not give a confirmed PHP2Shell breach count or a confirmed exploitation campaign.

The Unit 42 numbers and the retraction

Palo Alto Networks' Unit 42 reported more than 22.6 million potentially exposed instances in its Cortex Xpanse telemetry. That is a company estimate of exposure. It is not a count of hacked servers.

Unit 42 had earlier suggested that post-compromise activity at a European government agency was caused by PHP2Shell. On October 25, it retracted that update. It said it could not confirm a connection to either CVE.

So the agency incident should not be treated as a PHP2Shell breach. The retraction does not make the bugs less serious. It means that one claim fell apart.

Where the experts agree

Official agencies agree on the basics:

• Patch immediately.
• Inventory your PHP assets.
• Prioritize internet-facing systems.
• Isolate what you cannot patch.

Wiz and Cloudflare, both companies with their own interests, back the finding that the bugs sit in the PHP runtime. The sources do not include a separate, fully independent technical review. Treat the high-impact assessment as strong and official, and the exploitation picture as unconfirmed.

No money figures here

No financing, cost or loss figures appeared in the sources. This article does not estimate what the incident has cost anyone.

Source: Canadian Centre for Cyber Security advisory AL26-026; Cloudflare blog on PHP vulnerabilities and WAF protection; Palo Alto Networks Unit 42 report, published October 23 and updated October 25; ENISA and EU partners' joint statement, October 21; BBC report by Liv McMahon and Osmond Chia (no URL supplied).

What This Means for Startups and Small Businesses

Most visitors to your site need to do nothing. The work falls on whoever runs the server. Ethical hacker Ken Munro told the BBC that installing the fixes is "a bit like running a Windows update." He also said that if you look after your own site, "it is your own responsibility to make sure fixes are applied."

A practical checklist

1. Ask your host in writing. Use this wording: "Has the PHP runtime on our account been updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor-backported fix?"
2. Do not stop at WordPress. The BBC reported that the fix must be applied to PHP itself. Updating WordPress or its plugins will not resolve it.
3. List everything that runs PHP. Include your marketing site, store, staging servers, internal tools and old projects nobody owns.
4. Check your web server type. Apache mod_php was rated highest risk by the Canadian Cyber Centre, so confirm how PHP is wired in.
5. Handle the follow-up bug. If you control your PHP settings, consider session.upload_progress.enabled=0 until the next bug-fix release. Ask your host if you cannot change it.
6. If you cannot patch fast, consider going offline. The NSA and the UK NCSC both raised taking systems offline when patching or protection is not possible quickly.
7. Plan for older PHP. If you run 8.1 or older, ask your vendor about backported fixes. Also plan to leave PHP 8.2 before its scheduled end of life on December 31, 2026.
8. Add a WAF, but do not rely on it. Cloudflare says its WAF is defense in depth and does not replace updating PHP.

Watch for scams

The BBC reported advice to watch for phishing messages that use the publicity around the incident. Be careful with any email asking you to change passwords unless it comes from a service you can verify.

If your site stores API keys or tokens in places a PHP process can reach, Wiz showed that such data can be exposed from worker memory in its demonstration. After patching, consider rotating high-value secrets, especially if you saw odd traffic. That step is a precaution, not a response to a confirmed breach.

Source: Wiz Research blog post, October 21; PHP Development Team 2026 news archive; Canadian Centre for Cyber Security advisory AL26-026; Cloudflare blog on PHP vulnerabilities and WAF protection; UK NCSC guidance on the PHP issue; BBC report by Liv McMahon and Osmond Chia (no URL supplied).

Frequently Asked Questions