When security researchers announced in October 2026 that a pair of flaws could let attackers take over roughly 70% of the world's websites, the culprit wasn't a niche plugin or one company's mistake — it was PHP, the server-side programming language quietly running behind WordPress, Drupal, Joomla, and a huge share of the modern web. Known as "PHP2Shell," the disclosure covered two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow remote code execution, meaning an attacker could run their own commands on a vulnerable server without ever logging in or tricking a user into clicking anything. Here's what a PHP vulnerability actually is, how these specific flaws work, and what you can do to protect a PHP-powered website.

What Is PHP, and Why Does It Run Most of the Web?

PHP, short for "PHP: Hypertext Preprocessor," is an open-source, server-side scripting language created in 1994 by Danish-Canadian programmer Rasmus Lerdorf and now maintained by the non-profit PHP Foundation. "Server-side" means the code runs on a web server rather than in a visitor's browser: when someone requests a page, the server executes the PHP, pulls data from a database if needed, and sends back plain HTML for the browser to display. That makes PHP ideal for dynamic content such as login forms, shopping carts, blogs, and the content management systems that generate pages on the fly.

Its reach is enormous. Roughly 70% of all websites use PHP in some form, and WordPress — which itself powers more than 40% of websites — is built entirely on PHP. Other major platforms such as Drupal and Joomla run on it too. Because PHP is everywhere, a vulnerability in the core language isn't one app's problem; it's a problem for a large slice of the internet at once.

What Is a PHP Vulnerability?

A vulnerability is simply a flaw in software that someone can misuse. In the world of PHP, vulnerabilities fall into two broad categories. The first lives in PHP applications — the code developers write themselves. These include SQL injection, where untrusted input is fed into a database query, or cross-site scripting (XSS), where an attacker injects JavaScript that runs in another user's browser. Developers can prevent these by writing careful code, validating input, and using prepared statements for database queries.

The second, more dangerous category lives in the PHP engine itself — the core interpreter written in C that executes PHP code. Bugs here are known as "memory safety" flaws. When the engine mishandles how it allocates, frees, or reuses computer memory, an attacker can sometimes exploit that mistake to overwrite parts of memory and redirect the program into running their own malicious code. This is "remote code execution" (RCE), and it is the worst-case scenario in web security because it bypasses every safeguard the application itself might have built.

Inside PHP2Shell: Two Flaws in the Engine Itself

PHP2Shell is the name given to two such engine-level flaws, tracked as CVE-2026-109618 and CVE-2026-109619. Both were rated critical — 9.2 out of 10 on the CVSS v4.0 scale — and both allow unauthenticated remote code execution, meaning an attacker needs no username, no password, and no interaction from a victim.

CVE-2026-109618 is an out-of-memory (OOM) corruption flaw. When PHP hits its memory limit in the middle of processing a request, the way it cleans up can corrupt memory in a predictable way. An attacker who crafts a request designed to exhaust memory can chain that corruption into full code execution. CVE-2026-109619 is related but distinct: it involves "stale global state," where PHP reuses request-owned global state after that memory has already been freed — a classic use-after-free bug. Both are memory-safety issues present in PHP versions 5.4 through 8.5, and both can be triggered in default configurations without authentication.

The practical result, as researchers at Wiz put it, is that a successful attack lets someone "take control of affected servers, steal sensitive data, and deface the websites running on them." Because the flaw is in the language itself, any PHP site running a vulnerable version — from a small personal blog to a major government portal — was potentially exposed.

How AI Found a Bug Hidden for More Than a Decade

What made PHP2Shell headline news wasn't just its severity — it was who found it. Researchers at Wiz independently uncovered the flaws using a combination of AI tools: Wiz Atlas, Google's Gemini 4 Argon, and OpenAI's GPT-5.6 Sol. Separately, OpenAI's security agent, known as "Calif," identified a critical flaw using GPT-5.6 Sol as part of the company's "Patch the Planet" initiative. OpenAI later described PHP2Shell as "one of the most impactful security issues in recent memory," adding that frontier AI found it before attackers did.

The discovery stands out because the bugs had apparently gone unnoticed for more than a decade, spanning PHP versions released as far back as 2013. The AI models were pointed at PHP's low-level memory-allocation logic and, within weeks, had not only spotted the flaws but helped build and validate proof-of-concept exploits. It's an early, concrete example of AI being used to hunt down critical software bugs faster than traditional manual auditing.

Timeline: From Discovery to Emergency Patch

  • August 1, 2026 — OpenAI's "Calif" agent, running GPT-5.6 Sol, begins analyzing PHP's memory-allocation code.
  • August 19, 2026 — Wiz Research discovers the first vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol.
  • August 20, 2026 — Wiz identifies the second, related flaw.
  • October 21, 2026 — The PHP team releases emergency patches and publicly discloses both flaws.

The fixes were shipped for the four supported PHP branches: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Older branches — 5.4 through 8.1 — are no longer supported and received no patches, which means anyone still running them must upgrade to a supported version to be safe.

How to Protect Your PHP Website

The single most important step is to update. If you run a supported version of PHP (8.2, 8.3, 8.4, or 8.5), apply the patched release immediately — 8.2.35, 8.3.36, 8.4.27, or 8.5.12 — and then restart every PHP process and rebuild any containers so the new version actually takes effect. Updating the package without restarting leaves the old, vulnerable code running in memory. If you're on an end-of-life version such as PHP 7.4 or 8.0, your only complete fix is to upgrade to a supported branch.

Beyond this specific incident, a few habits make any PHP site harder to attack. Keep the PHP engine, your framework, and every plugin up to date, since most breaches exploit known bugs that were already patched. Use prepared statements for all database queries to stop SQL injection, and validate and sanitize every piece of user input. Disable dangerous PHP functions you don't need, such as exec and shell_exec, and run with the principle of least privilege so the web server has only the permissions it requires. Finally, secure your sessions and cookies using the HttpOnly and SameSite flags, and monitor logs for unusual activity.

Where Things Stand Now

As of late October 2026, the security community's message is consistent: patch now. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged organizations to apply the fixes immediately, and major vendors including Ubuntu and Google Cloud published their own guidance within days. Cloudflare reported that it had already observed early exploit attempts, though no confirmed large-scale breaches had been attributed to the flaws at the time of writing.

Because PHP is maintained by the non-profit PHP Foundation and shipped through countless hosting providers, the patch rollout is ongoing. The good news is that for most website owners — especially those on managed WordPress hosts — the fix may be as simple as a routine update pushed by the provider. The risk remains highest for older, self-managed servers that are rarely updated.

The Bottom Line: What to Remember

  • PHP runs about 70% of websites, so a bug in its core engine affects a huge part of the internet.
  • PHP2Shell is two critical remote code execution flaws (CVE-2026-109618 and CVE-2026-109619) in PHP 5.4 through 8.5.
  • Both flaws let unauthenticated attackers run code without logging in or needing user interaction.
  • AI models — including OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon — helped discover the bugs after more than a decade.
  • To fix it, update to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12 and restart all PHP processes.
  • Older, end-of-life PHP versions must be upgraded to a supported branch — there is no patch for them.