PHP2Shell Explained: Which PHP Versions to Patch Now

Website owners around the world are racing to install emergency PHP updates after researchers disclosed two critical flaws in the core of the language on Wednesday, Oct. 21, 2026. The PHP vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed “PHP2Shell” by Wiz Research, can let an attacker who has not logged in run code on a vulnerable web server. The PHP project released fixed versions the same day and says updating is the only complete fix.

Image: Server racks in a data center, used for illustration. Photo: BalticServers.com, via Wikimedia Commons (CC BY-SA 3.0).

What the PHP2Shell flaws are

PHP is the server-side language behind WordPress, Drupal, Joomla and MediaWiki, the software that runs Wikipedia. Wiz Research says PHP powers about 70% of all websites, which is why the disclosure set off a scramble across the hosting industry.

According to Google Cloud’s security advisory, both flaws carry a CVSS severity score of 9.2, which is rated Critical. Google describes CVE-2026-109618 as a problem with out-of-memory handling: PHP can be interrupted while internal request data is only partly set up, and the cleanup step may then treat that broken data as valid. CVE-2026-109619 involves internal state from one request surviving after its memory has been freed, so a later request handled by the same worker can use that stale state.

Wiz’s technical write-up describes several bugs under the two CVE numbers, including an upload-progress unserializer use-after-free, a remote process-memory disclosure and an OPcache type confusion. Wiz says it chained bugs into a working exploit and demonstrated unauthenticated remote code execution against the latest container images of WordPress, Drupal and Joomla. It also says attackers could read memory from the PHP process that may hold passwords, tokens and API keys, without needing to take over the server.

The important detail for site owners is that the bug sits in PHP itself, not in any one application. Wiz says even a simple “Hello World” page running on an affected version can be vulnerable.

Which PHP versions are affected and how to fix them

Google’s advisory says every PHP version from 5.4 through 8.5.11 is affected. The fixed releases are:

PHP 8.5.12
PHP 8.4.27
PHP 8.3.36
PHP 8.2.35

The PHP project’s release announcement for 8.5.12 says “there are no complete mitigations, updating is the only safe choice.” PHP 8.1 and older have reached end of life and will not get fixes, so Amazon Web Services’ bulletin tells customers on those versions to move to a supported branch. AWS also lists interim steps, such as web application firewall rules that block request bodies over 8 KB, but it stresses that none of them is a full fix.

Major platforms moved quickly. AWS released updated Elastic Beanstalk PHP platform versions (v4.13.12) on Oct. 21, with a follow-on release containing the upstream fix targeted for Oct. 22. It said Lightsail customers need to build new instances from updated blueprints, because running instances cannot be patched in place.

Wiz advises defenders who have not yet patched to watch for unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, oversized or malformed PHPSESSID cookies, and unexplained churn in PHP worker processes.

How AI found a decade-old bug

The disclosure is drawing attention as much for how the flaws were found as for their reach. Wiz says it discovered the first vulnerability on Aug. 19, 2026, using its Wiz Atlas tool along with Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol models. It confirmed remote code execution against Drupal on Aug. 20 and WordPress on Aug. 21, reported the issues to PHP’s security team on Aug. 24, and PHP began building a coordinated fix on Sept. 21.

Wiz wrote that the flawed code had been present for more than a decade, and that building a working exploit required chaining several bugs and adapting to each server’s memory layout. It said frontier AI models made that work practical, and that “a single researcher completed in a week what previously would have taken a world-class team months of work.” Wiz compared the case to Heartbleed in 2014 and Log4Shell in 2021.

OpenAI said in its own post that security firm Calif found a critical flaw using GPT-5.6 Sol through OpenAI’s “Patch the Planet” program, and that Wiz independently found and reported both vulnerabilities. OpenAI said it worked with infrastructure providers and U.S. agencies including the White House’s Super Intelligence Force, the Cybersecurity and Infrastructure Security Agency (CISA) and the Office of the National Cyber Director to help security guidance reach critical organizations. “To our knowledge, frontier AI found these vulnerabilities before attackers did,” OpenAI wrote. The company also said it has committed $1 billion in subsidized access to its Daybreak security tools for under-resourced defenders, and expects similar findings to “increase sharply in the coming months.”

What it means for businesses and site owners

For anyone running a WordPress blog, a small online store or a company intranet, the steps are simple even if the bug is not: find out which PHP version your server or host runs, and get it on one of the patched releases. Many managed hosts will apply updates for you, but sites on self-managed servers or old PHP branches need action from their owners.

The episode follows other recent AI-and-security stories we have covered, including a report that a hacker used AI agents to breach more than 100 company websites and the DHS order telling federal agencies to remove DeepSeek AI. Together they point to the same shift: AI is making it faster to find and exploit old weaknesses, and defenders have less time to respond.

Sources

Like this story? Get the newsletter

The day's Boston news, weather and local business in one short email, with links to the full stories.

Latest

All latest news →

PHP Vulnerabilities: AI-Found PHP2Shell Flaws Put Websites at Risk