PHP2Shell: What the AI-Discovered PHP Vulnerability Means for Your Website
Clients aren’t simply purchasing website maintenance. They’re purchasing expertise, accountability, and coordinated response when vulnerabilities emerge.
Welcome to a whole new era of the Internet.
You know its real when old friends text you after work to ask about things called PHP and node. “Are you guys being impacted by this website security bull shit on the news?”
On Wednesday, October 21, 2026, Government sites in France, Denmark, Finland and the Netherlands came down, including the Dutch cyber security agency’s own site. Wikimedia pulled systems offline as a precaution. The U.S. National Security Agency issued a rare public warning telling organizations to take websites offline if they couldn’t update right away.
The cause: the PHP2Shell vulnerability, a pair of critical flaws in PHP, the programming language behind just under 70% of websites with a known server-side language. That includes every WordPress site on the planet.
And the flaws weren’t found by a few hackers or cyber terrorist group. They were found by AI.
Key takeaways
- What happened: PHP disclosed two critical flaws, CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), and shipped fixes on October 21, 2026.
- Who’s affected: Any PHP server, including WordPress sites, running a version older than the fixed releases.
- The fix: Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Older versions are getting selectively rolled out based on hosting provider as of this writing, but you should seriously plan an upgrade path to the latest version of PHP.
- How Bytes.co responded: With the help of our Industry leading Cloud-providers and partners, Our Client Services team patched, upgraded, blocked or isolated every site we manage, on the day of disclosure. Thankfully, we were well prepared.
What is the PHP2Shell vulnerability?
PHP2Shell lets an attacker exploit problems in how PHP manages memory. PHP’s advisories describe two bugs: one corrupts request data when a server runs out of memory, and the other lets data from one request linger where a later request can use it.
What does that mean? It’s bad.
A hacker could take control of a website’s server without a username or password, then steal sensitive data, disrupt the site, or use it as a foothold to move deeper into a network. Both flaws score 9.2 out of 10 on the CVSS v4.0 severity scale.
The CVE identifiers leaked early, so PHP moved the release up a day. The bad guys were even earlier, though. Amazon Threat Intelligence says its MadPot honeypots, decoy servers built to attract attackers, caught a PHP2Shell exploit attempt on October 17, four days before disclosure! More attempts from several different actors started rolling in around 2 a.m. UTC on October 21, hours before the patch shipped.
Why it matters that AI found PHP2Shell
These bugs sat in PHP for more than a decade. Researchers at Wiz and Calif found them independently in August using frontier AI models. Wiz says the findings “rank among the most severe vulnerabilities discovered in PHP, and arguably in software history.”
If you thought Project Glasswing was a publicity stunt or science fiction, this is your moment to think again. When Anthropic announced it on April 7 of this year with AWS, Apple, Google, Microsoft and others, the warning was blunt: AI can now outperform all but the most skilled humans at finding and exploiting software vulnerabilities, and that capability will spread.
We are officially seeing the warnings from this past April take shape.
“The window between a vulnerability being discovered and being exploited… has collapsed.”
— Elia Zaitsev, CTO, CrowdStrike, on Project Glasswing
How Bytes.co responded to PHP2Shell
This is precisely the kind of event that shows why professional website management is more than plugin updates, and we lived up to that promise.
Like most agencies with a long Client list that have been around for a while, we manage a lot of different website configurations. Our Client Services team was ready for this one. On the day PHP released its fixes, they worked through every site we manage:
- Patched: Applied the fixed PHP release or a vendor backport.
- Upgraded: Moved sites to a supported PHP branch.
- Blocked: Added protections in front of sites that couldn’t be updated immediately.
- Isolated: Took at-risk sites offline until a fix was in place, the same step the NSA recommended.
What website owners should do now
If your site runs on PHP, including WordPress, check these today:
- Inventory everything that runs PHP. Not just your website: every internet-facing service that relies on it.
- Confirm the patch. You want PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later, or a vendor backport covering both CVEs, and every PHP process restarted on it.
- Replace end-of-life PHP. Upgrade or migrate, and take the site offline until you can.
- Turn up logging and watch for vendor patches. The NSA expects more vendor fixes over the coming weeks.
- Ask who owns your response. If you don’t know who would patch your site tonight, that’s the answer.
Not sure what PHP version your site runs, or who would have your back when the next one hits? Let’s talk.
