What happened
On 21 October the PHP project released emergency patches for two flaws the industry is already calling PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Both score 9.2 out of 10 and allow something very serious: running code on the server without logging in. With a single well-crafted request, an attacker can end up taking over the machine that serves your website.
PHP is the language behind WordPress, WooCommerce, PrestaShop, Drupal, Joomla and a large share of small business websites in Spain and Latin America. Wiz, one of the firms that found the flaws, estimates that PHP runs around 70% of websites.
On Wednesday we wrote about AI agents breaking into online stores for 50 dollars. This is the other side of the same coin.
Why it matters that AI found it
The flaws had been in PHP's code for years. What was missing was someone able to chain together all the steps needed to exploit them. According to Wiz, that was so complex nobody had managed it.
In August, researchers at Wiz and at the firm Calif did it separately with the help of AI models such as GPT-5.6 Sol and Gemini 4 Argon. Wiz demonstrated the attack on WordPress, Drupal and Joomla and reported it to the PHP team, which took two months to prepare the fix.
The lesson is uncomfortable: the same tools defenders use to find flaws are within attackers' reach. And the window between a flaw being published and someone trying to exploit it has shrunk to hours.
What is happening right now
This is what we know as of today:
- Attacks from day one. The firm watchTowr saw exploitation attempts against both flaws on 21 October itself, and Cloudflare counted millions of attempts by that evening.
- Governments and companies taking sites offline. Several public bodies and companies have switched off services as a precaution while they updated.
- The official advice is blunt. CISA, the US cybersecurity agency, asks for immediate updates and, if that isn't possible, for the system to be taken off the internet until it can be.
What it means for a small business
If your website is built on WordPress, WooCommerce or PrestaShop, it almost certainly affects you. It doesn't matter whether WordPress, the plugins and the passwords are up to date: the flaw is in PHP, underneath all of that.
There is only one thing to check: which PHP version your server uses. These are the fixed versions:
The versions you need
If your server isn't on one of these versions or a later one, it's exposed:
- PHP 8.5: update to 8.5.12.
- PHP 8.4: update to 8.4.27.
- PHP 8.3: update to 8.3.36.
- PHP 8.2: update to 8.2.35.
- PHP 8.1 or earlier: no longer officially supported. The PHP team has published minimal fixes for 7.4, 8.0 and 8.1, but they only help people who compile PHP themselves. For a small business, the realistic way out is moving to 8.2 or later.
What I would do today
First, check your PHP version. In WordPress it's under Tools, Site Health, Info, in the Server section. In your hosting control panel it usually appears in the PHP or domain settings section.
Second, if you're on shared hosting, write to your provider today. In most cases they are the ones who update PHP. Ask in writing whether they have already applied the fixed version and on what date.
Third, if you have your own server or a VPS, update PHP and restart the service. If you're on 8.1 or earlier, test the site on 8.2 or later on a copy before switching, because an old plugin may break.
Fourth, don't forget your secondary sites. The old blog, a campaign landing page, the intranet or an internal app built in PHP. That's what nobody updates.
Fifth, if you use Cloudflare, it has rolled out protection rules for all its customers, including the free plan. It helps while you update, but it doesn't replace the patch: the PHP team itself insists the only complete fix is updating.
If you want us to look at it with you
We build and maintain custom software, web applications and online stores, and as a fractional CTO we make sure this doesn't depend on someone remembering.
Book a thirty-minute call. We go through which of your company's websites and applications run on PHP, which version they're on and who needs to update them. If something is urgent, we'll tell you on the same call. No commitment.
Sources
This article draws on the following publications, consulted on 23 October 2026:
Frequently asked questions
It's the name for two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, published together with their patches on 21 October 2026. They have a CVSS score of 9.2 and allow code to be run on a server without logging in.
Very probably, because WordPress runs on PHP and the flaw is in PHP, not in WordPress. It doesn't matter whether WordPress and the plugins are up to date: what you need to check is the server's PHP version. Wiz Research demonstrated the attack on WordPress, Drupal and Joomla.
PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a later release within each branch. PHP 8.1 and earlier versions are no longer officially supported, so the recommendation is to move to 8.2 or later.
In WordPress, go to Tools, Site Health, the Info tab, and open the Server section. Otherwise, the version appears in your hosting control panel, usually in the PHP or domain settings section. If you can't find it, ask your hosting provider.
Yes, even though the update is usually done by the provider. Write to your hosting company today and ask whether they have already applied the fixed PHP version on your server and on what date. If your site uses an older PHP version you selected yourself in the panel, you may need to change it.
They were found by researchers at Wiz and at the firm Calif with the help of AI models such as GPT-5.6 Sol and Gemini 4 Argon. The flaws had been in the code for years, but exploiting them required a very complex chain of steps that AI helped work out.