If your website runs on WordPress, Laravel, Drupal or any PHP app, this one is for you. Two critical PHP bugs, nicknamed PHP2Shell, were fixed this week. This post explains what is confirmed, what "70% of websites" really means, and the defensive steps to take today.
What happened
On 21 October 2026, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. These versions fix two critical vulnerabilities that can allow unauthenticated remote code execution. In plain words, an attacker who has no login could run their own code on an unpatched server.
The confirmed facts:
Two bugs, two IDs: CVE-2026-109618 (linked to out-of-memory handling) and CVE-2026-109619 (linked to stale internal state after errors). Both are rated 9.2 out of 10 on the CVSS v4 scale.
Who is at risk: PHP says all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates the risk highest for Apache with mod_php.
Old versions are affected too: reports from Wiz and others say the reach goes back to PHP 5.4. PHP 8.1 and older no longer get official updates.
AI helped find it: security firm Calif found one bug in August 2026 using OpenAI's GPT-5.6 Sol, during an audit funded by OpenAI's Patch the Planet initiative. Wiz says it found the flaws independently using its own tools plus Google's Gemini 4 Argon and GPT-5.6 Sol. PHP's advisory credits Calif, Wiz and OpenAI.
The release came early: details leaked online before the planned disclosure, so PHP moved the release forward. A proof-of-concept exploit then circulated.
Attacks have started: Cloudflare reported attack traffic against its customers and said attackers were changing their payloads to get around its firewall rules. Several governments, including Finland, the Netherlands and France, took some websites offline as a precaution.
About the "70% of websites" claim: this number is PHP's market share, not a count of hacked or confirmed-vulnerable sites. W3Techs data shows PHP runs about 69% of websites whose server-side language is known. Whether a given site can actually be attacked depends on its PHP version, setup and whether it has been patched. Palo Alto Networks counted more than 22.6 million internet-exposed instances that could be vulnerable.
Why it matters for you
A huge share of Indian small business sites, blogs, college sites and online stores run WordPress on shared hosting. That means PHP. Here is what to do, in order.
Find your PHP version. On WordPress, go to Tools, then Site Health, then the Info tab, and open the Server section. On cPanel-style hosting, look for an option like "Select PHP Version" or "MultiPHP Manager". If you run your own server, your hosting dashboard or your system administrator can tell you.
Compare it with the fixed versions. Safe versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or newer in the same branch. Linux distributions may ship fixes under older-looking version numbers (backports), so a lower number does not always mean unpatched. When in doubt, ask.
Ask your host directly. Send a short message to support:
Hello, my site runs PHP. Please confirm whether my hosting account is patched
for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell), fixed in PHP 8.5.12,
8.4.27, 8.3.36 and 8.2.35. Which PHP version and build is my site using, and
when was it updated? If my account is on PHP 8.1 or older, what is the
upgrade path?Upgrade old PHP. If you are on PHP 8.1, 8.0, 7.x or older, move to a supported branch. Test on a staging copy first if your host offers one, because old plugins or themes may break.
Take a backup before and after. Keep a full copy of files and database before you change anything.
If you cannot patch today, PHP says the only complete fix is updating. The UK NCSC and CERT-EU advised taking unpatchable systems offline. A web firewall such as Cloudflare, which pushed rules to all plans including free, is a stopgap, not a fix.
If you manage servers, keep logs from 20 October onward and check for unusual activity or unknown files. Security experts point out that a patch does not remove access an attacker may already have.
Good to know
Do not run random "scanner" scripts from social media on your live site. Use your host, your security provider or official advisories.
Bundled PHP counts too. Some router and firewall products and app images include PHP. Vendors including Cisco, Palo Alto Networks, OPNsense and pfSense have issued bulletins.
PHP 8.2 support ends on 31 December 2026, so plan a move to 8.3 or newer even after you patch.
Hiding that your site uses PHP does not protect it.
What to watch next
Host and distribution updates. Most shared hosts and Linux distributions received patches in advance. Check that yours has rolled them out.
More AI-found bugs. OpenAI says it expects similar findings to "increase sharply" in the coming months, and is fixing other bugs too, including one in Node.js.
Follow-up advisories. PHP's GitHub advisories hold the full technical details for administrators.
Sources
Found this useful? Follow @kevinsingh.me on Instagram for a new AI tool every day, and subscribe so you don't miss the next one.