PHP2Shell: Your WordPress Update Won’t Fix This One

The short version: Two critical flaws in PHP, the programming language every WordPress site runs on, were patched on October 21, 2026, after AI models helped researchers find them before attackers did. The fix lives one layer below WordPress, so no WordPress update and no plugin can install it; your web host has to. And according to WordPress.org’s own statistics, which we pulled on October 22, 35.8 percent of WordPress sites run PHP 8.1 or older, versions the PHP project no longer patches at all.

Another 23.7 percent run PHP 8.2, which did get the fix but stops receiving security updates on December 31, 2026, 70 days from today. Put those together and 59.5 percent of WordPress sites need someone to change their PHP version before the year is out. That someone is almost never the owner, which is why the PHP2Shell WordPress story is worth five minutes of your week even if your site updates itself.

What did AI find in PHP?

Researchers nicknamed the pair PHP2Shell. Officially they are CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10, and the PHP project’s October 21 advisory describes them as memory-handling bugs that can let a request run code on the server. The advisory says the risk is highest on Apache servers running PHP as a module, a very common setup on budget hosting, where the attack can land before any website code runs at all.

The discovery is the AI part, and it is mostly good news. A security firm called Calif found the first bug in August during a PHP audit funded through OpenAI’s Patch the Planet program, using OpenAI’s GPT-5.6 Sol, as CyberScoop and The Next Web reported from OpenAI’s account. Weeks later, Wiz says it found the flaws independently using its own Atlas tool, GPT-5.6 Sol and Google’s Gemini 4 Argon, and that it ran the attack successfully against a stock WordPress container. Two months of quiet coordination followed between the labs, the PHP maintainers, security companies and government agencies.

The people still did the hard part. Calif’s own write-up credits the researcher’s knowledge of twenty-year-old PHP bug history for pointing the model in the right direction, and says plainly: “No model is simply capable of unearthing ‘all bugs’ with simple prompts.” That is the pattern we described in our piece on AI and the price of an attack, running in the defenders’ favor this time. As of CyberScoop’s Wednesday report, CISA said it had not seen the flaws exploited, though Fastly said attackers were already probing PHP sites.

Why won’t a WordPress update fix PHP2Shell?

Because WordPress is not where the bug is. Think of your site as three layers: WordPress and its plugins on top, PHP in the middle, the server underneath. WordPress updates reach only the top layer.

That is the real difference from the last scare. In July, a flaw chain nicknamed wp2shell, also found with GPT-5.6 Sol (by Searchlight Cyber, according to Wiz), sat inside WordPress itself. It was fixed in WordPress 7.0.2, 6.9.5 and 6.8.6, and WordPress’s automatic background security updates delivered that fix to most small-business sites without the owner lifting a finger. PHP2Shell gets no such ride. Cloudflare’s guidance says it directly: updating website code or plugins alone does not fix these flaws.

There is a second trap in the advisory itself. For anyone who cannot update right away, PHP lists stopgap settings, and then warns that they must be set at the server level: do not rely on ini_set() or .user.ini. On shared hosting, a .user.ini file is usually the only PHP setting a customer can touch. So for the typical owner on a shared plan, there is no do-it-yourself fix. There is a phone call.

How many WordPress sites run a PHP version with no official fix?

Here is the split from WordPress.org’s live PHP version statistics, read on October 22, 2026, against what the PHP advisory ships for each version.

The first three rows add up to the 35.8 percent (the rounded figures show 35.9). A “source code backport” is patched code for people who compile PHP themselves. It is not an update you can click. The one real escape hatch for old versions is the vendor build: Linux distributions and paid long-term-support vendors received the patches in advance, and they often fix an old version without changing its number. So a server reporting PHP 8.1 might be patched and might not, and only your host can tell you which.

How do I check my PHP version in WordPress?

It takes two minutes. In your WordPress dashboard, go to Tools, then Site Health, then the Info tab, and open the Server section. The line marked PHP version is the one you want.

• 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or higher within the same version: you have the PHP project’s fix.
• 8.2, 8.3, 8.4 or 8.5 with a lower last number: your host has not updated yet, or runs a vendor build. Ask.
• 8.1 or anything older: ask whether the build is patched, and plan a move. WordPress itself recommends PHP 8.3 or greater.

We checked our own site from the outside before writing this. The server announces itself as Apache and reveals nothing about PHP, which is good practice, since it means a scanner cannot read your version off a header. It also means you cannot either. Site Health is the reliable place to look.

What should I ask my web host?

One short email covers it:

1. Is the PHP running my site patched for CVE-2026-109618 and CVE-2026-109619, either on the October 21 releases or a vendor build with the fixes included?
2. My site runs PHP [your version]. If that is 8.2 or older, when will you move it, and can I switch to 8.3 or newer myself in the control panel?
3. Is my site behind a web application firewall with rules for these flaws?

On the second question, many hosting panels have a PHP version picker, and it is tempting to just flip it. Do it on a staging copy first if your host offers one, because an old plugin or theme that has not been updated in years is exactly the kind of thing a newer PHP version breaks. On the third: if your site already runs through Cloudflare, its firewall rules for these flaws went live for every plan, Free included, at 3:02 a.m. UTC on October 21, about nine hours before the bugs were public. Cloudflare calls that a layer on top of patching, not a substitute for it, and says attackers were already changing their payloads to slip past the rules.

The window worked. The last mile is ours.

When OpenAI launched Patch the Planet, we wrote that small businesses on open-source software would get its patches whether or not they ever touched the tools. PHP2Shell is the first big test of that promise, and the first half passed: AI helped find a bug in the plumbing of most of the web, as far as anyone knows before attackers did, and the fix shipped. The second half runs through people. A host has to install it, and for more than a third of WordPress sites, an owner has to ask for a version upgrade nobody has asked for in years. That email takes ten minutes, and it is the part no model can send for you. If you want the wider picture of where AI fits in your security setup, our AI cybersecurity playbook for small business owners is the place to start.

Frequently Asked Questions

What is PHP2Shell?

PHP2Shell is the nickname for CVE-2026-109618 and CVE-2026-109619, two critical flaws in the PHP programming language that were fixed on October 21, 2026, and rated 9.2 out of 10. They can let an attacker run code on a server through a web request, and they affect sites built on PHP, including WordPress. Researchers at Calif and Wiz found them with help from AI models including OpenAI’s GPT-5.6 Sol and Google’s Gemini 4 Argon.

Does updating WordPress fix PHP2Shell?

No. The flaws are in PHP, the language WordPress runs on, not in WordPress or its plugins, so WordPress updates cannot reach them. Your web host has to update PHP on the server, or move your site to a patched PHP version.

Which PHP versions are patched for PHP2Shell?

The PHP project shipped fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no official update, only patched source code for people who build PHP themselves, although some Linux distributions and long-term-support vendors patch older versions in their own builds. You can see your version in WordPress under Tools, Site Health, Info, Server.

Is my site protected if it uses Cloudflare?

Cloudflare switched on firewall rules for these flaws for all plans, including Free, on October 21, 2026, so sites behind it have an extra layer of protection. Cloudflare says that layer does not replace patching PHP itself, and attackers were already adjusting their payloads to get around the rules, so you still need your host to update.

Has your host said anything to you about PHP2Shell yet, or is this the first you are hearing of it? Tell us in the comments.