PHP2Shell Explained: What It Means for Your Website

Your WordPress site is exposed to PHP2Shell if the server it runs on uses a PHP version without the fix, because the flaws sit in PHP itself and not in WordPress. Under the right conditions they let an unauthenticated attacker run code on the server, and the PHP project says updating is imperative.

At Layer3Labs, we build custom agents and enterprise integrations for businesses.

On October 21, 2026, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical flaws. The vulnerabilities were detailed by researchers at Wiz Research, who named their exploit script php2shell, while official coordination and patch details were released by the PHP Foundation.

What to Do Today If You Run PHP

Updating PHP on your hosting is the only complete fix, according to Wiz. The flaws are in PHP's engine, so WordPress, Drupal and Joomla sites are exposed because they run on PHP, and Wiz demonstrated code execution against all three.

If your organization hosts websites or web applications powered by PHP, work through these four steps:

• 1. Check your PHP version: Log into your hosting control panel or administrative dashboard to find the exact PHP version your site is using, or contact your hosting support team to confirm the runtime version.
• 2. Compare it with the fixed releases: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If your version on that branch is older than the fixed release, it needs the update.
• 3. Ask your host to update: request the fixed release for your branch. If you are on any other branch, the four releases are the only ones the PHP project named, so ask your host about an upgrade path.
• 4. Watch for the warning signs listed in the section below until the update is done.

How to Check Your PHP Version and What to Do Next

Run OpenAI's PHP version checker, released as a Codex skill, or follow PHP's and your host's guidance to see whether your version is affected. Then apply the fixed release. If your version is too old to receive the fix, plan to take the site offline or rebuild it. PHP Foundation executive director Elizabeth Barron called updating affected systems "imperative."

The Verge reported that the flaw exists across roughly 20 years of PHP releases. Many of those older versions no longer receive maintenance, leaving unsupported systems with few recovery options. Two Japanese mobile games, World Quest and Save My Demonic World, are shutting down after running for over a decade because their older tech cannot be updated to patch the flaw.

To support under-resourced operators, OpenAI committed $1 billion in subsidized Daybreak access through Daybreak for Frontline Defenders. This initiative focuses on organizations with limited security budgets that protect essential services. OpenAI stated that it expects AI-found vulnerability disclosures to increase sharply in the coming months.

The Underlying Flaws in PHP Memory Management

PHP2Shell, named after an exploit script by Wiz Research, targets two critical security flaws in the core PHP runtime: CVE-2026-109618 and CVE-2026-109619. These two flaws allow an unauthenticated attacker to execute code remotely under specific conditions. Both vulnerabilities sit within the memory management and error handling systems that almost every web request activates.

The first vulnerability, CVE-2026-109618, enables Remote Code Execution (RCE) through Out-of-Memory (OOM) corruption. When a web request reaches PHP's memory limit at a specific processing moment, PHP can leave partially initialized internal data in memory and later treat that corrupt structure as valid. On Apache servers running mod_php, an unauthenticated request can trigger this condition before any application code executes. Full RCE was demonstrated with default settings on Apache with mod_php, and RCE was also confirmed on PHP FastCGI Process Manager (PHP-FPM) environments through application-level paths.

The second flaw, CVE-2026-109619, causes RCE through stale global state. When a fatal error occurs at a vulnerable execution point, PHP can leave its internal state pointing to memory that belonged to a previous request. A subsequent request handled by that same worker process can then use that freed memory. Researchers confirmed a use-after-free condition and worker crash, and demonstrated complete RCE against a real-world application running on Apache with mod_php.

Because these vulnerabilities reside inside the PHP binary itself, they expose popular Content Management System (CMS) platforms without requiring any security flaw in the application code. Wiz demonstrated unauthenticated RCE on WordPress, Drupal, and Joomla using the latest official container images available during testing. A simple script displaying plain text on an unpatched PHP version can be vulnerable.

Which PHP Versions Are Fixed and Which Are Exposed

The PHP project released four fixed versions on October 21, 2026: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Your hosting should run the fixed release for its branch. The PHP Foundation said: "If you run PHP, it is imperative that you update now."

According to research published by Wiz, every PHP version released over the past decade is affected by at least one of these two vulnerabilities, extending all the way back to PHP 5.4. The four fixed releases are the only ones the PHP project named, so for any other branch, ask your host about an upgrade path.

Wiz says the patch fixes the issue at its core and eliminates all variants in the patched release.

How Frontier AI Models Figured in the Research

Wiz reported using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol during its research process. Wiz stated that frontier models made it practical to adapt working exploits across multiple web applications in hours, even though the underlying flaws had existed in the PHP code base for more than a decade.

The PHP Foundation says Calif began an audit of PHP under the Patch the Planet program. Calif reported an unconditional RCE vulnerability to the PHP team on August 11. OpenAI independently reported the identical root cause, delivering additional attack vectors on September 18, with further attack vectors from Wiz on August 24.

The PHP Foundation disclosed that it had observed early warning signs of the OOM problem in 2024 during an external code audit conducted by Quarkslab, describing the prolonged delay in resolving the issue as "a structural failure." The Foundation says AI helps it validate security reports, but a person makes every call and works on every patch. Wiz thanks a group of companies, including Automattic, Akamai, Amazon Web Services, Cloudflare, Fastly, Google, Imperva, Microsoft, and Vercel, for helping prepare mitigations for customers who cannot patch immediately.

Warning Signs in Server Logs and Worker Activity

Wiz lists warning signs for defenders before patching. Because these flaws sit below the application layer, application logs may record very little context. Your host or developer can check for them.

Wiz points to these three signs:

• 1. Unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses.
• 2. Unexpectedly large or malformed PHPSESSID response cookies.
• 3. Unexplained PHP worker churn.

Severity Scores and Web Statistics Clarified

An incorrect CVSS score circulated before the release. Unofficial forum posts on October 20 claimed the vulnerability held a maximum Common Vulnerability Scoring System (CVSS) score of 10.0. The PHP Foundation confirmed that the official CVSS score is 9.2.

The disclosure timeline shifted because details leaked two days early. The official security release was originally scheduled for October 22, 2026, but the PHP project moved the release forward to October 21. At the time of release, the PHP Foundation had not identified any functional exploits, though proof-of-concept exploits began circulating after the October 20 leak, with public circulation increasing on October 21.

Wiz published that PHP powers "70% of all websites in the world." That figure is Wiz's own, not one we have verified.

Questions to Ask Your Hosting Provider or Developer

Small business owners who do not manage their own server infrastructure should contact their hosting support team or web agency immediately. Asking direct questions helps you confirm your specific environment has received the fix.

To verify your security status, ask your provider the following specific questions:

• 1. Has our server been upgraded to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35?
• 2. If our account runs an older PHP branch, what is the fastest procedure to upgrade our site to a patched, supported version?
• 3. Are any mitigations in place while the update is pending, and which ones?
• 4. Are our web server error logs recording any unusual PHP worker crashes or repeated out-of-memory errors?