PHP2Shell: updating WordPress won't fix these PHP flaws

Cracked stone PHP elephant split by an orange lightning bolt in a red-lit server room, with the text

Article by Kami

According to Al Jazeera and Reuters (22 October 2026), the US NSA advised taking offline any website that cannot be updated immediately, and the French Interior Ministry deactivated the official websites of local administrative offices. The cause comes down to two PHP flaws, nicknamed PHP2Shell. If you host a WordPress site, a forum or the web panel of a game server, this concerns you, and it cannot be fixed inside WordPress.

Why these PHP flaws slip past WordPress updates

The two flaws carry the identifiers CVE-2026-109618 and CVE-2026-109619 (a CVE is the public number assigned to a known flaw). The PHP team rates them 9.2 out of 10 on the CVSS v4 scale, which measures how severe a flaw is from 0 to 10. IT-Connect notes that other sources report 10 out of 10. In both cases it is remote code execution (RCE): someone with no account can run their own commands on your server.

IT-Connect article of 21 October 2026 titled — IT-Connect, Florian Burnel, 21 October 2026: the French-language article on the fixes and the affected versions.

These PHP flaws sit in the engine of the language that runs the site, not in the code of WordPress or of any plugin. Updating WordPress, its theme and its plugins therefore changes nothing. The release announcements published on 21 October on php.net leave no room for doubt: « There are no complete mitigations, updating is the only safe choice. »

According to IT-Connect, every mode that serves web requests is affected: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. These are the different ways a server runs PHP. The risk is judged highest with mod_php, where an unauthenticated request can trigger the attack before the site’s code even runs. Wiz says it achieved unauthenticated code execution on the WordPress, Drupal and Joomla images it tested.

Attacks already under way, according to the sources

The sources do not all say the same thing. On the late afternoon of 21 October (New York time), Huntress, a security vendor, had observed no exploitation among its partners, while noting that other researchers were reporting attacks. Fortune reports that Amazon (AWS) describes a flaw « now being broadly exploited in the wild », and that Cloudflare counted hundreds of thousands of attempts within two hours, then millions by the evening of the 21st.

A leak sped up the schedule. Huntress says a post announcing the disclosure circulated on 20 October, and that PHP published its fixes the next day, earlier than planned. On the size of the affected pool, Fortune cites 22.6 million potentially vulnerable instances according to Palo Alto Networks. The « 70% of the web » figure comes from Wiz, and Fortune states it did not verify it.

Wiz Research blog post dated 21 October 2026, — Wiz Research, Sagi Tzadik, Shir Tamari, Nir Ohfeld and Tomer Schwartz, 21 October 2026: the analysis behind the 70% figure.

A two-sided discovery, with AI

The two PHP flaws were found with the help of AI models. According to Al Jazeera, Calif, a security firm, reported the first on 11 August while working with OpenAI, which had invited it into its Patch the Planet program. Fortune dates the discovery to 1 August and cites GPT-5.6 Sol. Wiz, for its part, says it identified its first defect on 19 August with Gemini 4 Argon, GPT-5.6 Sol and its Wiz Atlas tool, then alerted the PHP team on 24 August. The fixes shipped on 21 October, about two months later.

We previously covered how OpenAI shipped GPT-5.6-Cyber, a model built to find flaws. PHP2Shell illustrates what such tools change on both sides, and the PHP Foundation warns that they « find bugs faster than ever, for defenders and attackers alike ».

The checklist for your hosting

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Against these PHP flaws, the five points below follow what PHP, IT-Connect and Huntress say.

Read the PHP version your site really uses. In WordPress, open Tools, Site Health, Info tab, Server section. Otherwise, a phpinfo() page uploaded temporarily shows the same information (delete it afterwards). The php -v command-line command may report a different version from the one your web server uses.
Aim for a fixed version. On Debian and Ubuntu, IT-Connect warns that the version number stays the same after the fix: it is the package revision that changes (for example 8.1.34-9 on the Sury repository). A site that still shows the old number is therefore not necessarily vulnerable. Ask for, or check, the revision.
Shared hosting: write to support. You do not control PHP, so ask for the date of the fix. In the sources we consulted we found no statement from any specific French host, so we assert none.
VPS or dedicated server: update the package, then restart. PHP-FPM or Apache must be restarted for the fix to take effect. Internet-facing servers come first.
PHP 8.1 or older: plan the migration. The PHP team only published minimal source backports for versions 7.4, 8.0 and 8.1, which you must compile yourself, and nothing official below that. PHP 8.2 will also stop receiving fixes on 31 December 2026.

If you cannot update, or if you have doubts

For an end-of-life version, Huntress advises removing it from public access or putting it behind a VPN or a web application firewall (WAF, a filter that inspects web requests). php.ini settings circulate as stopgaps, but IT-Connect stresses that they only cover part of the attack paths, which matches PHP’s warning: no configuration replaces the update.

If you suspect an intrusion, Huntress recommends isolating the server, keeping the web and PHP logs, then looking for unknown files in the site folder, scheduled tasks and accounts created without you. Wiz also demonstrated a leak of PHP’s memory, which according to IT-Connect can contain passwords or API keys. Our reading: on a server that stayed exposed without the fix, changing those secrets after the update is a reasonable precaution.