Information correct as of 21 October 2026. PHP’s fixed releases went out at 14:00 UTC that day.
PHP shipped emergency security releases on 21 October 2026 to fix two critical flaws in the language itself. Tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, they can let an attacker who has never logged in run code on a web server, read passwords and API keys from its memory, or crash it. PHP rates both 9.2 out of 10 on CVSS v4.0. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and PHP’s advisory says updating is the only complete fix.
The “14-year-old” label holds up. Calif traced the earliest affected code path to PHP 5.4.0, released in March 2012, and Wiz says every PHP version from the last decade is hit by at least one of the bugs. The “70% of the internet” figure needs a qualifier. W3Techs finds PHP on 69.3% of the websites whose server-side language it can identify, which is the pool at risk; plenty of those sites are already patched by their host or shielded by a firewall.
Any website, shop or landing page running on PHP needs its PHP runtime updated, and that job sits with whoever hosts it. Updating WordPress, a plugin or a theme does nothing for this. The flaws also say something about AI: they sat in plain view for years because exploiting them was too fiddly for almost anyone to bother, and that barrier has gone.
Two memory bugs in how PHP recovers from errors
Both flaws come from what PHP does when a request fails halfway through. If a request hits PHP’s memory limit, or another fatal error, at exactly the wrong moment, PHP can leave half-built internal data behind or keep pointers to memory it has already freed. A later request handled by the same worker then trusts that stale data. An attacker who can trigger the failure on purpose, with a crafted upload request for example, can turn the corrupted memory into code execution.
PHP rates the risk highest for Apache with mod_php, where an unauthenticated request can trigger the attack before any application code runs, with default settings. PHP-FPM, the setup behind most Nginx sites, is exposed too: remote code execution there was confirmed through code paths in the application, such as session handling or WordPress’s own data decoding. PHP also lists php-cgi, FrankenPHP and LiteSpeed as at risk.
Which platforms does PHP2Shell affect?
Every application running on an affected PHP version inherits the flaws, because they sit in PHP itself. Researchers proved the point by taking over eleven widely used platforms before login, on releases that were current when they tested.
If the table extends beyond the screen, scroll sideways to view all columns.
| Platform | What it is used for | Taken over by |
|---|---|---|
| WordPress 7.1.2 | What it is used forWebsites, blogs and WooCommerce shops | Taken over byCalif, Wiz |
| Drupal 11.4.3 | What it is used forCorporate, university and government sites | Taken over byCalif, Wiz |
| Joomla 6.1.4 | What it is used forBusiness and community sites | Taken over byCalif, Wiz |
| Magento 2.4.9 | What it is used forOnline shops, the open-source edition of Adobe Commerce | Taken over byCalif |
| Laravel 13.11 | What it is used forFramework behind many custom web apps | Taken over byCalif |
| Symfony 8.1 | What it is used forFramework used in custom apps and enterprise sites | Taken over byCalif |
| MediaWiki 1.46.2 | What it is used forWikipedia and internal company wikis | Taken over byCalif |
| Nextcloud 35.0.1 | What it is used forSelf-hosted file sharing | Taken over byCalif |
| phpMyAdmin 5.2.3 | What it is used forWeb panels for managing MySQL databases | Taken over byCalif |
| Roundcube 1.7.4 | What it is used forWebmail | Taken over byCalif |
| WHMCS | What it is used forBilling and client portals for hosting firms | Taken over byCalif |
The list is a sample. Wiz says even a “Hello World” script on a vulnerable PHP version can be enough, so other PHP software, such as PrestaShop, Moodle and bespoke company sites, carries the same exposure, though no attack on them has been published. Keeping WordPress or Magento up to date gives no protection here: Wiz attacked the latest WordPress, Drupal and Joomla images. Wiz also showed a separate attack that reads passwords, tokens and API keys straight out of server memory without taking the server over.
PHP also sits inside products that do not look like websites, such as appliances and hosted services. The NCSC points to an inventory of software with a PHP dependency, published by its Dutch counterpart, as a starting list for those.
A bug PHP spotted in 2024, made exploitable by AI in 2026
The lineage is long. Stefan Esser found PHP’s first memory-limit remote vulnerability in 2004, and a related out-of-memory bug was reported in 2020. In 2024, during PHP’s first external security audit in years (carried out by Quarkslab through OSTIF and funded by Germany’s Sovereign Tech Agency), a PHP core developer spotted the out-of-memory problem behind CVE-2026-109618. Nobody found a concrete way to exploit it, every candidate fix broke something else, and the work stalled. The PHP Foundation’s own account calls the delay “a structural failure”, caused by the security team’s decision process and its lack of resources.
Early headlines credit OpenAI, which tells only part of the story. Ryan Austin at the security firm Calif found the first route to remote code execution with OpenAI’s GPT-5.6 Sol, under OpenAI’s Patch the Planet programme, and reported it to PHP on 11 August. OpenAI’s own Codex Security team reported the same root cause that day. Wiz, now owned by Google, found and reported both flaws independently using Gemini 4 Argon, GPT-5.6 Sol and its own Wiz Atlas, and credits Gemini 4 Argon with the larger share of its work.
AI removed the obstacle that had kept the bug theoretical. Wiz says one researcher working with frontier models finished in a week what would once have taken a top team months, because the models could adapt the exploit to each PHP version, configuration and memory layout through repeated testing. Calif adds a useful corrective: its find used no special harness and no models beyond those anyone can use. Austin knew PHP’s vulnerability history and steered the model towards an old class of bug that, he argues, models would not have gone looking for on their own. OpenAI calls the result “one of the most impactful security issues in recent memory”.
The embargo leaked a day early, and attack traffic followed
Coordinated disclosure held until 20 October. At about 15:00 UTC the two CVE numbers began circulating online, with a wrong release time and a wrong score of 10.0, and PHP pulled its release forward from 22 to 21 October. That evening Calif mistakenly published a video of its exploit working against several targets. Copies spread after it was deleted and, according to the PHP Foundation, sped up the race to build proof-of-concept code. At 07:41 UTC on 21 October, Chainguard published built images containing the fix more than six hours early, which PHP says let anyone study the patch before most users could get it.
Reports differ on whether PHP2Shell is already being exploited, and the safe reading is to assume it is. PHP says it found no working exploit among the code circulating at release. Cloudflare says it saw attack traffic against its customers after the leak, with attackers changing their payloads to slip past its rules, and watchTowr reports exploitation in its honeypot network. CISA has told organisations to patch immediately, and the UK’s National Cyber Security Centre has issued an alert urging immediate action. Forbes reports that some European governments took their websites offline while they patched.
Can UK businesses tell if their sites are exposed?
Yes, once they know which PHP version each site runs, and almost every version from 5.4 onwards is affected until it is updated. Most marketing teams do not manage PHP themselves, so the question goes to whoever does: the hosting company, the agency or the in-house developers. On WordPress, the PHP version appears under Tools, Site Health, Info, Server, and WordPress.org has confirmed that no WordPress update is required or planned for these flaws. OpenAI has also published a version checker as a Codex skill. Cloudflare says customers using its free or paid web application firewall have been protected by default since 03:02 UTC on 21 October, which buys time, though Cloudflare itself tells customers to patch as well.
Shared hosting needs one extra question. Picking a newer PHP branch in the control panel only helps once the host has installed the patched builds, so ask the host which build is running. Linux distributions received the fix in advance, while PHP warns that the volunteer-run remirepo repository, common on Red Hat-family servers, would not have updates on release day.
Which hosts and security firms have added protection?
Most large hosts put interim protection in place on 21 October and started rolling out the fixed PHP the same day, though progress varied widely by the evening. Firewall rules and switched-off PHP features reduce the risk, while only the patched PHP removes it, so a host that says “you are protected” should still confirm which build is running.
Firewall and network providers moved first. Cloudflare switched on default rules for free and paid WAF customers at 03:02 UTC on 21 October. Fastly published a virtual patch that customers of its Next-Gen WAF have to apply, and warned that blocking at the edge gives only partial protection. Wiz credits Akamai, AWS, Imperva, Microsoft and Vercel with preparing mitigations too. Google Cloud patches App Engine standard apps on PHP 8.2 or newer automatically, while Cloud Run, GKE and App Engine flexible users must rebuild or redeploy, and it will not patch PHP 8.1 or older runtimes.
Among managed WordPress hosts, Automattic told Newsweek that WordPress.com, WordPress VIP, WP Cloud and Pressable were already protected, with nothing for customers to do. SiteGround switched off the affected PHP features on all its servers before the fix shipped. GoDaddy had patched every PHP version on its Managed Hosting for WordPress by 19:30 UTC, while its standard Web Hosting ran on interim mitigations until vendor packages arrived, and its VPS customers must update themselves. Cloudways applied the configuration changes PHP recommends, began a phased rollout of the official patches, and is using extended-support partners to cover outdated PHP versions. Host status pages collected by Codeable and Meow Apps show WP Engine and Flywheel relying on Cloudflare and Fastly protection while they patch, Kinsta rolling out interim protection and emailing customers as each site is patched, and Pantheon patching live sites on PHP 8.2 to 8.5.
Shared hosts depend on control panel and operating system vendors, so many sit a step behind. cPanel has added patched packages to EasyApache 4, including backports for PHP 7.4, 8.0 and 8.1, and Plesk has released fixed PHP 8.2 to 8.5 for Linux. CloudLinux, which runs underneath many cPanel hosts, was still rolling out its builds, and Codeable reports that its Imunify360 rules block the public exploit on Apache but only log it on LiteSpeed. Namecheap, DreamHost, InMotion Hosting, OVHcloud and the UK’s Unlimited Web Hosting all reported mitigations in place while patches roll out. Some hosts went further: Austria’s Anexia and Germany’s Uberspace and Netcup took PHP services offline until they could patch.
Hostinger is the notable gap. CybelAngel counts 142,401 internet-facing PHP hosts there, second only to Amazon, yet we found no public PHP2Shell statement from the company. Hostinger customers should ask support directly which PHP build their sites run.
What should UK marketing teams do next?
- Name the owner of every PHP site. List the main site, the shop, microsites, campaign landing pages and any forgotten WordPress installs, with the host and the person or agency that maintains each.
- Ask for the version number in writing. A reply of “patched” leaves room for doubt. Ask for 8.5.12, 8.4.27, 8.3.36, 8.2.35, or a vendor package confirmed to cover both CVE-2026-109618 and CVE-2026-109619, since backported packages keep their older version numbers.
- Turn on firewall protection while you wait. If a site sits behind Cloudflare, check its managed rules are switched on. A WordPress security plugin cannot stand in for this, because the attack runs inside PHP before WordPress loads.
- Treat PHP’s interim settings as a stopgap. Where an update has to wait, PHP’s advisory lists configuration changes, such as switching off session upload progress, that block the known attack paths. PHP says plainly that they do not make an installation safe. If even those cannot go on quickly, the NCSC says to consider taking the system offline, and to check anything left running unpatched for signs of compromise and backdoors. If a site does go offline, pause the paid campaigns pointing at it and log the downtime, so reporting does not mistake the outage for a drop in campaign performance.
- Assume secrets on unpatched servers may have leaked. The memory flaw can expose passwords, tokens and API keys. If a site ran an affected version after the 20 October leak, consider rotating the keys stored on it: payment gateway keys, CRM and email platform credentials, and ad platform API tokens.
- Retire old PHP. Sites on PHP 8.1 or earlier get no official release, and W3Techs counts 27.0% of PHP sites on version 7 and 7.7% on version 5. PHP has published source-only backports for 7.4, 8.0 and 8.1, and some Linux vendors ship packaged ones, but PHP 8.2 itself stops receiving security fixes on 31 December 2026. Budget the upgrade now.
What to watch next
Patch rates over the coming fortnight will show whether the warnings reached the long tail of small sites, where outdated PHP tends to linger longest. Cloudflare and watchTowr will be the early signal if scanning turns into mass compromise, which would most likely surface as defaced WordPress sites, card skimmers on online shops and spam pages. OpenAI says PHP2Shell is one of several significant vulnerabilities it has already found and is working to fix, and expects similar findings to rise sharply in the coming months. It has published a draft framework for handling such disclosures and is asking the security community for feedback. The PHP security team, for its part, has published 15 CVEs since 1 July and worked through more than 100 reports that proved invalid, duplicated or impossible to reproduce. The PHP Foundation is asking the companies and governments that rely on PHP to fund more security engineers.
The real lesson from PHP2Shell
For years, difficulty did quiet work as a defence. A bug that needed weeks of expert effort to weaponise usually sat below one any script could hit, and the PHP out-of-memory problem sat there from 2024 until August. PHP2Shell shows that ordering breaks down once a model can do those weeks of work in hours, and OpenAI concedes that attackers can use the same capability. Wiz ranks it alongside Heartbleed in 2014 and Log4Shell in 2021 as a possible turning point for security. For businesses, updates to shared software like PHP now need chasing on the day an advisory lands. WordPress owners can read what is new in WordPress 7.0 for the platform itself. For help working out which of your sites are affected and who needs to act, talk to AIWIZ.