PHP2Shell: AI-found PHP flaws and what small sites must do

1. What happened

On October 21, 2026, the PHP team released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and urged all users to update immediately. The flaws can let an outsider who has not logged in run code on the server remotely, and the team says every PHP installation that serves web requests is at risk, whether it uses PHP-FPM, Apache with mod_php, LiteSpeed or another setup (PHP official site). There are no fixed releases for PHP 8.1 and older; the developers have offered only minimal mitigations for 7.4 through 8.1 (JPCERT/CC alert).

Wiz, which took part in the research, says every PHP version released in the past decade, going back to 5.4, is affected by at least one of the flaws, and that it demonstrated running code without logging in on the latest WordPress, Drupal and Joomla. It adds that passwords and authentication keys could be read from server memory (Wiz write-up). According to W3Techs, 69.2% of websites whose server-side language is known use PHP, and 26.8% of those are on version 7, which gets no fixed release (W3Techs).

2. In Japan, the Prime Minister asked for action that night

On the night of October 21, Prime Minister Sanae Takaichi posted on X asking site operators to check whether their sites use PHP and to be ready to apply the fix due at 11 p.m. Japan time. If that was not possible right away, she said that taking a site offline temporarily was one way to reduce the risk (PM's post on X). The next day she wrote that her own official site had been taken offline for the fix, and asked site administrators to follow the alert account of the National Cybersecurity Office (PM's post on X).

IPA issued a follow-up on countermeasures on the 22nd (IPA). The same day, JPCERT/CC said it had confirmed that PHP is widely used in Japan and asked operators not only to apply the fix but also to check whether they had already been compromised. Signs to look for include unusually long PHPSESSID cookies, suspicious multipart/form-data requests followed by memory-limit errors, and PHP processes crashing unexpectedly. It warns that finding no traces does not prove there was no attack (JPCERT/CC).

Our view We think the sites most at risk belong to small businesses whose site was built by an agency with no maintenance contract and still runs an old PHP on a rental server. If customer details are taken through an inquiry form or members' page, the company faces apology and investigation costs, and customers will ask it to explain how it handles information. Large companies took their sites down and fixed them overnight; a company with no one in charge stays exposed for days until someone notices. Check your site's PHP version, and who you can ask to update it, this week.

3. Why it matters that AI found it

Wiz writes that the underlying defects had existed for decades, but proving they could be exploited required a chain of steps so complex that it was at the edge of what human researchers could manage, and that frontier AI models lowered that barrier sharply. It says working exploits for several applications could be built in hours (Wiz write-up). According to TechTarget, OpenAI said its GPT-5.6 Sol model helped find the flaws and that it had spent two months preparing fixes with maintainers and researchers (TechTarget).

According to the Associated Press, OpenAI said these bugs are among several significant vulnerabilities it has already found and is working to fix, and that it expects similar findings to increase sharply in the coming months. The AP also reported that government bodies and other organizations in Europe and the U.S. took their sites offline temporarily to apply updates (AP report).

Our view If AI speeds up how fast holes are found, we believe attackers will use the same kind of AI that defenders do. Old systems once thought too complex to be targeted in practice will become targets within a short time. Companies that have put off updates as a once-a-year chore will be the ones unable to keep up in the short gap between disclosure and attack. We expect the damage to split clearly between companies that know what runs on which server and can update on the day a flaw is announced, and those that cannot.

4. What small businesses should check now

List every website, booking form, online shop and admin screen you run that uses PHP (any WordPress site runs on PHP)
Confirm with your hosting control panel or web agency that each is on PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later
If anything is on 8.1 or older, agree on a target version and a date for the work with your agency or host
Ask someone to check the logs for the signs JPCERT/CC lists: odd cookies, memory-limit errors and crashed processes
Decide who will apply updates next time this happens, and how to reach them

Our outlook

Over the next six months to two years, we expect AI to keep digging up holes in old software, and attacks starting within hours of a fix being published to become normal. In the same period, consumers will increasingly let AI find and compare shops and suppliers for them. Sites that are down, defaced, or impossible to judge as safe are likely to be dropped at the comparison stage. Defence will shift from people chasing alerts by hand to systems where AI keeps watch and problems are fixed the same day. The companies that first list what runs where, and hand updates and monitoring to AI and a named maintainer, will keep being chosen by both customers and their AI agents. Now is the time to lay that groundwork.

Questions this article answers

What is PHP2Shell, and does it affect my company's site?

It is the nickname for two critical PHP flaws fixed on October 21, 2026, which can let attackers take over a server without logging in. Any site running on PHP, including WordPress sites, may be affected, so check that PHP is on 8.5.12, 8.4.27, 8.3.36, 8.2.35 or later.

What should we do if our site is on an old PHP version?

PHP 8.1 and older get no fixed release, so you need to move to a supported version. If you cannot move right away, Japan's Prime Minister and CERT-EU both mention taking the site offline temporarily as a way to reduce risk. Also check the logs for the signs of compromise that JPCERT/CC lists.

Sources

Related Q&A

Related services

If you want to try this in your own business

To see how the topics in this article would apply to your own operations, and what it would cost, send us a message through the contact form.

AI Weekly, Oct 19: usage gap widens as model prices fall