PHP2Shell: Update PHP Now If You Run a WordPress Site
In short
- Wiz Research, helped by frontier AI models, found critical flaws in PHP itself – the language behind WordPress, Drupal and Joomla.
- Two CVEs, severity up to CVSS 9.2, every PHP version back to 5.4 affected. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- The fix costs you €0 – one PHP update. A hacked shop costs you days of sales.
If you have a WordPress site, this one is for you. Security firm Wiz just disclosed PHP2Shell: flaws in the PHP engine that let an attacker take over a server without logging in. Not a bad plugin. Not a weak password. PHP itself.
What happened
On October 21, PHP released security updates and Wiz Research published the details. The bugs are tracked as CVE-2026-109618 and CVE-2026-109619, with severity reaching CVSS 9.2. Wiz says every PHP version released in the last decade is hit by at least one of them, going back to PHP 5.4.
What can an attacker do? Run code on your server without a password. Wiz demonstrated it on the latest WordPress, Drupal and Joomla. It also showed attackers can read server memory – where passwords, tokens and API keys live. Even a simple “Hello World” page on a vulnerable PHP version can be exposed.
The AI angle is the real story. The flaws sat in PHP’s code for over a decade. Turning them into a working attack was too complex for most humans. With Gemini 4 Argon, GPT-5.6 Sol and its own Wiz Atlas, a single researcher did in a week what Wiz says would have taken a world-class team months.
How to use it (what to do today)
- Check your PHP version. In WordPress: Tools → Site Health → Info → Server. Or look in your hosting panel.
- Update PHP. Safe versions: 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer. On shared hosting, it’s often one click in cPanel.
- Ask your host in writing. “Have you installed the PHP2Shell fixes (CVE-2026-109618 and CVE-2026-109619) on my server?” Get a yes or a date.
- On PHP 8.1 or older? The PHP project no longer ships updates for it. Move to a supported version, or confirm your host or Linux vendor gave you a backported fix.
- After patching, rotate keys. Since memory could leak, changing admin passwords and payment/API keys is cheap insurance.
Updating plugins won’t fix this. The bug is under your application – only a PHP update closes it.
Do the math: the fix costs €0 and ten minutes. Now the other side – an example, plug in your own numbers. A small online shop doing €300 a day is down for 3 days: €900 lost. Add a freelancer to clean up the hack, say €300. That’s €1,200 for one incident – before lost trust or leaked data.
What it means
Wiz compares PHP2Shell to Heartbleed and Log4Shell. The scary part isn’t this bug – it’s the pattern. AI makes old, “too hard to exploit” flaws practical. The same tools now work for attackers.
The good news: AI found it first, and the industry patched before the details went public. Cloudflare, AWS, Google, Microsoft and Automattic worked on mitigations. But the patch only helps if someone installs it. That someone is you or your host.
Ivan’s Take
Don’t panic – update. My own stores run on WordPress, so this goes to the top of my list today. Ten minutes and one email to your host is the cheapest insurance you’ll ever buy. And note the lesson: AI that finds bugs this fast means “update later” is no longer a strategy.
Sources: Wiz Research · PHP.net
If it doesn’t save you time or money, you won’t see it here
- Facts, not hypeEvery price and number is checked against the official source
- Always the real priceYou see what it costs before you click
- I say when it’s weakEven when it’s OpenAI or Google
