PHP2Shell is a pair of critical flaws in PHP, the programming language behind about 70% of websites, including WordPress. Researchers used AI tools to turn bugs that had been hidden for years into working attacks, and PHP released fixes on October 21, 2026. If your site runs on PHP, ask your host which PHP version you are on and confirm it is a patched one.