AI Found a Bug in the Software Behind 70% of Websites. Here Is What It Means for Yours
Updated: Oct 22
By Elevion Studio | October 23, 2026 | 6 minute read
The short answer: PHP2Shell is a pair of critical flaws in PHP, the programming language behind about 70% of websites, including WordPress. Researchers used AI tools to turn bugs that had been hidden for years into working attacks, and PHP released fixes on October 21, 2026. If your site runs on PHP, ask your host which PHP version you are on and confirm it is a patched one.
What happened with PHP2Shell?
On October 21, 2026, the PHP team released emergency security updates for two critical flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. PHP runs WordPress, Drupal, Joomla and many other website platforms. By the most widely used estimate, about 70% of websites use it [1][4][5].
The flaws are in PHP itself, not in a plugin or a theme. When a server runs out of memory halfway through a web request, PHP can leave behind data it should have cleaned up. A later request can then misuse that leftover data. According to the researchers, an attacker with no login could run code on the server or read sensitive memory, which can hold passwords, tokens and API keys [1]. PHP rated both flaws 9.2 on the CVSS v4.0 scale, which is critical [3].
The reach is wide. Wiz Research says every PHP version of the last decade, back to 5.4, is affected by at least one flaw, and that even a simple "Hello World" page on a vulnerable version can be exposed [1].
The timeline, in short:
August 19, 2026: Wiz Research finds the first flaw [1].
August 24: Wiz reports the flaws to the PHP security team. September 21: PHP starts building a fix [1].
October 20: PHP warns that a critical release is coming [3].
October 21: Patched versions ship and the details go public [3].
Did AI really find the bug?
Partly, and the details matter. Wiz says it used frontier AI models throughout its research. The flawed code had sat in PHP for more than a decade. What AI changed was the ability to turn the weakness into a working exploit. In Wiz's words, "a single researcher completed in a week what previously would have taken a world-class team months of work" [1].
OpenAI says the security firm Calif identified a critical flaw using one of its models, and that Wiz independently found and reported both vulnerabilities. It adds that, to its knowledge, AI found the flaws before attackers did [2].
So AI did not act alone. People directed it. But it made a very hard job much cheaper, and OpenAI notes the same abilities can help attackers build exploits too [2].
Is 70% of the internet really at risk?
No. About 70% of websites use PHP, but only unpatched sites are exposed. Here is how the headlines compare with the sources.
Headline claim | What the sources say |
"70% of websites are affected" | About 70% of sites use PHP [1][4][5]. Patched sites are not exposed. No source says how many remain unpatched. |
"The internet is being taken down" | In the UK, 32 government services went offline, largely as a precaution. Downing Street said offline did not mean hacked [5]. |
"Attackers are exploiting it everywhere" | Cloudflare's chief executive reported millions of attempts [5][6]. Whether they succeeded is unclear. A Calif researcher said exploitation did not look widespread [5]. |
"The most serious flaw in five years" | This is the view of the former head of the UK's National Cyber Security Centre [5]. Wiz called the flaws arguably among the most severe ever found [1]. Both are opinions. |
Amazon Threat Intelligence also detected an exploit attempt on October 17, four days before the patches shipped. It says it is unclear how the attacker got that information [6].
Is my website affected?
It may be if your site runs WordPress, Drupal, Joomla, Magento or any custom PHP build. Sites that do not use PHP are not affected by these flaws.
The fix happens at the server level. Updating plugins, themes or website code does not fix this, because the flaw is in the PHP runtime [4]. If your hosting provider manages PHP, they need to apply the update.
The patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive updates from the PHP project, though some vendors provide their own backported fixes. PHP 8.2 reaches end of life on December 31, 2026 [3].
What should you do today?
Steps 1 to 4 follow the PHP and Cloudflare guidance. Steps 5 and 6 follow advice reported in the sources.
Ask your host or developer which PHP version your site runs. Get the answer in writing.
Get the update applied. PHP says there are no complete mitigations and that updating is the only safe choice [3].
Keep your firewall protections on. Cloudflare enabled protections by default on every plan, free ones included, but says customers should still patch [4].
If you are on PHP 8.1 or older, make a plan. Confirm your host provides a backport, or upgrade to a supported version [3].
Look back as well as forward. Amazon advises checking for suspicious activity back to at least October 17 [6]. Ask your host for logs.
Change passwords and keys if you have any doubt. The flaws can expose them from server memory [1], and China's industry ministry urged organizations to change them [5].
What if a platform manages my site?
Then patching is your provider's job, and this week showed why that matters. Still, ask them to confirm in writing which PHP version your site uses and when it was updated.
The Guardian reported particular concern about schools, local governments and charities, which may lack security staff to apply a fix like this [5]. Many small businesses are in the same position. A website is not a one-time build. Someone needs to own updates, backups and checks every month, so a day like October 21 is a routine task and not a scramble.
What comes next? Predictions
These are forecasts, not facts, and both come from companies with a stake in the topic.
Prediction from OpenAI: similar AI-found vulnerabilities will "increase sharply in the coming months" [2].
Prediction from Wiz: complexity "may no longer provide a meaningful barrier" to exploitation, because AI cuts the time and skill an attack needs [1].
Our own expectation is a prediction too: the gap between a fix being released and attackers trying it will keep shrinking. Sites with a steady update routine will cope. Sites left alone for a year will not.
There is a hopeful side. The same tools help defenders find flaws first. OpenAI says it has committed $1 billion in subsidized access for frontline defenders with limited security resources [2].
Key takeaways
PHP2Shell is two critical flaws in PHP itself, patched on October 21, 2026.
About 70% of websites use PHP. Only unpatched sites are exposed.
AI helped find the flaws and build working exploits, with people directing the work.
Millions of exploit attempts are confirmed. Successful attacks at scale are not.
Plugin updates do not fix this. The PHP version on your server does.
FAQ
What is PHP2Shell?
It is the nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They could let an attacker run code on a server or read sensitive memory without logging in [1][3].
How do I find out which PHP version my website uses?
Ask your hosting provider or developer. Then compare the answer with the patched versions: 8.5.12, 8.4.27, 8.3.36 or 8.2.35 [3].
My WordPress plugins are all up to date. Am I safe?
Not necessarily. The flaw is in PHP, so plugin and theme updates do not fix it. The PHP version on your server must be updated [4].
Does a firewall protect my site?
It helps but does not replace the update. Cloudflare says its protections are on by default and that customers should still patch [4].
Was my site hacked?
The sources cannot tell you. The UK's National Cyber Security Centre reported no successful hacks from the flaw at the time of publication [5]. Check your logs, as step 5 above suggests.
Need a hand with your website?
If you are not sure what your site runs on or who looks after updates, we can help you find out. Tell us about your site through our inquiry form, or see how we work on our services page.
References
All sources were read in full on October 23, 2026.
Wiz Research. "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet." October 21, 2026. https://www.wiz.io/blog/php2shell-php-rce
OpenAI. "Patch the Planet: global response coordination as agents uncover critical vulnerabilities." October 21, 2026. https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/
The PHP development team. "Security advisory: Critical remote code execution vulnerabilities, update now." PHP.net, October 21, 2026. https://www.php.net/archive/2026.php
Cloudflare. "Cloudflare deploys protections against php2shell vulnerability." October 21, 2026. https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
The Guardian. "Websites across world hit by millions of attempts to exploit PHP code flaw." October 22, 2026. https://www.theguardian.com/technology/2026/oct/22/websites-across-world-hit-by-millions-of-attempts-to-exploit-php-code-flaw
The Register. "Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure." October 22, 2026. https://www.theregister.com/cyber-crime/2026/10/22/hackers-pile-on-php2shell-as-aws-reveals-attacks-began-before-disclosure/5304749
Published by Elevion Studio. This post explains public reporting and is not a security audit of your site.
Comments