PHP2Shell: What the AI-Discovered PHP Flaw Means for Your Business Website

On October 21, 2026, the PHP project released an emergency update for two critical flaws known as PHP2Shell. What made headlines was not only their severity, but how they were found: security researchers used AI models to uncover bugs that had been hiding in PHP’s code for more than a decade. Within hours, government agencies in Europe took websites offline as a precaution, and security vendors reported attack attempts.

If your company website runs on WordPress, it runs on PHP, and so do about 69% of all websites whose server technology is known, according to W3Techs.

Most business owners have never heard of PHP, and that is exactly the problem. Flaws like PHP2Shell rarely get fixed on time because nobody inside the business knows they are responsible for them. As a provider of IT services in Glendale, we see the same pattern again and again: the website was built years ago, the designer moved on, and no one has checked what the server is running since.

This guide explains what happened with PHP2Shell, why AI-discovered vulnerabilities change how fast businesses need to patch, and what to do this week.

What PHP Is and Why It Matters to Your Business

PHP is the programming language that runs on the web server behind your website. When someone fills out your contact form, logs into a client portal or loads a WordPress page, PHP does the work. Visitors never see it, so it is easy to forget.

Like any software, PHP needs security updates. Each version receives fixes for a limited time and then reaches end of life. After that date, new vulnerabilities in that version are not fixed by the PHP project.

What Happened With PHP2Shell

The two flaws, CVE-2026-109618 and CVE-2026-109619, are rated 9.2 out of 10 (critical). They allow remote code execution: an attacker can run commands on the web server without logging in. According to the official PHP advisory, every PHP installation that serves web requests is affected, including the common setups used by hosting companies.

The PHP team was direct about the fix: “There are no complete mitigations, updating is the only safe choice.”

Your PHP branch	Fixed version
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35
PHP 8.1, 8.0, 7.4	No official release, only source patches for those who build PHP themselves
PHP 7.3 and older	No fix

Once an attack can take over the server, everything on it is exposed: the website, form submissions, customer data stored in the database, and email accounts or passwords kept on the same hosting. A hacked server can also be used to send spam or attack others in your name.

The response was unusually dramatic. The Dutch National Cyber Security Centre took its own website offline, along with the government portal Overheid.nl, and France’s Interior Ministry put its websites into maintenance mode while patches were applied, as reported on October 21. Large organizations have security teams to make that call within hours. Most small businesses do not.

Found by AI: Why PHP2Shell Changes the Patching Clock

PHP2Shell was not found by a hacker or by accident. According to Wiz Research, the first flaw was discovered on August 19, 2026, and reported to the PHP security team five days later. Security firm Calif found the first bug during an AI-assisted audit of PHP’s source code using OpenAI’s GPT-5.6 Sol, and Wiz independently found the flaws using its own AI tooling together with Google’s Gemini 4 Argon and GPT-5.6 Sol, as The Next Web explains. Wiz says the vulnerable code had been present for more than a decade and affects PHP versions going back to 5.4.

In this case, AI helped defenders find the problem first, and the fix shipped before the details became public. That is good news. But the same technology is available to attackers, and it changes two things for every business that runs a website:

• More old bugs will surface. Code that looked safe for years is now being re-examined by AI at a scale no human team could match. OpenAI expects findings like this to rise sharply.
• The time to patch is shrinking. Wiz reports its team built working exploits across multiple applications in hours. Once a fix is public, attackers can compare the old and new code and start attacking unpatched servers almost immediately.

For a business, this means the old habit of updating “when we get to it” no longer works. Someone needs to be watching for critical updates and applying them within days, not months.

The Bigger Problem: Outdated PHP Versions

PHP2Shell will be patched on well-maintained servers within days. The servers that stay vulnerable are the ones running versions that no longer receive updates.

PHP version	Security updates until
8.5	December 31, 2029
8.4	December 31, 2028
8.3	December 31, 2027
8.2	December 31, 2026
8.1 and older	Already ended

Source: PHP supported versions

Based on W3Techs data from October 2026, nearly half of all PHP websites run a version that no longer receives security updates. About one in three still runs PHP 7 or older. Another one in six runs PHP 8.2, which reaches end of life on December 31, 2026, just two months from now. A scan by Bitsight during the PHP2Shell response found that only about a third of identifiable PHP servers were on a branch covered by the official fix.

An outdated version is not one vulnerability. It is every future vulnerability, left open permanently.

WordPress Plugins Multiply the Risk

For WordPress sites, PHP is only the foundation. Plugins and themes add their own code, and that is where most problems appear. According to Patchstack’s State of WordPress Security in 2026 report:

• 11,334 new WordPress vulnerabilities were reported in 2025, 42% more than in 2024.
• 91% of them were in plugins.
• About half of high-impact vulnerabilities were exploited within 24 hours.
• 46% had no developer fix available when they were made public.

Attackers use automated tools that scan thousands of websites at once. A small business site is not too small to be found. It is simply next on the list.

Why Outdated PHP Goes Unnoticed

In most small businesses, the website sits between several people, and each one assumes someone else is watching it.

Who	What they usually assume
Web designer or agency	“We built the site. Hosting and updates are the client’s job.”
Hosting company	“We keep the server online. Your PHP version and plugins are your choice.”
In-house IT person	“I take care of computers and email. The website is marketing’s area.”
Break-fix IT provider	“Call us when something stops working.”
Business owner	“Someone must be handling it.”

Nothing breaks when PHP falls out of support. The website loads normally, so nobody calls anyone. The first sign of a problem is often a hacked page, a Google warning or a flood of spam sent from your domain. Our guide to the signs your business has been hacked explains what to look for.

What to Do This Week

1. Find your PHP version. In WordPress, go to Tools → Site Health → Info → Server. Or ask your hosting company in writing.
2. Confirm the PHP2Shell fix. Ask your host whether the server runs 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a vendor-patched equivalent. Some Linux distributions patch without changing the version number, so ask for confirmation, not just a number.
3. Plan an upgrade if you are on PHP 8.2 or older. Test the site on a staging copy first. Old themes and plugins sometimes break on newer PHP, which is why upgrades get postponed.
4. Update or remove plugins. Update everything still maintained. Delete plugins you no longer use and replace plugins that are no longer updated.
5. Check your backups. Keep a recent copy of the website and database stored outside your hosting account, and confirm it can be restored.
6. Look for signs of compromise. Unknown admin users, changed files or strange redirects are warning signs. If PHP2Shell was unpatched on your server after October 20, it is worth a review.
7. Name one owner. Decide who is responsible for website updates from now on, and write it down.

How Managed IT Closes the Gap

The real fix for PHP security vulnerabilities is not a one-time update. It is making sure someone owns the job permanently. That is what managed IT services are built for.

With a managed IT provider, your website and hosting are treated as part of your IT environment, just like computers, email and the office network:

• Inventory. Every system is documented, including the web server, its PHP version and who has access.
• Patch management. Security updates are applied on a schedule, and emergency patches like PHP2Shell are handled the same day.
• End-of-life planning. Upgrades are planned months before a version loses support, not after a breach.
• Monitoring and backups. Problems are caught early, and a tested backup is ready if something goes wrong.
• One accountable partner. No more gaps between the designer, the host and the IT person.

Our cybersecurity services add protection such as firewalls and threat monitoring, and our development services team can test and upgrade older websites safely. To see how this fits together, read what is included in managed IT.

Not sure which PHP version your website runs, or whether it was patched? Contact Techbleed for a quick review