PHP2Shell Explained: How AI Helped Find Critical PHP Flaws

You have updated WordPress, checked your plugins and changed your password. Then a security alert says your website could still be at risk. How?

The answer is the software working underneath WordPress: PHP.

The PHP2Shell vulnerability alert concerns two flaws in that software. On 21 October 2026, PHP released security updates addressing them. Here is what happened, how AI helped researchers and what website owners should check. PHP release advisory.

Checked: 22 October 2026. This is a researched explainer using official advisories and researcher reports, not an independent exploit test or an assessment of your server.

What is PHP2Shell?

PHP2Shell is the name associated with CVE-2026-109618 and CVE-2026-109619. A CVE number identifies a reported security vulnerability.

Under exploitable conditions, these flaws can allow unauthenticated remote code execution, or RCE: an attacker may make the server run code without first signing in. Researchers also demonstrated disclosure of sensitive process memory. Wiz research.

PHP runs on the server, handling tasks such as page generation and backend logic. WordPress depends on it. The faults therefore sit below the plugin or theme you see in your dashboard. UK NCSC explanation.

What went wrong inside PHP?

PHP uses temporary memory while handling a web request. The two flaws concern unfinished information and references that survive after their memory is released.

1. PHP may trust information that was never finished

With CVE-2026-109618, an out-of-memory error can interrupt PHP while internal request data is still being prepared. Cleanup may then treat that unfinished data as valid.

Think of someone marking a form “ready” before filling it in. Work stops suddenly, but another person trusts the ready mark. This is an analogy for incomplete state, not a literal description of the exploit. PHP’s first technical advisory.

2. A later request may encounter an old reference

With CVE-2026-109619, a PHP worker can retain a reference to memory belonging to an earlier request after that memory has been freed. A later request may encounter it before normal setup clears it.

Imagine a note saying “the file is in drawer three”. The file is removed, but the note remains. Following that outdated instruction illustrates the problem. A PHP worker is a process that handles requests; this analogy simplifies its memory behaviour. PHP’s second technical advisory.

How did AI help researchers?

Wiz reports using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol. Its account describes AI assistance with analysing code, developing and adapting exploit demonstrations, detection and checking the patch.

This still involved researchers, repeated testing, debugging and coordination with maintainers. A model suggesting a weakness is different from a verified finding. Wiz demonstrated attacks against WordPress, Drupal and Joomla deployments using their latest container images at testing time.

Calif also published its own research account, describing AI-assisted investigation and coordination with OpenAI and PHP.

The useful lesson is to keep verification beside AI-generated code. Our Gemini coding guide explains that habit through a smaller practice task.

Does this mean every WordPress website was hacked?

No. Exposure, an attack attempt and a successful compromise are different things. The PHP advisories describe differences between server setups and exploit paths. A working demonstration against one deployment is not proof that every website was breached.

The widely shared “70% of websites” figure also needs context. W3Techs reports PHP on 69.3% of websites whose server-side programming language it can identify, as of 22 October. That is a usage estimate, not a count of hacked sites.

Which PHP releases contain the fixes?

PHP announced these security releases on 21 October:

Distribution and support vendors may provide backported fixes: security changes added to their existing packages. Confirm the package advisory with your provider. PHP 8.1 and older no longer receive normal PHP-project updates; the announcement also describes limited source backports and vendor options. Official release and support details.

Example: A fictional shop updates every WordPress plugin but still uses unpatched upstream PHP 8.3.35. The PHP flaw remains. Its provider needs to apply the PHP fix, such as 8.3.36 for that branch or an applicable vendor backport. The plugin update and the PHP update address different layers.

What should a website owner do now?

ENISA recommends identifying PHP-based systems, coordinating with providers and applying the released updates, prioritising internet-facing applications. Use the flowchart to work out who needs to act.

For managed hosting: ask your provider to confirm that the PHP runtime serving your domain has fixes for both CVEs. Ask which package/build is active and when the fix was applied. A statement that WordPress is current does not answer that question.

For your own server: have the administrator apply the relevant vendor update and verify that the fixed runtime is active, following its deployment instructions. Check important pages, forms and logs afterwards.

If immediate updating is not possible, follow official temporary-mitigation advice with your administrator. The NCSC says to consider taking a system offline when those measures cannot be applied or would take too long. If securing or disabling it is delayed, it also recommends assessing for compromise and seeking incident-response help where needed.

Our practical interpretation: do not assume a WordPress maintenance plugin isolates the vulnerable runtime. PHP documents an attack path that runs before application code. Ask the provider how it will restrict public access if isolation is needed.

Is Cloudflare protection enough?

Cloudflare reports deploying WAF protections against PHP2Shell. A WAF filters web traffic. Cloudflare explicitly recommends applying the PHP update even with those protections enabled. Treat filtering as an additional layer while patching, not confirmation that PHP itself is fixed. Cloudflare guidance.

Updating also does not establish that an earlier intrusion never happened. AWS reports an exploitation attempt dating to 17 October in its sensors. Keep investigation separate from patch verification if there are signs of compromise. AWS threat report.

Start with one clear question for your host

“Has the PHP runtime serving my website received fixes for both PHP2Shell CVEs, and can you confirm the active build?”

That answer gives you a useful next step. AI helped researchers investigate these flaws; protecting a live website now depends on getting the correct fix deployed and verified.