PHP2Shell: AI helped find critical PHP bugs. Check your website's PHP version today

On 21 October 2026 the PHP project released an urgent PHP security update for two critical bugs, now known as PHP2Shell. PHP runs WordPress, Joomla, Drupal and many other website systems, so every small business website on PHP that has not been updated is at risk. Researchers say AI models helped them find the bugs and build working attacks. Here is how to check your website and what to ask your hosting company, based on PHP's advisory, CERT-In's note, CERT-EU's advisory and the researchers' report, read on 22 October 2026.

What happened: PHP fixes two critical bugs found with AI help

• The fix. PHP's advisory of 21 October 2026 says PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities "that can allow unauthenticated remote code execution". In plain words: an outsider, without any password, could run their own commands on your website's server. PHP says every installation that serves web requests is at risk.
• India. CERT-In, India's cyber security agency, published Vulnerability Note CIVN-2026-0510 the same day. It rates the issue "CRITICAL" for "All organizations and individuals using PHP."
• The AI part. Wiz, a security company whose researchers reported the bugs, says it used AI models throughout: Google's Gemini 4 Argon, OpenAI's GPT-5.6 Sol and its own Wiz Atlas. In its words, "a single researcher completed in a week what previously would have taken a world-class team months of work." Wiz showed the attack on WordPress, Drupal and Joomla, and says every PHP version back to 5.4 is affected by at least one of the bugs.
• First attack code. CERT-EU, the cyber security team of the EU institutions, wrote on 21 October 2026 that sample attack code had begun to circulate, which "raises the likelihood that attackers are already exploiting the vulnerabilities."

What is not known: how many websites in India are affected, and whether any have been attacked. CERT-In's note does not say.

Why it matters for a small business

Your website is where many customers check you before they call or pay. Wiz says an attack could let someone "take control of affected servers, steal sensitive data, and deface the websites running on them." For you that means changed pages, details taken from your enquiry or order forms, and your name on it.

AI also changes the timing. Wiz writes that AI "changes the economics of both discovery and exploitation": the same help that found the bugs makes attacks easier to build. So this update cannot wait for your yearly website maintenance.

Who should care

• Owners whose website or online shop runs on WordPress, Joomla, Drupal or other PHP software
• Businesses on shared hosting who have never looked at their PHP version
• Anyone whose website forms collect customer names, phone numbers or orders
• Web developers and agencies who look after client websites

What changes for your website

Look at the full version number. "8.3" alone does not tell you; "8.3.36" does.

One caution: PHP notes that Linux distributions got the fixes in advance and some fix older versions themselves, so a server can be fixed under an older-looking number. Only your host can confirm it.

How to check your PHP version and get the fix this week

1. Find the version. In WordPress, go to Tools, then Site Health, open the Info tab, expand Server and look for "PHP version", as WordPress's own help page explains. For any other website, ask your developer or host.
2. Compare it with the table above.
3. Ask your host to confirm the fix in writing. WordPress.org notes that "Your hosting company determines which versions of PHP are available for your site". Send this to their support:

Hello, my website [your website address] is hosted with you. On 21 October 2026 PHP released security fixes for CVE-2026-109618 and CVE-2026-109619 (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35). Please confirm in writing:

1. Which PHP version my website uses now.
2. Whether the fixes for both CVEs are installed on the server of my website.
3. If my PHP version is 8.1 or older, whether you provide a fix, or how I can move to a newer version.

Thank you.

4. Changing the PHP version yourself? Take a backup and update WordPress, themes and plugins first. WordPress.org cannot promise every theme or plugin works on a newer PHP version, so check your site afterwards.
5. If the fix cannot be confirmed soon and your site takes orders or holds customer details, ask your host about taking it offline until it is fixed. CERT-EU advises organisations to consider this when they cannot patch at once.
6. Developers on a VPS or cloud server: install your Linux distribution's updated PHP packages and restart PHP. PHP's temporary settings only reduce the risk; they "do not make an installation safe".

On a website builder where you never choose a server or PHP version, there is nothing for you to change; the platform looks after its servers.

Then make it a monthly habit: PHP version, updates, a backup that works. Our guide on turning team knowledge into SOPs with AI shows how to write that checklist once. And collecting less customer data, one habit from our guide on customer data, privacy and AI tools, leaves less for an attacker to take.

What to watch next

• Attacks now that details are public. CERT-EU thinks attackers may already be using the bugs. Read your host's emails this week.
• More bugs found with AI. Wiz wants AI-assisted bug hunting to become "routine". Expect more urgent updates, and keep automatic updates on.
• Notes from CERT-In and your host. They may add instructions, but PHP says only the update is a complete fix.

Not sure where AI can help your business safely? The free AI Business Checkup takes about three minutes.