PHP2Shell: AI ki madad se mile critical PHP bugs. Apni website ka PHP version aaj hi check karein

21 October 2026 ko PHP project ne do critical bugs ke liye ek urgent PHP security update nikala. In bugs ko ab PHP2Shell kaha ja raha hai. WordPress, Joomla, Drupal aur kai doosre website systems PHP par chalte hain, isliye PHP par chalne wali har small business website, jo abhi tak update nahi hui, khatre me hai. Researchers kehte hain ki AI models ne unhe ye bugs dhoondhne aur working attack banane me madad ki. Is update me hai ki apni website kaise check karein aur apni hosting company se kya poochhein. Ye PHP ke advisory, CERT-In ke note, CERT-EU ke advisory aur researchers ki report par based hai, jo 22 October 2026 ko padhe gaye.

Kya hua: PHP ne AI ki madad se mile do critical bugs fix kiye

• Fix. PHP ka 21 October 2026 ka advisory kehta hai ki PHP 8.5.12, 8.4.27, 8.3.36 aur 8.2.35 do critical vulnerabilities fix karte hain, "that can allow unauthenticated remote code execution". Simple shabdon me: bahar ka koi bhi person, bina kisi password ke, aapki website ke server par apne commands chala sakta hai. PHP kehta hai ki web requests serve karne wali har installation khatre me hai.
• India. India ki cyber security agency CERT-In ne usi din Vulnerability Note CIVN-2026-0510 publish kiya. Isme issue ko "CRITICAL" bataya gaya hai, aur audience likhi hai "All organizations and individuals using PHP."
• AI wali baat. Wiz, ek security company jiske researchers ne ye bugs report kiye, kehti hai ki usne poori research me AI models use kiye: Google ka Gemini 4 Argon, OpenAI ka GPT-5.6 Sol aur apna Wiz Atlas. Uske shabdon me, "a single researcher completed in a week what previously would have taken a world-class team months of work." Wiz ne attack ko WordPress, Drupal aur Joomla par chala kar dikhaya, aur kehti hai ki PHP 5.4 tak ka har version kam se kam ek bug se affected hai.
• Pehla attack code. EU institutions ki cyber security team CERT-EU ne 21 October 2026 ko likha ki sample attack code ghoomne laga hai, jo "raises the likelihood that attackers are already exploiting the vulnerabilities."

Kya pata nahi hai: India me kitni websites affected hain, aur kya kisi par attack hua hai. CERT-In ka note ye nahi batata.

Small business ke liye ye kyun zaroori hai

Kai customers call ya payment karne se pehle aapki website dekhte hain. Wiz kehti hai ki attack se koi "take control of affected servers, steal sensitive data, and deface the websites running on them." Aapke liye iska matlab: badle hue pages, aapke enquiry ya order forms se chura li gayi details, aur un sab par aapka naam.

AI timing bhi badal deta hai. Wiz likhti hai ki AI "changes the economics of both discovery and exploitation": jis madad se bugs mile, usi se attack banana bhi aasaan hota hai. Isliye ye update aapki saal me ek baar wali website maintenance tak ruk nahi sakta.

Kise dhyan dena chahiye

• Wo owners jinki website ya online shop WordPress, Joomla, Drupal ya kisi aur PHP software par chalti hai
• Shared hosting wale businesses jinhone kabhi apna PHP version nahi dekha
• Har wo business jiske website forms customers ke naam, phone number ya orders lete hain
• Web developers aur agencies jo clients ki websites sambhalte hain

Aapki website ke liye kya badalta hai

Poora version number dekhiye. Sirf "8.3" se pata nahi chalta; "8.3.36" se chalta hai.

Ek savdhani: PHP ke hisaab se Linux distributions ko fixes pehle mil gaye the aur kuch purane versions ko khud fix karte hain, isliye server purane dikhne wale number par bhi fix ho sakta hai. Ye sirf aapka host confirm kar sakta hai.

Apna PHP version kaise check karein aur is week fix kaise paayein

1. Version dhoondhiye. WordPress me Tools, phir Site Health par jaiye, Info tab kholiye, Server expand kijiye aur "PHP version" dekhiye, jaisa WordPress ka apna help page batata hai. Kisi aur website ke liye apne developer ya host se poochhiye.
2. Use upar wali table se milaiye.
3. Host se fix ka written confirmation maangiye. WordPress.org likhta hai ki "Your hosting company determines which versions of PHP are available for your site". Unke support ko ye bhejiye:

Hello, my website [your website address] is hosted with you. On 21 October 2026 PHP released security fixes for CVE-2026-109618 and CVE-2026-109619 (PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35). Please confirm in writing:

1. Which PHP version my website uses now.
2. Whether the fixes for both CVEs are installed on the server of my website.
3. If my PHP version is 8.1 or older, whether you provide a fix, or how I can move to a newer version.

Thank you.

4. PHP version khud badal rahe hain? Pehle backup lijiye aur WordPress, themes aur plugins update kijiye. WordPress.org ye promise nahi karta ki har theme ya plugin naye PHP version par chalega, isliye baad me apni site check kijiye.
5. Agar fix jaldi confirm nahi hota aur aapki site orders leti hai ya customers ki details rakhti hai, to host se poochhiye ki fix hone tak site ko offline kiya ja sakta hai ya nahi. CERT-EU organisations ko yahi sochne ki salah deta hai jab wo turant patch na kar sakein.
6. VPS ya cloud server wale developers: apni Linux distribution ke updated PHP packages install kijiye aur PHP restart kijiye. PHP ki temporary settings sirf risk kam karti hain; wo "do not make an installation safe".

Agar aapki website kisi website builder par hai jahan aap kabhi server ya PHP version nahi chunte, to aapke badalne ke liye kuch nahi hai; platform apne servers khud sambhalta hai.

Phir ise monthly aadat banaiye: PHP version, updates, aur ek backup jo sach me kaam kare. Hamari guide team knowledge ko AI se SOPs me badliye batati hai ki ye checklist ek baar kaise likhein. Aur customers ka kam data rakhna, jo hamari guide customer data, privacy aur AI tools ki ek aadat hai, attacker ke liye bhi kam chhodta hai.

Aage kya dekhna hai

• Details public hone ke baad attacks. CERT-EU ko lagta hai ki attackers shayad pehle se bugs use kar rahe hain. Is week apne host ke emails padhiye.
• AI se mile aur bugs. Wiz chahti hai ki AI ki madad se bugs dhoondhna "routine" ban jaye. Aur urgent updates aayenge, isliye automatic updates on rakhiye.
• CERT-In aur aapke host ke notes. Wo aur instructions de sakte hain, lekin PHP kehta hai ki sirf update hi poora fix hai.

Pata nahi ki AI aapke business me safely kahan madad kar sakta hai? Free AI Business Checkup me lagbhag teen minute lagte hain.