PHP2Shell: One Researcher and AI Found a Critical PHP Bug

One researcher, working with AI, found a critical bug in every PHP version released in the last decade. It's remote code execution with no login required, and it works against WordPress, Drupal and Joomla. If you run anything on PHP, this is the patch to apply this week.

What happened

On October 21, 2026, Wiz published its research on PHP2Shell, the same day PHP shipped the security update. The issues are grouped under two CVEs, CVE-2026-109618 and CVE-2026-109619, with severity reaching CVSS 9.2.

The key facts from Wiz's write-up:

• "Every PHP version released in the last decade is affected by at least one of these vulnerabilities." The oldest affected version Wiz names is PHP 5.4.
• The bug is in PHP itself, so it doesn't depend on any one application. Wiz says even a simple "Hello World" app on an affected version can be vulnerable.
• It allows unauthenticated remote code execution. There's also a memory disclosure path that can expose passwords, tokens and API keys.
• Wiz demonstrated unauthenticated RCE on WordPress, Drupal and Joomla using their latest container images at the time of testing.
• Wiz cites PHP as powering 70% of all websites.

The timeline is short. Wiz found the first bug on August 19, confirmed RCE on Drupal on August 20 and on WordPress on August 21, and reported it to PHP on August 24.

The AI part is what made me cover this. Wiz says it used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout the research. It credits Gemini 4 Argon with an "invaluable contribution to finding the vulnerability," plus exploit development, attack detection and patch validation, and says frontier models helped adapt the exploit to different PHP versions, configurations and memory layouts. Wiz's conclusion: "a single researcher completed in a week what previously would have taken a world-class team months of work."

Why it matters for builders

Finding bugs just got a lot cheaper. That cuts both ways. The same models that helped one researcher find a decade-old flaw are available to attackers, and the gap between disclosure and exploitation keeps shrinking.

For anyone shipping PHP, Wiz is blunt: applying the PHP security update is the only complete fix. Web application firewalls help in the meantime. Wiz notes Cloudflare, Fastly, Google and Vercel published mitigations for customers who can't patch immediately, but those buy time and nothing more.

The bigger shift is for small sites. A lot of WordPress installs run on shared hosting or an old VPS that nobody has logged into in a year. Those are the ones that will still be on a vulnerable PHP version a month from now.

Check your servers in 15 minutes

1. Find out what you're running. On the server: php -v. On shared hosting, check the PHP version setting in your control panel. Do this for every site, because hosts often pin different versions per site.
2. Read the PHP security release notes from October 21 on php.net for your branch, and upgrade to the patched release. If you're on a branch that no longer gets security fixes, plan the move to a supported branch now.
3. Restart PHP-FPM or your web server after upgrading, then run php -v again to confirm the new version is the one actually serving requests.
4. If you can't patch today, turn on your CDN or WAF provider's PHP2Shell mitigation if they published one.
5. Watch the logs for the signals Wiz lists: unusual multipart requests followed by memory-limit errors, repeated HTTP 500 responses, unexpectedly large or malformed PHPSESSID cookies, and unexplained PHP worker churn.
6. Because memory disclosure can leak secrets, rotate database passwords and API keys on any server that was exposed and unpatched.

Here's how you get paid

Here's my take. Most small-business WordPress sites don't get patched on day one. The owners have never heard of PHP. They hired someone to build the site years ago and they assume it just keeps working.

That gap is a service you could start offering this weekend. I'd frame it as a WordPress security sweep:

• Upgrade PHP to a patched release and confirm it's live.
• Update WordPress core, the theme and every plugin.
• Use an AI coding agent to read through the site's custom plugins and theme code for obvious problems: unescaped input, exposed admin endpoints, hardcoded keys.
• Rotate credentials and turn on the host's firewall.
• Hand the owner a plain-English report of what you fixed.

Then offer to keep doing it monthly. "We patched your server and ran an AI security audit on your plugins" is a sentence a local business owner understands immediately, and PHP2Shell gives you the reason to call.