On Wednesday morning, the team behind PHP released emergency fixes for two critical security flaws. PHP is the programming language that runs a huge share of the web, including WordPress, Drupal and Magento.

The flaws have existed in every version since PHP 5, which came out in 2004, and they let attackers run their own code on a server without logging in.

Both vulnerabilities were rated 9.2 out of 10 for severity and are tracked as CVE-2026-109618 and CVE-2026-109619. Together they are nicknamed PHP2Shell.

The first flaw involves how PHP behaves when it runs out of memory, which can make it process incomplete or corrupted data.

The second involves PHP continuing to use old information from an earlier web request after the memory holding it has been freed. Either can open the door to running malicious code.

The bug sits in a file upload interface. An attacker doesn’t need to know which site or software they are hitting. They send one crafted upload to any server they can find.

Wiz, the security company that helped find the flaws, says attackers could also read sensitive server memory, which may hold passwords, API keys, login tokens and certificates, some belonging to other visitors’ requests.

Estimates vary depending on what is being counted. One researcher, Silas Cutler, estimated about 1.3 million internet-connected hosts are affected. Other accounts say PHP runs roughly 70% of websites, which would be tens of millions of sites.

WordPress alone powers over 40% of the web by its own figures, and security firm Wordfence says every WordPress site is exposed because they all run on PHP.

WordPress says the flaw is not specific to its software. Site owners need to update PHP on their servers, usually by working with their hosting company.

Wordfence warns that this can’t be done through automatic updates, so someone has to find out who is responsible for the server and get them to apply the patch by hand.

Only PHP 8.2 and newer still receive official fixes, and the current version is 8.5.12. Anyone on PHP 8.1 or older has to upgrade to a supported version.

The PHP Foundation notes that some Linux distributions and third-party vendors still ship their own fixes for older versions, which is important because old PHP installs tend to be forgotten on old servers.

The PHP Foundation was blunt that there are no complete workarounds and that updating is the only safe choice.

Because of that, the UK’s National Cyber Security Centre, the EU’s computer emergency response team, Australia’s cybersecurity agency and the NSA all gave similar advice. If you can’t patch right away, take the site offline or cut it off from the public internet until you can.

Some organizations did exactly that before the patch even arrived. Several Finnish government sites, including the National Land Survey, went dark, as did French government sites and the Port of Rotterdam’s website, according to Reuters.

The mobile operating system GrapheneOS pulled its user forum offline, saying proof-of-concept exploits were already being developed and it didn’t want to take the risk.

The PHP Foundation gave advance notice on Tuesday, October 20, without saying which versions were affected or how the bugs worked. Some details reportedly leaked anyway, according to Ars Technica.

Cloudflare’s chief technology officer, Dane Knecht, said the company was seeing early attacks and was adjusting its firewall rules as a stopgap. Security firm Sansec predicted mass attacks within 15 minutes of the patch release.

The fear is that attackers can compare the patched code with the old code to work out exactly what was broken, then automate attacks against every site that hasn’t updated.

Security consultant Lukasz Olejnik said the worst case is wormable malware, meaning an attack that spreads from server to server on its own.

The FBI asked anyone who finds signs of a break-in to isolate the system, keep their web server and PHP logs, and report it to their local FBI field office.

Two groups found the flaws separately. Security firm Calif was working in OpenAI’s “Patch the Planet” project to hunt for bugs in open-source software.

Researcher Ryan Austin used OpenAI’s GPT-5.6 Sol model to audit PHP’s code, and Calif and OpenAI reported the findings to PHP’s developers in August.

Wiz, which is owned by Google, used its own AI security agent along with Gemini 4 Argon and GPT-5.6 Sol and found multiple vulnerabilities.

Both teams followed responsible disclosure, meaning they worked with PHP on fixes before going public, and a long list of companies helped test the patches, including Microsoft, AWS, Cloudflare, Akamai and Vercel.

OpenAI says researchers found the flaws before criminals did, and there were no known exploits in the wild at the time of its disclosure. Part of the reason is that these bugs were historically very hard to turn into working attacks.

Wiz says AI removes that barrier, since language models can adapt an exploit to different PHP versions, settings and memory layouts.

Olejnik said AI can turn a newly disclosed bug into an attack in about a minute. So the same technology that found the problem before the criminals did is also what makes it so urgent to fix now.

The PHP Foundation admitted in a Wednesday blog post that its developers spotted signs of the underlying problem behind one flaw in 2024. They couldn’t agree on a fix that wouldn’t cause new problems, and the issue sat for months.

The foundation called this a “structural failure” caused by its security team’s decision process and lack of resources, and said it is working to make sure similarly complex fixes get resolved faster in the future.

If you run a PHP site, find out which PHP version your server uses and update to a supported release, ideally 8.5.12.

The PHP project has released fixes for 2 critical vulnerabilities affecting servers that host PHP applications. Site owners and technical teams should confirm their hosting provider’s update plan and update PHP immediately. Versions before PHP 8.2 no longer receive security…

— WordPress (@WordPress) October 21, 2026

If you use WordPress or another PHP-based platform, ask your host whether the server has been patched, because the platform’s own updates won’t fix it. If you can’t update today, take the site offline until you can.