PHP2Shell: The AI-Found PHP Vulnerability and What Small Businesses Should Do Now

On October 21, 2026 the PHP project released emergency updates for two critical flaws that let an attacker run code on a web server without logging in. Researchers nicknamed them PHP2Shell. The bugs had been in PHP for more than a decade, and they were found with the help of AI models. Since PHP runs a large share of the web, including WordPress and Drupal sites, the news went around the world within hours, and some governments and organisations took websites offline as a precaution.

This guide explains what is affected, why it matters for a small business website, and what to do today, in plain language.

What happened

The two vulnerabilities are CVE-2026-109618 and CVE-2026-109619. Both are memory-safety bugs (use-after-free) in PHP itself, not in a plugin or an application, and each is rated 9.2 out of 10 on the CVSS v4 scale. In the words of the PHP security advisory, they affect “all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed”.

• CVE-2026-109618: when PHP runs out of memory while it is still preparing an incoming request, cleanup can treat half-initialised data as valid.
• CVE-2026-109619: internal state from one request can survive after its memory is freed, and the next request handled by the same PHP worker can use it.

What makes this serious is that exploitation does not depend on your own code. The researchers at Wiz write that even a simple “Hello World” page on an affected PHP version can be vulnerable. The PHP team considers Apache with mod_php the highest risk, with a demonstrated exploit that works before any application code runs.

Which PHP versions are fixed

If your site still runs PHP 8.1 or older, this is the moment to move to a supported branch: those versions no longer receive updates from the PHP project.

Is it being exploited?

A working proof-of-concept exploit is public. Reports differ on how much real damage has followed so far. Fortune reported that Cloudflare saw millions of exploit attempts by the evening of October 21 and that AWS described the flaw as broadly exploited in the wild. The Canadian Centre for Cyber Security wrote on October 23 that it had not yet identified active exploitation, but that this could change quickly. Either way, the safe assumption for any unpatched server is that it is being probed.

Several organisations took sites offline while they patched. Reported examples include Finland’s government public web services, a number of Dutch public bodies and some Wikimedia systems.

Why AI matters in this story

According to Fortune, the security firm Calif found the first issue on August 1 using OpenAI’s GPT-5.6 Sol, and Wiz independently found it on August 19 using Google’s Gemini 4 Argon, GPT-5.6 Sol and its own tooling. Wiz reported the bugs to PHP on August 24, and the fixes and public disclosure followed on October 21.

The bugs themselves are old. What changed is speed: AI helped the researchers understand the flaws and turn them into working exploits across PHP versions and configurations. Attackers can use the same tools. For a small business the practical lesson is simple: the time between “a flaw is announced” and “bots are trying it on your site” is now measured in hours, so updates cannot wait for a quiet week.

What to do now: a checklist for small businesses

1. Find out which PHP version your site uses. In WordPress, go to Tools > Site Health > Info > Server. On most shared hosting you will also see it in your hosting control panel. If you are not sure, ask your web host or developer directly: “Which PHP version runs our site, and is it patched for CVE-2026-109618 and CVE-2026-109619?”
2. Update to a fixed version. Many hosting companies update PHP on shared servers themselves, but do not assume it: get a written confirmation. If you run your own server or VPS, install the update from your operating system or PHP vendor and restart every PHP worker.
3. If you are on PHP 8.1 or older, plan the move to 8.2 or newer now. Test the site on the new version first, because old plugins and themes can break.
4. If you cannot update today, ask whoever manages the server to apply the temporary configuration from the official PHP advisory (below). The advisory is clear that this reduces the risk but is not a complete fix. CERT-EU and the UK NCSC advised taking affected systems offline where patching is not possible.
5. Turn off session upload progress. On October 23 a further, narrower issue was announced (CVE-2026-115560) that the October 21 releases do not fix. Until the next PHP release, the advice is to set session.upload_progress.enabled=0.
6. Look for signs of compromise if your site was unpatched for days: new administrator accounts, unfamiliar files in upload folders, changed pages, or unusual spikes of server errors (HTTP 500) in your logs. If you find anything, involve your developer or host before you simply restore a backup.
7. Stop announcing your version. Many servers send a header such as X-Powered-By: PHP/8.2.20 with every response. Hiding it does not fix anything, but it stops your site from appearing in the easiest automated searches for vulnerable versions. Our free website security check shows whether your server discloses software versions.

Temporary configuration from the PHP advisory

This is for whoever manages the server, and it must be applied in php.ini, the PHP-FPM pool or the web server configuration, not in .user.ini or with ini_set(). Restart all PHP workers afterwards.

session.upload_progress.enabled = 0
memory_limit = -1
post_max_size = 8M         ; 32M if the site needs file uploads
upload_max_filesize = 2M   ; must stay below post_max_size
fatal_error_backtraces = 0 ; PHP 8.5 only

Setting memory_limit = -1 removes a safety limit, so the advisory recommends a container or cgroup memory limit instead. This is exactly why updating is the better option.

Firms covered by the FTC Safeguards Rule

Tax preparers, mortgage brokers and other non-bank financial companies should treat this as a test of their information security program. Patching internet-facing systems quickly is part of the safeguards the Rule expects, and if customer information was accessed, the notification duties in 16 CFR 314.4(j) may apply. Write down when you learned about the issue, when your systems were updated and who confirmed it: that record is useful evidence later. See our guides for tax preparers and mortgage brokers.

How Nyorsoft can help

Our external reviews look at your website the way an attacker would, from the outside and without access to your systems. Among other things they flag software that publicly reveals an outdated version, exposed admin panels and files, and missing security headers, and the report tells you what to fix first. Prices are fixed and everything happens by email. See our services and pricing, or start with the free check.

An external review cannot confirm the PHP version behind a site that hides it, and it does not replace updating. The only complete fix for PHP2Shell is installing the patched PHP release.

Sources

• PHP: Security advisory – Critical remote code execution vulnerabilities, update now (October 21, 2026)
• Canadian Centre for Cyber Security: Alert AL26-026 (updated October 23, 2026)
• Wiz Research: PHP2Shell
• Fortune: AI helped discover the PHP vulnerability (October 21, 2026)
• The Next Web: PHP rushes out emergency patches for two critical bugs AI found first
• Paubox: PHP flaws found by AI force governments and major sites offline

This article summarises public advisories as of October 24, 2026. The situation is changing quickly; always check the official PHP advisory for the latest versions and guidance.

Written byPavol Huňor · IT Analyst, Nyorsoft

Pavol brings IT analysis experience from banking and financial-sector projects to Nyorsoft’s external security reviews for small businesses. About our team