Make Better
List your asset
AI cybersecurity and website security

PHP2Shell: Critical PHP Fixes and AI Discovery

•Make Better Editorial

PHP2Shell fixes arrived October 21. See patched PHP versions, website exposure and how AI-assisted researchers helped find the flaws.

PHP's security team released emergency fixes on October 21, 2026 for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Affected web-serving PHP runtimes can allow unauthenticated remote code execution. The disclosure also marks a notable moment for AI-assisted security research: OpenAI says Calif identified one flaw with GPT-5.6 Sol through Patch the Planet, while Wiz independently discovered both. PHP maintainers led the fixes. The immediate action for operators is patching the runtime, not changing an AI model.

What PHP maintainers confirmed

The PHP project warns that all installations serving web requests need attention, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It highlights a demonstrated particularly severe path in Apache mod_php. These are engine-level issues, not necessarily bugs in a site's CMS code. WordPress, Drupal or Joomla sites can therefore require a PHP runtime update even if the application and all plugins are current. Exact exposure depends on the deployed version and configuration.

Fixed PHP releases

BranchPatched version
PHP 8.58.5.12
PHP 8.48.4.27
PHP 8.38.3.36
PHP 8.28.2.35
8.1 or olderVendor backport or supported-branch upgrade

What AI did—and did not—do

OpenAI credits Calif with discovering a critical flaw using GPT-5.6 Sol, and separately credits Wiz with independently finding and reporting both vulnerabilities. Wiz's first-party report says its team used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout the investigation. It would be misleading to credit a single model with discovering every issue or shipping the fixes. Researchers validated the findings, PHP maintainers produced security releases, and infrastructure providers prepared protective guidance.

Make Better analysis

This case illustrates how AI-assisted analysis can shorten difficult security investigations, while potentially reducing the effort required to adapt attacks. For businesses, the operational lesson is to maintain a reliable inventory of runtimes, monitor maintainer advisories and verify that emergency patches actually reach production. Vendor claims about AI discovery should not distract from the difference between detecting a flaw and remediating an exposed service.

Five practical steps for site owners

  1. List websites and services running PHP, including managed hosting and background workers.
  2. Identify the PHP branch actually serving each site, not just a version selected in an account dashboard.
  3. Install PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or an officially verified vendor security backport as appropriate.
  4. Coordinate service or worker restarts with your provider and verify that the patched runtime is active.
  5. If patching is delayed, request temporary risk reduction and an incident review where warranted; do not consider temporary controls a permanent fix.
Urgent remediation caveat

PHP says there are no complete configuration-only mitigations. Applying a fixed release or a verified vendor security backport is essential; temporary protections may only reduce specific attack paths.

Questions people ask

FAQ

Questions people ask

Which PHP versions fix the two PHP2Shell vulnerabilities?

PHP published fixed releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026. Upgrade the branch you actually run, or install your operating-system vendor's verified patched package. PHP 8.1 and older no longer receive upstream security releases; those deployments need a vendor-supported backport or migration to a supported version. Confirm the updated runtime is active, not merely downloaded.

Does updating WordPress or its plugins remove PHP2Shell exposure?

No. PHP2Shell concerns vulnerabilities in the PHP runtime, so updating WordPress core, themes or plugins alone does not repair an affected PHP installation. The PHP security team identifies exposure in web-serving PHP configurations, including PHP-FPM and Apache mod_php. A managed WordPress site owner should verify the actual PHP runtime and security package with the hosting provider, even if WordPress reports that all application updates are installed.

Is a web application firewall enough to protect a PHP website?

No. PHP's official October 21 advisory states that temporary mitigations can reduce exposure to some attack paths but are not complete fixes. Firewall rules or hosting controls may help during emergency response, but they cannot substitute for a patched PHP runtime or a vendor-backed security fix. Work with your provider on temporary protections only while arranging and verifying the actual update.

How should a managed-hosting customer confirm the fix is installed?

Ask the host which PHP branch and patched build is serving requests for your site, and whether the relevant PHP workers were restarted after deployment. Compare that build with PHP's October 21 advisory or an official distribution backport notice. A dashboard setting, CMS update, CDN or firewall status does not by itself establish that the PHP runtime is patched. Escalate unclear answers to the host's security team.

Bottom line

PHP2Shell combines a major website-security emergency with an important AI-assisted discovery story. Follow the PHP maintainers' October 21 patch guidance, verify your hosting provider's actual runtime and distinguish research claims from confirmed remediation.

Explore related Make Better resources

Sources & useful resources