PHP2Shell, the flaw found by AI: is your PHP website up to date? Test it for free

On 21 October 2026, the PHP team shipped emergency fixes for two critical flaws in its engine. PHP runs 70.3% of the websites whose server-side language is known, according to W3Techs (August 2026): WordPress, WooCommerce, PrestaShop, Joomla and a large share of custom websites. If yours is one of them, the question is not whether you are affected, but whether your server has been updated.

Want the answer right away? Test your website for free: the result arrives in 10 seconds.

What happened with PHP on 21 October 2026?

PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two flaws named PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10 (CVSS 4.0). The release was brought forward by a day after details leaked before the planned date.

Both flaws involve how the PHP engine handles memory. The first occurs when a request hits the memory limit at the wrong moment: PHP keeps half-built data and reuses it. The second leaves, after a fatal error, internal state pointing at memory from a previous request. In both cases an attacker can go as far as running code on the server.

According to the PHP Foundation, remote code execution was demonstrated with default settings on Apache with mod_php, without authentication, and confirmed on PHP-FPM through paths in the application code.

Why is it called a flaw found by AI?

Because the main reports came from teams working with AI models. Calif reported the issue to PHP on 11 August 2026, Wiz contributed further attack scenarios on 24 August, and OpenAI independently reported the same root cause, then new vectors on 18 September. Wiz says it used its own tools and several AI models to find the flaw, build the exploit and validate the fix.

The PHP Foundation notes that a person makes every decision and works on every patch. AI sped up the research; it speeds up attackers too. Exploitation attempts were seen in the following days, and even before the official release, according to SecurityWeek and The Hacker News.

Is your website affected?

Yes, if it runs on PHP and its server's version has not been updated since 21 October. According to Wiz, almost every PHP version is hit by at least one of the two flaws, including releases going back to PHP 5.4.

That last case is far from rare: according to W3Techs, 63.1% of websites using PHP run version 8 (August 2026). The rest run older versions that no longer receive any security fix from PHP.

Two clarifications avoid false certainty. Updating WordPress, WooCommerce or your plugins does not change the server's PHP version. And a website built with Next.js, like the ones we build, does not use PHP: it is not affected by this particular flaw, even though it has its own updates to follow.

How do you check your PHP version in 10 seconds?

The fastest way is our free PHP version test. It loads your home page once, like a browser, reads what the server shows publicly and gives you a verdict. It sends no attack request, and it is reserved for the website's owner: it asks for an email address of its domain and a declaration.

If your website hides its version, which is good practice, check it yourself:

1. In your hosting panel: cPanel, Plesk or your host's client area show the website's PHP version, often under « PHP version selector ».
2. In WordPress: Tools, then Site Health, then Info, then Server: the « PHP version » line gives the exact number.
3. On the server: php -v shows the version. Note that the website may use a different version than the command line.

A number followed by a suffix, such as 8.1.2-1ubuntu2.19, means a version packaged by the system (Ubuntu, Debian). The vendor sometimes backports the fix without changing the number: ask your host to confirm in writing.

What should you do if your website is not up to date?

The PHP Foundation is clear: update now. Wiz confirms that updating PHP remains the only complete remediation.

1. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 depending on your branch, or ask your host to do it today.
2. If you are on PHP 8.1 or older, plan the migration to a maintained version. The theme, plugins or code may need adapting: test on a copy before switching.
3. Hide the version your server publishes (expose_php = Off): showing your version number tells bots what to attack.
4. Turn on a web application firewall if you have one. Cloudflare, for example, deployed rules against PHP2Shell. They lower the risk but do not replace the update.
5. Watch for the attack signs listed by Wiz: repeated memory-limit errors, recurring 500 responses, unusually long session cookies.

If you do not know who manages your server, or your provider does not answer, tell us about your website: we check the real version on the server, apply the fix or the migration, and make sure everything works afterwards.

What should you take away?

This flaw recalls a rule often missing from quotes: a website is not finished on launch day. Its security depends on regular updates, set out in a written maintenance contract. It is one of the points in our checklist to judge an e-commerce website quote.

If your website runs on a PHP version that no longer gets fixes, it is also the right time to decide: migrate, or rebuild a lighter website that is easier to keep up to date. Read Next.js or WordPress: how to choose, and see our redesign and migration service.

---

Related reading — Why Next.js for a company website in Tunisia · Brochure site or e-commerce: how to choose