Mo Explains
As someone who works with PHP, I'm surprised this was a bug that lasted this long.
I see the good and the bad of it. The good is that AI apparently found it. The bad part is that now everybody knows about it, and there are going to be nefarious people out there trying to take advantage of this loophole. So obviously, this needs to get closed quickly.
What is PHP2Shell?
PHP2Shell is two bugs in PHP itself that, chained together, let someone run their own code on your web server. Wiz says that's enough to steal data and deface a site, or to take over the server outright.
Wiz Research, the security firm that named it, says PHP powers about 70% of websites, including WordPress, Drupal, Joomla and MediaWiki, the software behind Wikipedia. The bugs live in PHP itself, underneath those apps, so Wiz says even a plain "Hello World" page on an affected PHP version can be vulnerable. The PHP team rates both bugs 9.2 out of 10 on the standard CVSS severity scale.
Calif, which worked on the research with Wiz and OpenAI, says it confirmed attacks against WordPress, Drupal, Joomla, MediaWiki, Magento, Nextcloud and phpMyAdmin, among others.
How AI found a bug that hid for over a decade
Wiz says it found the first bug on August 19, 2026. It used its own Wiz Atlas tool along with Gemini 4 Argon and GPT-5.6 Sol, and it says Gemini 4 Argon made a particularly big contribution. Calif, which found its first attack path on August 1, traced the earliest affected code back to PHP 5.4.0, which came out in 2012. Calif also says a related bug was reported back in 2020 and turned up again in a 2024 security audit, but nobody proved it could be exploited until now.
What AI changed was the hard part. These are memory bugs, and turning them into a working attack meant chaining several of them and adjusting for each server's setup. Wiz wrote that "Pre-AI, this manual work would be difficult to implement and even harder to scale." In other words, Wiz is saying AI made these attacks a lot cheaper to build.
So Wiz reported them to the PHP team on August 24, PHP started on a fix in September, and the patched versions came out on October 21.
Why this week is risky
The details got out early. Huntress says information on both bugs leaked online on October 20, before the patches were ready, and PHP had to post an emergency heads-up that day.
Attackers didn't wait, either. On the morning of the release, Cloudflare's Dane Knecht posted that "We are seeing early attacks emerging." That's exactly the bad side I was talking about.
Is my website affected?
If your site runs PHP and it isn't on one of the fixed versions, assume it is. The PHP team's release notice says everyone serving web pages with PHP is at risk, and that includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It calls the risk highest for mod_php.
To find your version on WordPress, go to Tools > Site Health > Info and open the Server section, where the PHP version is listed. WordPress's own docs cover that screen. On other sites, your hosting dashboard usually shows it, or your host's support can tell you in one message.
The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If you're on PHP 8.1 or older, there's no patch coming, because those versions are past end of life, so you'll need to move up to a supported one. And 8.2 only gets security fixes until December 31, 2026, according to PHP's support schedule, so 8.3 or newer is the better jump.
What to do right now
Update PHP, and don't count on anything else to cover you. PHP core developer Gina Peter Banyard said that "the only mitigation is patching / upgrading PHP."
- Check your PHP version using the steps above.
- If a host runs your site, log in and look for a PHP version setting in the control panel, since many hosts let you pick it yourself. If you can't find it, ask support whether your site is on one of the fixed versions, and get a yes before you assume it's done.
- If you run your own server, update to the fixed version for your branch and restart PHP so every worker picks it up.
- If you're on PHP 8.1 or older, back up the site first, then move to a supported version. Older plugins can break on a big jump, so test it.
Updating WordPress or your plugins won't fix this, because the bugs are in PHP underneath them.
Honest limitations
Nobody knows yet how widespread the attacks are. Tenable says exploit code is circulating, but it hasn't confirmed that any of it works, and fake exploit code sometimes carries malware.
Wiz also says there are more variants of these bugs than the four it first reported, and that PHP will need a deeper fix over time. So this probably isn't the last PHP update you'll see about it.
Check your PHP version today. If it's not 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or newer, that's your to-do.
Related reading: Anthropic published four times Claude attacked real systems | How to build a personal website with AI | What not to share with ChatGPT | New to AI? Start here
