PHP2Shell: What AI-Found PHP Flaws Mean for Your Website

PHP2Shell is the name given to two critical flaws in PHP, the language behind WordPress and a huge share of business websites, and AI helped turn them from a theory into working attacks. Patched versions of PHP were released on 21 October (midnight on 22 October, Brisbane time). Australia’s cyber security agency has issued a critical alert, and attackers are already trying the exploit. If your business website, booking system, online store or customer portal runs on PHP, you need to confirm it has been patched today, not next week.

Here is what happened, who is exposed, a short checklist for Australian businesses, and what the episode tells us about AI in cyber security.

What PHP2Shell is

The PHP project’s security advisory describes two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated critical. Under the right conditions they let an attacker run their own code on a server running PHP without logging in. The project says every PHP installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php the highest risk because a single unauthenticated request can trigger the attack before any website code runs.

The fix is in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer get updates from the PHP project. Because the flaws are so serious, the PHP team published minimal source backports for 7.4, 8.0 and 8.1, and some hosting vendors ship patched builds for those versions, but the advice is to move to a supported version. The project also notes that PHP 8.2 reaches end of life on 31 December 2026.

According to Wiz Research, which published the PHP2Shell research, the bugs sit in PHP itself, so a site can be exposed even if its own code and plugins are fully up to date. Wiz demonstrated remote takeover of standard WordPress, Drupal and Joomla installs, and separately showed that an attacker could read server memory that may contain passwords, login tokens and API keys.

Why Australian businesses need to act now

The ABC reported that GovCMS, which hosts many federal government websites, blocked direct access to its servers while serving cached pages, Moodle took its website offline as a precaution, and Australian host VentraIP restricted some file uploads on customer hosting. Security expert Troy Hunt told the ABC: “You have to patch it very, very quickly, or the suggestion is to take it offline,” and warned Australians to expect more data breaches.

Waiting is risky because exploitation started early. Amazon Threat Intelligence says it saw a PHP2Shell exploit attempt against its honeypot sensors on 17 October, four days before public disclosure, and that the flaw is now seeing broad exploitation attempts. AWS advises investigating from 17 October onwards, not from the disclosure date.

ASD’s Australian Cyber Security Centre issued a critical alert recommending that organisations identify PHP in their environments, apply the security updates and monitor PHP applications for suspicious activity.

A PHP2Shell checklist for business owners

1. Find every PHP site you own. The main website is the obvious one. Also think about the old campaign microsite, the staging copy, the booking or quoting plugin, the intranet and the customer portal a developer built years ago. If nobody is sure who controls the hosting account, our handover document guide covers recording accounts, owners and access.
2. Check the exact PHP version. In WordPress, go to Tools, then Site Health, then Info, then Server. Your hosting control panel also shows it per domain. 8.3.36 is fixed; 8.3.30 is not. On Plesk, older 7.4, 8.0 and 8.1 builds keep their version numbers, and Plesk says only builds made on 21 October 2026 include the fix, so ask your host if in doubt.
3. Ask your host or developer in writing. On shared or managed hosting, the host installs PHP. A short email asking “Is our PHP build patched for CVE-2026-109618 and CVE-2026-109619, and have the PHP workers been restarted?” gets a clear answer on record. If you run your own server or containers, update and rebuild yourself.
4. Move off PHP 8.1 or older. A backport buys time, but an unsupported version will miss the next fix. Test plugins and themes on a staging copy, then upgrade.
5. Rotate secrets on sites that were exposed. Because the flaw can leak server memory, consider changing admin passwords, database passwords and any API keys stored on the site, including keys for AI chatbot or LLM integration plugins, payment gateways and email services.
6. Look back from 17 October. Ask your host to review logs for unusual activity, new admin users, unexpected file changes or unknown scheduled tasks. AWS suggests looking for POST requests containing PHP_SESSION_UPLOAD_PROGRESS.
7. Warn staff about follow-up scams. Breaches tend to bring phishing. The ABC’s advice to be wary of unexpected prompts to log in applies inside businesses too, and our spam and phishing training covers spotting them.

If you cannot patch straight away, the PHP advisory lists temporary measures, such as turning off session upload progress and lowering upload size limits. The project is clear that only an update fully fixes the problem, and ASD’s ACSC can be reached on 1300 CYBER1 (1300 292 371) if you think you have been affected.

How AI changed the race

This is AI news as much as security news. The PHP Foundation says a core developer found the first signs of the underlying problem in 2024, but no practical attack was known and work on a fix repeatedly stalled. Security firm Calif, OpenAI and Wiz then reported working attack paths in August and September. Wiz says it used Gemini 4 Argon and GPT-5.6 Sol throughout, and that with frontier AI models a single researcher completed in a week what would previously have taken a world-class team months.

The same capability works for attackers. AWS says AI-assisted analysis makes it cheaper to turn a patch or advisory into a working exploit, so for critical flaws in internet-facing systems, patch timelines should be measured in hours rather than seven or 30 days. The disclosure itself was messy, too: the PHP Foundation says the CVE numbers leaked two days early, a researcher’s video briefly went public and one distributor shipped the fix ahead of the agreed time, so the release was brought forward a day.

There is a defensive lesson as well. The PHP Foundation says AI now helps its team validate and group the flood of incoming reports, but “a person makes every call and works on every patch.” That is the right model for businesses using AI agents in their own software and operations: let AI do the searching and drafting, and keep a named person accountable for decisions. We covered the model behind much of this research in our Gemini 4 Argon explainer, and the risks of letting agents act unsupervised in our look at AI agent safety.

What this means for your next software project

PHP2Shell is a reminder that most business software rests on layers nobody in the business ever looks at. Before you commission a new app, AI tool or website, it is worth asking who will keep its runtime patched, how fast they can do it, and where its secrets are stored. Our approach to AI software development and custom AI development treats maintenance and security updates as part of the build, not an afterthought, and our build a website with AI course includes a weekly maintenance routine with updates and tested backups. An AI business audit can also map which tools and integrations hold your data; here is what an AI audit includes.

This is general information based on the PHP project’s advisory, ASD’s ACSC alert and published vendor and media reporting as at 23 October 2026. It is not a substitute for advice on your own systems. Confirm your patch status with your hosting provider or developer, and follow the latest guidance from ASD’s ACSC.

Featured image: Photo by Pixabay on Pexels.