Run a WordPress Site? Check Now — Critical PHP Flaws 'php2shell' Were Found by AI
On October 21, 2026, PHP shipped fixes for two critical vulnerabilities (CVSS 9.2) known as 'php2shell'. OpenAI's AI-driven security program helped find them. Here's what WordPress site owners and businesses need to check and do today.
Does your blog or company website run on WordPress? Right now, the software underneath it has two critical security flaws. Left unpatched, they could let attackers take over the site.
What Is This?
In short, these are serious flaws in PHP, the language that powers a huge share of websites. WordPress, Drupal, Joomla and Laravel apps all run on PHP.
A flaw like this is called a vulnerability. Think of it as a design defect in your front-door lock. The two flaws are collectively nicknamed "php2shell" (CVE-2026-109618 and CVE-2026-109619).
What Changed
① Rated 9.2 out of 10 — "critical"
Both vulnerabilities score 9.2 on CVSS, the standard severity scale. They allow unauthenticated remote code execution — an attacker can run commands on your server without a password. That can mean a defaced site, stolen customer data, or malware served to your visitors.
② Patches shipped earlier than planned
The PHP team pre-announced the fix on October 20. The same day, technical details leaked online. As a result, patches were released early on October 21 (UTC).
The fixed versions are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Some security firms have already reported early exploitation attempts, so updating is urgent.
③ Found with help from OpenAI's AI
The flaws surfaced through OpenAI's "Patch the Planet" program. It uses AI to hunt for bugs in widely used open-source software, with human experts verifying each finding. Security firm Wiz independently reported the same issues.
Reports say nearly every PHP version since PHP 5 is affected by at least one of the flaws. Since PHP powers roughly 70% of websites whose server language is known, the blast radius is enormous.
What Should You Do?
Scenario 1: A WordPress blog on shared hosting (personal)
Many hosting providers patched within a day; some even paused services as a precaution. Check your host's status or announcements page first.
"Once the site is built, it's done." PHP updates were never on the radar. The old version still worked, so nobody noticed the risk.
Confirm with your host that PHP has been patched. If your control panel lets you choose a PHP version, switch to the latest 8.2+ release.
Scenario 2: You manage a company website (work)
If you run your own servers, nothing gets fixed automatically. Ask your agency or IT team today: "Have we patched php2shell?" If you can't update quickly, temporarily taking internet-facing apps offline is a recommended option.
Scenario 3: You just visit websites (home)
Website visitors don't need to do anything on their phones. Still, stay alert for suspicious emails or familiar sites that suddenly look off.
PHP 8.1 and earlier are end-of-life and won't get official patched releases. Upgrading to PHP 8.2 or later is the real fix. Configuration tweaks alone cannot fully mitigate these flaws.
What Does It Cost?
The cost depends on where your site lives.
- ✓Your host applies the patch
- ✓You just confirm it's done
- ✓Switch PHP versions in the control panel
- ✓For self-hosted or legacy sites
- ✓Impact assessment, update and testing
- ✓Japanese firms offer packages from ¥100,000
- ✓For people comfortable with servers
- ✓Update to 8.2.35 or later
- ✓Test your site afterwards
Most personal blogs sit on shared hosting, so the fix costs nothing. The cheapest fix is the one you make before something goes wrong.
In WordPress, open Tools → Site Health to see which PHP version you're running. If it's 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer, you're covered for now.
Summary
php2shell is a critical pair of PHP flaws that could let attackers take over websites. On shared hosting, confirming the patch and choosing the latest PHP version is usually all it takes. Companies running their own servers should check with their team today.
This matters most for anyone running a blog, shop or company site on WordPress. As AI speeds up how fast flaws get found, how fast we patch matters more than ever.
- PHP official site: https://www.php.net
- Detailed coverage (gihyo.jp, Japanese): https://gihyo.jp/article/2026/10/php-critical-security-release
More ChatGPT articles
How to Save Time in Excel with AI: Let ChatGPT and Copilot Handle Formulas, Summaries, and Charts
Can't remember Excel formulas? You can now ask ChatGPT or Copilot in plain language to write formulas, clean data, build summaries, and create charts. Here's how the free ChatGPT copy-paste method compares with Copilot inside Excel, plus what to watch out for with confidential data.
How to Use Microsoft Copilot: What's Free and How It Differs from ChatGPT (October 2026)
Curious about the Copilot button in Windows? Copilot's free tier still covers chat, image creation, and file uploads. Here's how to get started, what changed when Microsoft merged its Copilot apps in August 2026, how it compares with ChatGPT, and when a paid plan is worth it.
Best AI Translator Compared — ChatGPT, Gemini, Claude, or DeepL: Which Sounds Most Natural?
Not sure which AI to use for emails, travel, or PDF documents? We compared ChatGPT, Gemini (Google Translate), Claude, and DeepL scene by scene. Rule of thumb: ChatGPT for business email, Google Translate on the road, Claude or DeepL for long documents — plus prompt tips for natural translations.