migrateoffwpFree assessment
← All posts

PHP2Shell: Patch Tonight, Then Get Off PHP

October 23, 20265 min read

On October 21, governments told website owners to do something they almost never say: if you can't patch tonight, take your site offline.

The reason is PHP2Shell, a pair of critical flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619). PHP is the language every WordPress site runs on. The PHP project's own security engineer called it the most severe PHP issue in more than a decade. Wiz, one of the firms that found it, put it on par with Heartbleed. OpenAI called it among the most impactful security issues in recent memory. It belongs on any short list of the biggest internet security events of the last ten years.

If you run WordPress, this one is about you.

What the New York Times reported

The New York Times covered the disclosure the day the patches shipped. In short:

  • AI found it. Security researchers using OpenAI's advanced models found major bugs in PHP, software used widely across the internet. The disclosure added to six months of growing worry that AI could upend cybersecurity.
  • It reaches most of the web. By some estimates about 70 percent of websites and web applications use PHP, though its adoption is waning.
  • Patching starts a race. The fixes are available, but publishing them gives attackers a road map. Hackers can reverse-engineer the patches and strike before businesses and governments update. A successful attack could let them take over servers, steal private data and deface sites.
  • Governments said go offline if you must. The Trump administration and governments in Europe and Asia urged everyone to install the updates immediately. Agencies including the NSA advised taking systems offline if a patch couldn't be applied right away. Some European government sites did just that. Japan's prime minister, Sanae Takaichi, urged everyone to act that night.

How bad is it?

Both flaws allow pre-authentication remote code execution. An attacker needs no login, no plugin bug and no admin account. One web request to any PHP endpoint can be enough to run their code on your server. Security researchers stress that exposure does not depend on your CMS, theme or plugins. A fully updated WordPress install is exposed if the PHP under it isn't patched.

Every supported PHP 8.x release was affected, and researchers trace the bugs back as far as PHP 5.4. Unsupported versions were affected too, and they make up a large share of what's running on the internet.

Attackers moved fast. Amazon's threat intelligence team logged a probe on October 17, four days before disclosure. Cloudflare and other security firms saw exploit attempts within hours of the patches going public. Cloudflare reported attackers reworking their payloads to slip past its new firewall rules. The FBI warned that a successful attack may leave little more than a single memory-limit error in your web server logs. Most people ignore that line as noise.

If you're staying on WordPress, do this today

Updating WordPress, your theme or your plugins does not fix PHP2Shell. Those updates are about WordPress. This bug is in PHP, on the server, and it's patched there.

  1. Get onto a patched PHP build. The fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Anything older on those branches is vulnerable.
  2. On shared or managed hosting, ask your host directly. Ask which PHP build your site is serving and when PHP was last restarted. You can't patch this yourself on shared hosting.
  3. Restart PHP. Restart PHP-FPM, Apache and any long-running workers after updating. A patched package on disk does nothing while the old process is still serving pages.
  4. Check the version your site actually serves. php -v on the command line often reports a different binary from the one running your site. Some Linux distributions backport fixes without changing the version number, so confirm with your host or distro advisory.
  5. Get off PHP 8.1 and older. Those versions got source-code patches only, with no official releases. Move to PHP 8.3 or newer. PHP 8.2 reaches end of life on December 31, 2026, so it's only a stopgap.
  6. If you can't patch today, take the site down. That's the official advice from the NSA, the FBI and Europe's security agencies, not us being dramatic. A firewall such as Cloudflare's can buy time, but attackers are already working around those rules.
  7. Look for signs of compromise. Look for PHP processes spawning shells or downloading files, unexpected new files, and those memory-limit errors in your logs from the last week.

Patching closes this hole. It doesn't close the next one.

Why migrating is the better answer

To be clear: WordPress didn't write this bug. PHP did. But every WordPress site carries PHP with it: a live interpreter on a server that answers requests from the whole internet, every second of every day. When that interpreter has a flaw, so does every WordPress site.

And this won't be the last one. The same AI models that found PHP2Shell are now pointed at every popular codebase on the web. OpenAI expects AI-driven discoveries like this to rise sharply. A twenty-year-old interpreter running behind a quarter of the internet is the obvious next target. The question for a WordPress owner isn't whether the next emergency patch comes. It's whether you'll be awake when it does.

A modern, file-based site takes PHP out of the picture entirely. Your pages are built ahead of time and served as files from a global edge network. Nothing on the page path runs a PHP interpreter for an attacker to reach. Many sites have no database behind them at all. PHP2Shell isn't a patch you scramble to apply. It's simply not your problem.

This site runs on that model, with no PHP anywhere in the stack. On October 21 there was nothing for us to patch.

That's the trade we wrote about in WordPress Is Now a Liability. With AI tools that can edit your site as plain files, you no longer need WordPress to publish easily. Without WordPress, you no longer need a PHP server sitting on the internet waiting for its next zero-day.

So: patch tonight. Then plan your way off PHP. If you'd like help with the second part, request a free assessment. We'll map out what a migration looks like, with your content, URLs and SEO intact.

Sources: The New York Times, The Next Web, The Hacker News, Cloudflare, CNN, CBS News.