# AI helped find two serious PHP holes. Email your host.

Last checked Nov 5, 2026 . Published Oct 30, 2026

AI helped find and fix two critical flaws in PHP, the software under WordPress. The fix is your host's job, so ask them to confirm it.

Does this matter to you? It matters if Your site runs WordPress or PHP, or you look after one that does. Skip it if You have no website.

## What to do

- Check your PHP version in WordPress: go to Tools, then Site Health, then the Info tab, then click Server to open it, and write down the version.
- Compare it with the fixed versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or newer in the same line. A lower number does not always mean trouble, because many hosts add the fix without changing the number. On 8.1 or older? That version no longer gets regular updates, so ask your host to move you to 8.3 or newer, or to confirm in writing that they have applied a backported fix. PHP 8.2 stops getting security fixes on December 31, so 8.3 or newer is the safer ask.
- Send your web host one email asking them to confirm the fix. Copy the email below into a support ticket. If you run your own server, the update is yours to install.
- On Squarespace, Wix or Shopify? Those companies run their own servers, so there is nothing for you to update.

**What happened.** On October 21, the PHP project released fixes for two critical security flaws, nicknamed PHP2Shell (official IDs CVE-2026-109618 and CVE-2026-109619). PHP is the behind-the-scenes software that runs WordPress, Drupal, Joomla and a huge share of small business websites. Both flaws are rated 9.2 out of 10 for severity. In the worst case, an attacker can take over the server that runs a website without logging in, or read private data from its memory, like passwords and keys.

**Why it is an AI story.** The weak spots had been in PHP for more than a decade. Security researchers at Wiz say frontier AI models are what made it practical to turn them into working attacks, and they used AI to help find and fix the problem before going public. Their words: "With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work." That cuts both ways. AI helps defenders find old bugs faster, and it helps attackers too.

**Is anyone attacking yet?** Yes. On October 26, the US government's cyber agency CISA added both flaws to its list of known exploited vulnerabilities and told organizations to update right away. Researchers also confirmed attackers broke into at least one test server set up to watch for attacks. Wiz says the number of organizations with an exposed, vulnerable server fell by nearly half in the week after the fixes came out, as people patched, upgraded or locked servers down. As of November 5, PatchBell's tracker shows only 34 of 76 hosting providers say they have patched.

**What it means for you.** Updating WordPress, your theme or your plugins does not fix this. The fix lives one layer down, in the PHP software on the server, which is usually your hosting company's job. Some hosts patch without changing the version number, which is why asking them directly matters.

**The email to send your host.** Copy this into a support ticket:

> Hi, please confirm that the PHP running my site, [your website address], includes the fixes for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell). Please also confirm the PHP workers were restarted after the update, and let me know if anything on my account is still waiting for the fix. Thank you.

## Sources

- [PHP release announcement, October 21, 2026](https://news-web.php.net/php.announce/512) (PHP)
- [Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) (CISA)
- [PHP2Shell hosting provider patch status](https://patchbell.com/php/php2shell/status/) (PatchBell)
- [PHP2Shell research](https://www.wiz.io/blog/php2shell-php-rce) (Wiz)
- [PHP2Shell: exploitation attempts and remediation trends](https://www.wiz.io/blog/php2shell-exploitation-so-far) (Wiz)
- [Upcoming critical PHP security release (both flaws rated 9.2)](https://www.php.net/archive/2026.php#2026-10-20-1) (PHP)
- [Security advisory: critical remote code execution vulnerabilities, update now](https://www.php.net/archive/2026.php#2026-10-21-5) (PHP)
- [Critical vulnerabilities in PHP require immediate patching](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching) (CISA)
- [PHP2Shell security flaws now successfully exploited in the wild](https://www.bleepingcomputer.com/news/security/php2shell-security-flaws-now-sucessfully-exploited-in-the-wild/) (BleepingComputer)
- [Critical PHP RCE vulnerabilities, patch now](https://www.digitalocean.com/blog/critical-php-rce-vulnerabilities-patch-now) (DigitalOcean)
- [PHP2Shell, WordPress PHP update](https://powersec.io/blog/php2shell-wordpress-php-update-cve-2026-109618) (PowerSEC)