PHP2Shell WordPress Fix: Check and Patch the AI-Found PHP Flaw (CVE-2026-109618)

The internet’s biggest security story this week is not a phishing wave or a ransomware gang. It is PHP itself. On October 21, 2026, the PHP project shipped emergency fixes for two critical remote code execution flaws now known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Researchers at Wiz found them with AI-assisted tools, details leaked hours before the patch, and attackers were already probing servers days earlier. Because WordPress runs on PHP, almost every WordPress site on the planet is in scope. This guide explains in plain English what PHP2Shell is, why AI is part of the story, and exactly how to check and fix your WordPress site today, whether you are on shared hosting, a VPS or your own server.

What Is PHP2Shell?

PHP2Shell is the nickname for two separate but related flaws in PHP’s internal request handling. The PHP security team rates both at 9.2 on CVSS v4.0, and both can be triggered by an attacker who is not logged in. The scary part is where the bug lives: it fires while PHP is still setting up the request, before any application code runs. That means your WordPress security plugin, your login limiter and your strong admin password never get a chance to help.

CVE-2026-109618: code execution through out-of-memory corruption

If PHP runs out of memory at the wrong moment during a request, some internal request data can be left half-initialised. The cleanup code that runs afterwards can then treat that broken data as valid, and a skilled attacker can turn that confusion into code execution.

CVE-2026-109619: code execution through stale global state

Some internal state that belongs to one request can survive after its memory has been freed. A later request handled by the same PHP worker may then use that stale state before it is reset. Because PHP-FPM and mod_php reuse workers across many requests, this is very practical to abuse on a busy server.

According to SOCRadar, the two CVEs come from four underlying bugs. Help Net Security reports that every PHP installation serving web requests is affected, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, with Apache plus mod_php in the highest-risk group.

There is also a third, separate issue to know about: CVE-2026-115560, a session-handling flaw that the October 21 releases did not fix. It only affects apps that switch session.serialize_handler to php through ini_set() before session_start() while upload progress is enabled. Standard WordPress does not do that, but some plugins might, and the mitigation below covers it.

Why AI Is Part of This Story

This is why the security world is calling October 2026 “Black October”. According to Recorded Future’s timeline, Wiz Research found the first PHP vulnerability on August 19, 2026 using AI-assisted research tools. Within two days they had confirmed unauthenticated remote code execution against Drupal and then WordPress.

These bugs were not new. Wiz told Help Net Security that the flaws had existed for decades, and that proving they were exploitable needed a very complex chain of steps, but that “frontier AI models substantially reduced that barrier.” In other words, AI did not invent a new class of attack. It made it cheap to find and weaponise bugs that human auditors had walked past for years.

The same week, OpenAI’s Codex team reported a critical Node.js Brotli flaw (CVE-2026-111497, CVSS 9.2), and AI Weekly lists AI-assisted discoveries at the top of its security stories. The lesson for anyone running a website is simple: the time between a bug being found and being exploited is shrinking, so “I’ll update next month” is no longer a safe plan.

Timeline: From AI Discovery to Mass Exploitation

The exposure numbers are huge. Modat counted about 4.38 million PHP services on 1.89 million hosts in the ten days before October 20, and roughly 79% of those with a readable version were on unsupported branches. PHP 7.4 alone accounted for 878,761 services. These are exposure counts, not confirmed compromises, but they show why attackers jumped on this so quickly.

Is My WordPress Site Affected?

Assume yes until you have checked. The vulnerable code is in PHP, not in WordPress, a theme or a plugin, so updating WordPress core does nothing here. Your site is safe from the two main CVEs only if the PHP build that actually serves your website includes the October 21 fix.

Use this quick decision guide:

• PHP 8.2, 8.3, 8.4 or 8.5 at or above the fixed release: you are patched for the two main CVEs. Still apply the upload progress setting below.
• PHP 8.2 to 8.5 below the fixed release: you need to update, or your host does.
• PHP 7.4, 8.0 or 8.1: these are end of life. Only minimal source backports exist, so the version number may not show whether you are fixed. Ask your host in writing, and plan a move to 8.3 or newer now.
• PHP 7.3 or older: there is no fix from PHP. Upgrade, or take the site offline until you can.

Fixed PHP Versions by Branch

One catch: Linux distributions such as Ubuntu, Debian and Red Hat backport fixes into their own package versions, so a distro PHP might say 8.3.6 and still be patched. In that case, check your distribution’s security notice rather than the upstream number.

How to Check Your PHP Version (4 Ways)

1. WordPress Site Health (easiest)

1. Log in to wp-admin.
2. Go to Tools → Site Health.
3. Open the Info tab and expand Server.
4. Read the PHP version line and compare it with the table above.

2. Your hosting panel

On Hostinger, open hPanel, choose the website and look under Advanced → PHP Configuration. cPanel hosts usually show it under Select PHP Version or MultiPHP Manager. Note that panels often show only the branch (for example “8.3”), not the patch number, so Site Health is the better check.

3. Command line (VPS or dedicated server)

php -v
php-fpm -v      # or php-fpm8.3 -v on Debian/Ubuntu
php -i | grep -i session.upload_progress

Brandefense warns that the command line can load a different php.ini and even a different binary than your website. Check the binary your web server actually uses.

4. From outside

curl -sI https://yoursite.com/ | grep -iE "^(server|x-powered-by):"

This only works if expose_php is on. A missing header does not mean you are safe. Brandefense also runs a free passive check that reads your PHP version from response headers. Never run a public exploit against your own live server to “test” it; there is no published safe test for these bugs.

Fix It on Shared or Managed Hosting

On shared or managed WordPress hosting, you do not control the PHP binary. Your host does. Good hosts patched within hours; Wordify, for example, says it patched every PHP version from 7.4 to 8.5 by 16:36 UTC on October 21. Here is what you should do:

1. Check Site Health as above. If the version shows the fixed release (8.2.35, 8.3.36, 8.4.27 or 8.5.12) or newer, the main patch is in place.
2. If you are on 7.4, 8.0 or 8.1, switch to 8.3 or newer in your hosting panel. PHP 8.2 security support ends on December 31, 2026, so 8.3 is the sensible minimum.
3. Before switching, make a full backup and confirm your theme and plugins support the new version. A staging copy is ideal.
4. If anything is unclear, open a support ticket and ask: “Does the PHP build serving my site include the fixes for CVE-2026-109618 and CVE-2026-109619?” Get the answer in writing.
5. Turn on Cloudflare in front of the site if you have not already. Its free plan includes the new WAF rules for known PHP2Shell vectors.

Hostinger users can switch PHP versions from hPanel → Websites → Manage → Advanced → PHP Configuration, pick the version and save. If the site shows errors afterwards, switch back and update the plugin that broke.

Fix It on a VPS or Your Own Server

If you run your own server, the fix is to install the patched packages and restart every PHP process. Distributions received patches before the public release, so check your vendor’s packages first.

Ubuntu or Debian

sudo apt update
sudo apt install --only-upgrade 'php8.3*'     # match your installed branch
sudo systemctl restart php8.3-fpm
sudo systemctl restart apache2   # or nginx
php-fpm8.3 -v

If you use the Ondřej Surý PPA, update from there and confirm the version.

RHEL, AlmaLinux or Rocky

sudo dnf upgrade 'php*'
sudo systemctl restart php-fpm httpd

Help Net Security noted that the volunteer-run Remi repository had no update at publication time, so if you depend on Remi, check it again or switch to distribution packages.

Docker images

Pull the new official images (for example php:8.3-fpm or wordpress:php8.3-fpm), rebuild and redeploy. Old containers keep running old PHP until you replace them.

Restart all workers

This step matters because CVE-2026-109619 lives in long-running workers. Restarting the web server alone is not enough if PHP-FPM keeps old workers alive. Restart PHP-FPM itself, then verify the version again with a temporary phpinfo() page that you delete straight afterwards.

Temporary Mitigations if You Cannot Patch Yet

These reduce exposure but do not replace patching. Use them only to buy time.

• Disable upload progress: add session.upload_progress.enabled = 0 to php.ini (or .user.ini on shared hosting), then restart PHP. WordPress does not need this feature. It also mitigates CVE-2026-115560. SOCRadar notes that this alone does not fully protect against PHP2Shell.
• Lower request sizes: reduce post_max_size to 8M if you do not accept uploads, or about 32M if you do, and set request size limits in Nginx, Apache or your proxy.
• On PHP 8.5, set fatal_error_backtraces = 0.
• Hide your version: set expose_php = Off so scanners cannot pick you out as easily.
• Put a WAF in front: Cloudflare’s rules are available on every plan, including free.
• If none of that is possible, the UK NCSC advises taking unpatchable systems offline.

; php.ini or .user.ini (temporary PHP2Shell hardening)
session.upload_progress.enabled = 0
expose_php = Off
post_max_size = 32M

Signs Your Site Was Already Hit

Because exploitation started on October 17, review logs from that date onward. SOCRadar’s detection notes list these red flags:

• Multipart POST requests containing PHP_SESSION_UPLOAD_PROGRESS from unknown IPs, especially uploads named MARKER_ followed by eight hex characters.
• Unusual or oversized PHPSESSID cookies, including session IDs starting with fprint or dp.
• Bursts of HTTP 500 errors or “Allowed memory size exhausted” errors after odd multipart requests.
• php-fpm, httpd or apache2 spawning shells, curl or wget.
• Traffic to or from 206.188.197.105, which SOCRadar links to attacker staging.

On the WordPress side, look for:

• New PHP files in wp-content/uploads/ (there should be none).
• Admin users you did not create (Users → All Users, sort by role).
• Unknown plugins, modified wp-config.php, or a changed .htaccess.
• New cron jobs in your hosting panel or WordPress cron entries you do not recognise.

# list recently changed PHP files (VPS)
find /var/www -name "*.php" -newermt "2026-10-17" -ls
# PHP files inside uploads (should be empty)
find /var/www/html/wp-content/uploads -name "*.php"

If you find anything, isolate the site, keep copies of the logs, restore from a clean backup made before October 17, patch PHP, then rotate every password and key (WordPress admin, database, hosting, FTP/SFTP and the salts in wp-config.php).

After Patching: A WordPress Hardening Checklist

• Confirm the PHP version in Site Health shows the fixed release.
• Keep session.upload_progress.enabled = 0 anyway; WordPress does not use it.
• Move off PHP 8.1 or older for good, and plan for 8.2’s end of life on December 31, 2026.
• Enable automatic minor updates for WordPress core and auto-updates for trusted plugins.
• Delete unused plugins and themes. Less code means less risk.
• Keep daily off-site backups with at least 14 days of history, so you can restore to before an incident.
• Subscribe to your host’s status page and to PHP’s security announcements.

I treat this one as a wake-up call for how I run AI side projects too. Tools like ComfyUI and local LLM servers are not PHP, but the same rule applies: AI-assisted bug hunting means patches arrive faster and exploits arrive faster still. If you expose a local tool to the internet, keep it updated and behind authentication.

Frequently Asked Questions

Does updating WordPress fix PHP2Shell?

No. The bug is in PHP, the language WordPress runs on. You need a patched PHP build: 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer, or a distribution package with the backported fix.

Is my site safe because it uses Cloudflare?

Safer, not safe. Cloudflare’s WAF blocks known exploit patterns, but new variants can slip past any WAF, and attackers can sometimes hit your origin server directly. Patch PHP anyway.

Is LiteSpeed affected?

Yes. Help Net Security lists LiteSpeed alongside PHP-FPM, mod_php, php-cgi and FrankenPHP. LiteSpeed hosts need the patched LSPHP packages.

Was PHP2Shell really found by AI?

Partly. Wiz found the first bug using AI-assisted research tools and says frontier AI models substantially lowered the effort needed to prove the flaws exploitable. People still did the research and the responsible disclosure.

Can a security plugin like Wordfence stop it?

Not reliably. The attack fires while PHP is setting up the request, before WordPress or any plugin loads. Only a patched PHP build, or a WAF in front of the server, can act at that point.

Is CISA tracking it?

As of October 23, 2026, SOCRadar reported that neither CVE was in CISA’s Known Exploited Vulnerabilities catalogue, even though exploitation has been observed. That can change quickly.

What is CVE-2026-115560?

A separate session-handling flaw not fixed by the October 21 releases. It only matters for code that changes the session serializer at runtime with upload progress enabled. Setting session.upload_progress.enabled = 0 mitigates it.

Final Thoughts

PHP2Shell is the clearest example yet of AI changing the security timeline. Decades-old bugs were found in days, the details leaked before the patch, and attacks began before most people had heard the name. The good news is that the fix for a WordPress site owner is short: check Site Health, get onto a patched PHP build, disable upload progress, put Cloudflare in front, and scan your logs back to October 17.

If you came here for AI rather than servers, I cover the open models behind this kind of work too. See my guide to running Muse Spark Open locally, the Mistral Large 4 open weights breakdown, and how Comfy Agent automates ComfyUI with plain English.

Sources

• Help Net Security: PHP2Shell critical PHP vulnerabilities patched
• SOCRadar: PHP2Shell affected versions, mitigations and IOCs
• Recorded Future: PHP2Shell exploitation timeline
• Brandefense: fixed PHP versions and free check
• Wordify: what the PHP security release means for WordPress
• AI Weekly: AI security stories, October 2026