PHP2Shell: what marketers and store owners should check this week

Ask your host or developer whether your site is patched for PHP2Shell, and whether anyone checked that nothing got in before the fix. Updating WordPress will not fix it: PHP2Shell is a pair of critical flaws in PHP itself, the software Wiz says runs 70% of websites, and PHP patched them on 21 October 2026.

What does this mean, in plain words?

Your website is a shop, and a fault in the wiring of its building has gone public. WordPress is the shop: the shelves, the signboard, the billing counter. PHP is the wiring. Your hosting company is the building manager. Repainting the shop, which is what a WordPress or plugin update does, does not touch the wiring.

Only the building manager can fix it.

If your shop is in a mall such as Shopify or Wix, which runs everything for you, the mall runs the building and this one is theirs to fix.

What is PHP2Shell?

PHP2Shell is the name researchers gave to two critical flaws in PHP, the programming language behind WordPress: CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10. Both can let an attacker run code on a server from outside, and both sit in parts of PHP that nearly every request touches. According to the PHP Foundation's advisory of 21 October, on Apache with mod_php an unauthenticated request can trigger the first before any of a site's own code runs.

Wiz, one of the teams that found them, says the flaws are in PHP itself, independent of the application running on top of it, so any site built on PHP can be exposed, including WordPress and WooCommerce stores. It says nearly every PHP version, back to 5.4 from 2012, is affected by at least one.

Why did it move so fast?

Because AI changed how long it takes to turn a flaw into an attack.

The first signs turned up in 2024, when a developer fixing an issue from PHP's first outside security audit in years noticed the problem. A potential exploit was theorised, but no concrete way in was found, and work on a fix stalled and restarted over months. In the PHP Foundation's words, "the delay was a structural failure".

This summer the security firm Calif, working under OpenAI's Patch the Planet programme, used an OpenAI model to find a critical flaw and reported the first to PHP on 11 August. Wiz, working separately, reported its own findings on 24 August. In Wiz's words, "a single researcher completed in a week what previously would have taken a world-class team months of work".

Cloudflare says it switched on protection for its free and paid plans about nine hours before disclosure. Then, on 20 October, the vulnerability IDs leaked with a wrong severity score of 10.0, and PHP brought its release forward a day to 21 October, 19:30 India time. The Register reports that Amazon's honeypots logged an attempt on 17 October, four days before the fix. Within a day, Cloudflare's chief executive, Matthew Prince, said on X that attempts on its network had gone from thousands before the announcement to millions, Channel NewsAsia reported.

Is my website affected?

If it runs on PHP and has not been updated since 21 October, assume yes until someone shows you otherwise. Palo Alto Networks counted more than 22.6 million exposed instances that may be vulnerable. In India, Cyble's chief executive, Beenu Arora, said a quick scan found over 50,000 internet-facing systems running PHP, 159 of them government. Exposed is not the same as vulnerable, but it shows the reach.

On WordPress you can check your PHP version in two minutes: in the dashboard go to Tools > Site Health > Info and open Server. If it reads 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer, the fix is in. If it shows an older number, that does not settle it, because some hosts patched without changing the number. GoDaddy told its Web Hosting customers a patched site can still show a version like 8.5.11.

Why doesn't updating WordPress fix it?

Because the hole is underneath WordPress. An update to WordPress or a plugin changes your site's code. PHP is the engine that runs that code, and it is updated on the server. On shared hosting that is your host's job, and on a server your developer manages it is theirs. Marketers often own the site and not the server, which is how a fix like this falls between two people.

Has my hosting company fixed it?

Ask them. The answers differ, and some are still moving. Hostinger says patched builds are live for every version from 5.2 to 8.5 on its Web, Cloud and cPanel hosting, and that VPS customers manage their own servers. GoDaddy says its managed WordPress and Web hosting are patched, and that VPS customers update PHP themselves. ActiveSet's tracker of 35 hosts shows Bluehost and HostGator still patching as of its last check on 23 October. For BigRock and MilesWeb it found no public statement, though it could not open most Indian hosts' own pages, and no statement is not the same as no patch.

What should I ask my host or developer today?

Send one message:

Is my site patched for PHP2Shell, and has anyone checked that nothing got in before the fix?

The second half matters, because a patch closes the hole and does not remove anything that came in before. If the answer is not yet, ask when it will be done and what protects the site meanwhile.

If your site runs PHP 8.1 or older, the PHP project no longer sends it updates, though some hosts patch those versions anyway. Ask what the plan is to move to a supported one.

What happens to my ads if my site is hacked?

Google Ads disapproves ads that point to a hacked site. Its policy on compromised sites names signs such as credit card skimmers and redirects, and also running a content management system with known vulnerabilities that have been exploited. Google says it warns at least 7 days before suspending an account under it.

For a marketer the first sign may not be a defaced page. It may be campaigns that stop delivering. Google's route to a diagnosis runs through the Security Issues report in Search Console and its Safe Browsing Site Status Checker.

What did governments say?

The US Cybersecurity and Infrastructure Security Agency told organisations to patch immediately, and said those that cannot, or that run PHP 8.1 or earlier, should take PHP-based systems offline until they are patched. It warned that PHP is often a component of other software, so it may not be obvious where it runs, and that it had not observed exploitation when it published.

CERT-EU and India's CERT-In issued advisories the same day, CERT-In rating the flaws critical.

What does this say about keeping up with AI?

That the gap between a flaw existing and someone using it has shrunk from months to days, for both sides. The PHP Foundation now uses AI on its incoming reports, and it is careful about what that means: "a person makes every call and works on every patch". It is close to how we build agents: what one may decide alone is written down first, and a person gets everything else.

We checked the four sites we run on 23 October: what each reports about its server, and the usual PHP and WordPress pages. None shows PHP. Know what your site runs on, and who updates it.