If your business has a WordPress website, this week’s PHP security news affects you, even if you didn’t see the headlines.

On Wednesday 21 October (Thursday in New Zealand), the people who maintain PHP released an emergency fix for two serious security holes. PHP is the programming language that runs roughly three-quarters of the world’s websites, including every WordPress site. If your website is built on WordPress, it was affected.

This wasn’t only a problem for small business websites. The BBC covered the story because of how far it reached: BBC programme pages for Doctor Who and The Traitors were taken offline as a precaution, along with the Edinburgh and Oxford city council websites and several European government sites, while their teams applied the fix.

Below, we explain what happened in plain English, how we handled it for our clients, and why we think it’s a sign of things to come.

 

The short version

  • Two critical flaws were found in PHP, the language WordPress runs on. They’re known as CVE-2026-109618 and CVE-2026-109619, nicknamed “PHP2Shell”.
  • Both are rated 9.2 out of 10 for severity.
  • An attacker can use them to take control of a web server without logging in.
  • Every version of PHP from 5.4 onwards is affected.
  • Clicking “update” in your WordPress dashboard does not fix it. PHP itself has to be updated on the server.
  • The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

 

 

What is PHP2Shell?

The two vulnerabilities have been given the official identifiers CVE-2026-109618 and CVE-2026-109619. Security researchers have nicknamed them “PHP2Shell”. Both are rated 9.2 out of 10 for severity, which puts them in the critical category.

Put simply, both are memory bugs deep inside PHP:

  • One is triggered when PHP runs out of memory partway through handling a page request.
  • The other lets leftover data from one request be picked up by the next one, after it should have been cleared.

A skilled attacker can use either of them to run their own code on a web server. They don’t need to log in, and they don’t need a weak password or a dodgy plugin to get in. Once they can do that, they can change your website, read your customer data, or use your server to attack other people.

The researchers showed working attacks against WordPress, Drupal and Joomla. Every version of PHP from 5.4 onwards is affected, which means these flaws have been sitting there, unnoticed, for more than a decade.

 

How AI helped find the flaws, and why that matters

The flaws were found with the help of AI. Ryan Austin, a researcher at the security firm Calif, used an OpenAI model and reported the first bug to the PHP team on 11 August. A week later, researchers at the cloud security company Wiz found the problems separately, using their own tools alongside AI models from Google and OpenAI, and reported them on 24 August.

According to Wiz’s own write-up, AI means bugs that once seemed impractical to exploit are now realistic targets. Wiz said a single researcher did in a week what would previously have taken a world-class team months.

That cuts both ways. The same tools that helped the good guys find these bugs are available to people who want to break into websites. When a patch is published, attackers can now point AI at the changes and quickly work out how to exploit the old, unpatched version. The gap between “a fix is available” and “people are being attacked” used to be weeks. It’s now closer to hours.

This release was a good example. The CVE numbers leaked early, so the PHP team brought the fix forward a day, from Thursday to Wednesday. Cloudflare reported attack attempts the same day.

 

Why a WordPress update won’t fix this PHP security flaw

This is the part that catches a lot of business owners out.

Clicking “update” in your WordPress dashboard did nothing for this problem. The flaws are in PHP, which is installed on the server underneath WordPress. Only a new version of PHP on that server closes the hole.

Security plugins can’t block it either. Firewall services such as Cloudflare added rules to filter out known attacks, but they describe these as a stopgap until PHP is updated.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Older versions such as PHP 8.1, 8.0 and 7.4 are no longer supported by the PHP team and won’t get an official fixed release. A site still running one of those has to be moved to a newer version of PHP. Sometimes that means updating the theme and plugins first, so nothing breaks.

RNZ reported that the risk is highest for smaller websites on shared hosting, where the business doesn’t manage the server itself.

If nobody is looking after your hosting, nobody is doing that work.

 

How we protected our clients’ websites

We were watching for the release, and on the day it came out we updated PHP on every site under our care plans to the patched versions. We then checked each site was loading and working properly afterwards.

Our care plan clients didn’t need to follow the news, work out whether they were affected or chase anyone for an answer. It was already done.

 

What’s coming next for website security

We don’t think this is a one-off. AI tools are getting better at reading code and finding mistakes in it, and there’s a huge amount of old code holding up the internet.

Reported security vulnerabilities in 2026 are on track to double last year’s record, which was already the highest ever. Only a month earlier, on 22 September, WordPress itself released an emergency fix for a separate critical flaw in its core software (CVE-2026-87902).

For website owners, that means:

  • More security fixes, more often, and some of them urgent.
  • Less time between a fix being released and attacks starting.
  • More fixes that sit outside WordPress, on the server, where a dashboard update won’t reach.

A website that’s built and then left alone was always a risk. It’s now a much bigger one.

 

Why we recommend a website care plan

A care plan means someone is responsible for your website after it goes live. With ours, we:

  • Manage your hosting and keep PHP on a supported, patched version.
  • Apply WordPress, theme and plugin updates, and check the site afterwards.
  • Act quickly when an urgent fix like this one is released.
  • Keep regular backups so your site can be restored if something does go wrong.
  • Answer the phone and reply to emails when you need us.

The cost of a care plan is small next to the cost of a hacked website: lost sales, a damaged reputation, a privacy breach to report, and a rebuild.

 

Not sure if your website was patched? Talk to a real person

When something like this happens, the worst part is not knowing who to ask. Our clients have a team of real people they can call or email, and they get a fast answer from someone who already knows their website.

If your website isn’t on a care plan, or you aren’t sure whether it was patched this week, get in touch and we’ll check it for you.

Phone: 64 3 963 37 39 or Email: [email protected]

 

Sources