On Wednesday, the FBI, CISA and the UK's National Cyber Security Centre gave website owners blunt advice about a new PHP vulnerability: if you can't fix it fast, take it offline [R4][R5][R6]. The Dutch Parliament did. So did parts of Wikipedia [R12].
If your website runs on WordPress, this is about you. And the fix isn't the "Update WordPress" button you're used to clicking.
PHP2Shell is the nickname for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, that let a stranger run their own commands on your server without logging in [R1][R7].
Both flaws score 9.2 out of 10 for severity, and the PHP project shipped emergency fixes on 21 October 2026 [R1]. Every PHP version from 5.4 to 8.5.11 is affected [R3].
Two teams found the flaws in August. Researchers at the security firm Calif used one of OpenAI's AI models [R9]. Wiz, a cloud-security company, got there on its own [R9][R10]. Then the details leaked online on 20 October, the day before the fix shipped [R29].
CISA's advice: if you can't update right away, or you run 8.1 or older, take PHP-based systems offline [R4]. The FBI said the same, and the NCSC said to consider going offline if you can't put temporary protections in place quickly [R5][R6]. The PHP project didn't soften it either. "There are no complete mitigations, updating is the only safe choice" [R1].
Picture a hotel where housekeeping sometimes skips a room. The next guest walks in and finds the last guest's things still there. That's roughly the second flaw. PHP leaves data behind after one visitor leaves, and the next visitor's request can pick it up [R2].
The first flaw kicks in when PHP runs out of memory halfway through setting up a request. The cleanup step then trusts the half-built pieces as if they were finished, like a crew trusting scaffolding nobody completed [R2].
Here's the part that matters for you. The attack fires before WordPress even starts, so it's an unlocked front door to the whole building, not a weak lock on one room [R2][R7]. That's why updating WordPress or your plugins changes nothing [R31][R15]. Wiz showed full takeovers of WordPress, Drupal and Joomla sites [R10].
Is anyone actually attacking? The accounts conflict. CISA hadn't seen exploitation when it published [R4], and as of 22 October the flaws weren't on its list of known-exploited bugs [R8]. But Amazon logged an attempt on 17 October, before the fix was even public [R7]. It later said the flaws were "now being broadly exploited in the wild" [R6]. Cloudflare's CEO reported hundreds of thousands of attempts within two hours [R15]. I'd assume someone has already tried your door.
PHP runs on 69.3% of websites whose server language is known [R16]. WordPress is the single biggest reason. It alone powers 39.6% of all websites [R17]. Add cheap shared hosting, long-lived servers and an "install once, update never" habit [R24], and you get a lot of old PHP that nobody looks at.
I'll say it plainly. PHP was never designed. It piled up.
It started in 1995 as "Personal Home Page Tools" [R20], a small kit Rasmus Lerdorf built for his own use. He's honest about it: "I had no intention of writing a language. I didn't have a clue how to write a language. I didn't want to write a language" [R25]. He wanted "to solve a problem of churning out Web applications very, very fast" [R25]. Then people "wanted to do everything in the stupid little templating language I had written, all their business logic" [R20].
So PHP grew like a house where every owner adds a room and nobody keeps the plans [R20]. You can see it in the names. Some built-in commands use underscores and some don't, and two search commands take their inputs in opposite order [R27]. A well-known 2012 critique called PHP "a fractal of bad design" [R27]. Even Lerdorf, talking about web security, said "I fully take the blame for some of it, but not all of it" [R26].
Fair is fair, though. Modern PHP is a different animal. PHP 8, released in November 2020, brought real modern features [R23], and 89% of PHP-focused developers now use it [R22]. In 2021, ten companies, including JetBrains and WordPress.com's owner Automattic, formed the PHP Foundation to pay for its upkeep [R21].
Then this week happened. The Foundation's own verdict on how long the fix took: "We won't pretend otherwise: the delay was a structural failure." It blamed how its security team makes decisions, and a lack of resources [R11]. The language got better. The money and people behind it didn't keep pace.
Most of the damage will land on sites nobody was looking after. About 35% of PHP sites run PHP 7 or older, versions that stopped getting security fixes years ago [R18]. Of exposed servers with a visible version, 59% had no official fix for PHP2Shell [R14]. The next deadline is already set. PHP 8.2 stops getting security fixes on 31 December 2026 [R19].
A car recall isn't a crisis if you get the car serviced. Upgrading PHP is a well-defined task: check the version, test the site on the new one, switch over, confirm nothing broke. It's not a rebuild.
If nobody on your side does this, hand it over. yousource Dev on Demand works task by task, with a 3-day turnaround per task, and a PHP patch or version upgrade is one task. Check your PHP version today. Then book the next upgrade before 31 December, when 8.2 runs out.
Keep updating WordPress, but it won't fix this. WordPress.org says no WordPress update is required or planned for PHP2Shell [R31][R15]. The fix is updating PHP itself to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 [R1].
Your hosting company sets it, so your host's control panel usually shows it [R30]. In WordPress, Tools > Site Health > Info > Server lists it [R31].
CISA says yes if you can't update right away or run PHP 8.1 or older [R4]. The FBI says the same if an immediate update isn't possible [R6], and the NCSC says to consider it if you can't apply temporary fixes quickly [R5]. A few hours offline costs less than a stolen database.
Reports conflict. CISA had not seen exploitation when it published its alert [R4]. Amazon logged an attempt on 17 October and later said the flaws were "now being broadly exploited in the wild" [R7][R6].
Yes, if it's maintained. Supported PHP versions are patched [R1][R19], and most PHP developers already run version 8 [R22]. The danger is unmaintained PHP, not PHP.
