PHP2Shell Flaws Found With AI: Around 70% of Websites Run PHP and CISA Confirms Active Exploitation
Last week, we wrote about scammers using AI to clone voices. October 2026 showed the other side: AI is also finding software flaws faster than people can, and this time the flaws sit inside PHP, the language behind roughly 70% of websites worldwide.
Two vulnerabilities, known together as PHP2Shell, were patched on October 21, 2026. Just five days later, the US cybersecurity agency CISA confirmed they were being exploited. If your website runs WordPress, Laravel or any other PHP code, this is not an update to leave until next week.
1. What PHP2Shell is and why it matters
The two vulnerabilities are CVE-2026-109618 and CVE-2026-109619, rated 9.2 on CVSS v4.0 by Wiz. What makes them different is that the bugs are in PHP itself, not in the application running on top of it.
Impact: an attacker can run code on the server remotely without logging in.
Scope: according to published mitigation guides, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are all affected. Switching from mod_php to PHP-FPM does not avoid the bug.
Patches: fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older have no official fix, and only some long-term support vendors ship their own backports.
WordPress cannot fix this for you: the WordPress.org security team said no WordPress update is planned for this issue. The fix has to be installed in PHP on the server.
2. AI found the bugs, and patching took about two months
According to OpenAI and Wiz, the vulnerabilities were found with help from AI models. Details from different sources do not fully match, so we only include the points several parties confirm.
Who found them: security firm Calif used OpenAI's GPT-5.6 Sol model to find the flaw, while Wiz (owned by Alphabet) independently discovered both vulnerabilities.
Timing: according to some sources, the PHP team received reports around August 2026, about two months before the patch. The exact timeline still differs between sources.
OpenAI's message: the company said AI found these vulnerabilities "before attackers did". The reverse is also true: the same kind of tools help attackers write exploits faster once a patch is public.
3. Already exploited, with government websites taken offline
The gap between the patch release and real attacks was very short this time.
CISA changed its warning: on October 21, CISA said it had not observed exploitation. By October 26, it added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog and told US federal agencies to patch by October 29. For systems that cannot be updated, CISA advises taking them offline.
Websites taken down: many government websites in the Netherlands, Canada, France, Germany, Finland, Belgium and the Czech Republic went offline temporarily to patch, mostly as a precaution.
Many servers still unpatched: according to cited Censys figures, about 42 million PHP services are reachable from the Internet, and more than 10 million have been patched since October 21. Another estimate puts the number still running vulnerable versions at about 32.5 million.
Major hosting providers: Kinsta, WP Engine, Cloudways and DreamHost say they have deployed the fix. Shared hosting may receive patches later, so check your provider's status page yourself.
The Agenorix view: patch speed now matters as much as features
When AI helps both defenders and attackers find bugs faster, the safe window after each patch shrinks to a few days. A website that "works fine" but is rarely maintained is now a real risk. When we build and run websites for clients, we follow these principles:
Know exactly what you run: record the PHP version, web server, plugins and libraries for each website, so when an alert lands you can answer "are we affected?" right away.
Avoid end-of-life versions: PHP 8.1 and older no longer receive official fixes. Upgrading early is always cheaper than handling an incident.
Have an emergency patch process within 24 to 48 hours: for critical bugs that are already exploited, do not wait for the regular maintenance window.
Back up and monitor: keep separate backups and watch for unusual files or processes on the server, because patching alone is not enough for a server that was already compromised.
This is also how we run our SEO-ready websites connected via MCP: updated regularly, monitored, and with clear ownership.
Where to start?
Today, ask your hosting provider or server administrator three questions: which PHP version is your website running, has it been updated to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, and if you are still on PHP 8.1 or older, what is the upgrade plan. If you need a website review or upgrade, the Agenorix team is ready to help, and your first consultation is free: get in touch.
Sources: Help Net Security (Oct 21, 2026), Wiz, Fortune (Oct 21, 2026), Axios (Oct 22, 2026), The Record, Security Boulevard, TechTarget, Cybernews, The Repository.
Share