Key Takeaway
- 🚨 The story is real: two 9.2-rated PHP flaws — nicknamed PHP2Shell — allow unauthenticated remote code execution on web servers, and Europe’s agencies told operators to patch or take sites offline.
- 🤖 AI found them: security firms Calif and Wiz used OpenAI frontier models; the flaws hid in PHP for over a decade; fixes have already been released.
- 🖱️ The takedowns are real too: Finland, the Dutch parliament, Edinburgh council, the BBC’s show pages, DeviantArt, and French government sites went dark as a precaution — a patch race, not a live blackout.
- 🌐 The honest number: Wiz estimates roughly 70% of the internet runs affected code (independent verification pending); PHP powers about three-quarters of websites with a known server language.
- 🔧 Do this today: find who patches your PHP, confirm your version, upgrade anything end-of-life, and put confirmed WAF rules in front — the steps below take minutes as a WordPress site owner.
Table of Contents
PHP2Shell — the shorthand the Dutch security firm Sansec gave the pair — is what happens when the internet’s most common server language turns out to have a decade-old wound: security researchers just exposed two 9.2-rated PHP flaws that let an unauthenticated attacker run code on any reachable server, and by Wednesday afternoon Europe’s governments had started switching their own websites off as a precaution, not because of a blackout. The pair — CVE-2026-109618 and CVE-2026-109619 — shipped fixes at 14:00 UTC (PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35), security watchers say exploitation attempts are already arriving, and every WordPress site owner on earth runs the affected software stack. This guide separates the verified facts from the clickbait and gives you the patch sequence that matters for your site today.
PHP2Shell Explained: Two 9.2 Flaws in the Web’s Favorite Language
The vulnerabilities are rated 9.2 on the CVSS scale — critical territory — because they point to unauthenticated remote code execution: an attacker who never logs in could send crafted web requests that run code on the server itself. CERT-EU’s advisory 2026-018 carried the operational warning and PHP’s security team confirmed the scores and scheduled the emergency release; the European Union’s CERT team put the operational detail in writing: all PHP installations serving web requests are potentially affected, including the PHP-FPM mode most shared hosts run, Apache’s mod_php, the php-cgi mode, and newer stacks like FrankenPHP and LiteSpeed. The most dangerous variant is mod_php, where a demonstrated exploit fires the attack before any of the site’s own code runs.
Why the panic response was proportionate rather than theatrical: PHP is the engine under most of the web. Roughly three-quarters of sites with a known server-side language run PHP — which powers WordPress, the world’s most used content system — so a flaw that executes code without authentication becomes a landmine at internet scale. Wiz’s estimate that roughly 70% of the internet runs affected code carries the honest caveat that it is a firm estimate, not a measured census; the BBC flagged it as unverified. Either way, the exposure math favors acting first. Hosting provider GoDaddy’s warning matched the agencies’ own wording: the flaws could allow data theft, website defacement, or full server takeover.
The AI Twist: How PHP2Shell Was Found After 11 Years
The discovery itself is the story’s second headline. Researchers at the security firms Calif and Wiz used state-of-the-art AI from OpenAI to surface the flaws, which had gone undetected for more than a decade. Wiz called them the most severe vulnerabilities ever discovered by the technology. OpenAI described the disclosure as one of the most impactful security issues in recent memory. The reason the timeline collapsed is the part the whole security industry is studying: frontier models compressed exploit development across the affected applications from months into hours. A vulnerability class that once required national-lab patience can now be walked end-to-end in an afternoon.
The response posture from agencies matches that arithmetic. The EU’s CERT-EU advisory (2026-018) told organizations to identify every PHP application in their environment, prepare to patch everything at once, and — where patching immediately is not feasible — isolate internet-facing applications from the public network. The UK’s NCSC, Australia’s ACSC, and Japan published matching guidance; Japan’s Prime Minister Sanae Takaichi publicly urged people to check whether their sites ran PHP; the White House said federal agencies were assessing impacts and working with leading AI labs to speed the fix.
What Europe Actually Took Offline
The takedowns were precaution — the same defensive move CERT-EU recommended, executed by organizations that could not patch fast enough. Finland temporarily shut public government web services while it waited for the fix. The Dutch Cyber Security Centre took its own site offline; the Netherlands’ lower house of parliament (Tweede Kamer) and public-access services like DigiD-era pages became unreachable. Edinburgh council’s site went inaccessible; the BBC’s own show pages — including Doctor Who and The Traitors — went dark ahead of the update. DeviantArt posted a temporary-maintenance notice, and French government sites served an ongoing-maintenance screen. Others on the precaution list: the bookmarking service Pinboard, the privacy group noyb, parts of Wikipedia, a Belgian school platform, and an Antwerp hospital. Media coverage framed the same picture the security teams had: a self-inflicted pause for safety, not an attack in progress.
The distinction matters because headlines compressed it. Nothing in the verified reporting says the internet’s “75%” went dark — the takedown list is a few dozen very visible organizations. The 75% figure circulating on social posts is PHP’s market share of websites with a known server language, repackaged as an outage forecast. The real number agencies acted on is the exposure estimate: roughly 70% of the internet, per Wiz, unverified.
The Exploitation Watch: What “In the Wild” Means Right Now
Threat intelligence firms reported exploitation attempts appearing within hours of disclosure — scripted proof-of-concepts, some generated with AI assistance, hitting internet sensors with distinctive scanner signatures. None have succeeded publicly so far. The correct read of that gap: the attack window is open, the tools exist, and every unpatched hour widens the target pool. Cloudflare’s CTO said the company was already updating its firewall rules as a stopgap while the patch rollout spread — WAF rules that block the request patterns buying time for sites that host-manage their PHP.
The Patch Sequence for WordPress and PHP Site Owners
- Find who owns your PHP updates. On shared or managed hosting, the host patches PHP server-side; ask them to confirm the emergency fix is applied to your server. Own your own server? The update is yours.
- Check your version. In WordPress: Tools → Site Health → Info → expand the Server section; your host’s control panel shows the same. Anything below 8.2 needs an upgrade path, not just this patch.
- Confirm the fixed release. The emergency versions shipped today: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If you sit on an older branch, the fixed numbers change — match your major version and read the official advisory.
- Upgrade end-of-life stacks. PHP 8.1, 8.0, 7.4, and older stopped receiving security updates — today’s fix does not include them. Upgrade the branch as the only safe path, and verify the destination version carries the fix.
- Set a stopgap while you wait. A web application firewall with confirmed rules for the attack patterns buys hours; the major CDNs updated rules the same day. Confirm with your WAF that the rules are live, not just enabled.
- Decide the takedown the way agencies did. If a site cannot be patched and cannot be protected, take it offline until it can — the official advice is explicit. A dark page for a day beats an owned server for a quarter.
- Verify, then re-verify. After patching, confirm the serving version, run your site’s security scan, and watch logs for the scanner signatures researchers published.
The WordPress-specific wrinkle needs its own line: automatic updates will NOT apply this fix, because the patch lands on the server’s PHP, not in WordPress’s update system. The plugin that protects your site can scan and warn; your host or server admin is the actor. Wordfence’s guidance said exactly that — find out today who is responsible for the PHP on your site.
Our own readers sit inside this stack — the phone-compromise checks in our hacked-phone guide and the self-hosting guides we publish — from building a media server to locking the network edge — all assume a maintained PHP and a host that patches on emergency cadence. Our zero-day patch-math guide walks the same discipline on another actively-exploited appliance class.
Common Mistakes to Avoid
- Assuming WordPress updates you. The theme and plugin updater touches WordPress code — not the PHP engine. Only a host or server-side action puts the fix in place.
- Waiting for “confirmed successful exploitation.” The agencies acted early because the PoCs exist; waiting for headlines of real breaches means patching after the data left.
- Buying a random “PHP-fix” plugin or script. The fix is a server-side version update — anything selling otherwise is chasing fear.
- Patching one server and forgetting the rest. Staging servers, cron scripts, and forgotten side projects run PHP too; the exposure list is a fleet, not a homepage.
- Treating the WAF rule as the cure. A firewall rule is a stopgap; the version update is the fix. The agencies’ language separated the two for a reason.
Frequently Asked Questions
What is PHP2Shell?
PHP2Shell is the industry nickname for two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619), each rated 9.2, that could allow unauthenticated remote code execution on servers running PHP. They were discovered by AI-assisted research and fixed in PHP’s emergency releases on October 21, 2026.
Does this affect every WordPress site?
Every WordPress site runs on PHP, so every site rides the affected software class. The fix arrives on your server: ask your host to confirm the patched PHP version. WordPress’s own update system cannot apply it.
Is 75% of the internet really offline?
No — the precautionary takedown list is small (visible organizations like Finnish government services, the Dutch parliament, Edinburgh council, and a few platforms). The 75% figure on social posts is PHP’s share of websites with a known server language; Wiz’s exposure estimate was roughly 70%, flagged as unverified by the BBC.
Which PHP versions got the fix?
The emergency releases shipped as PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Older branches like 8.1 and 7.4 are end-of-life and receive no fix — upgrading the branch is the only protection for those servers.
Has anyone been exploited with PHP2Shell yet?
Threat firms reported exploitation attempts in the first hours — scripted scanning and proof-of-concept traffic — with no confirmed successful public compromise at the time of writing. Treat the window as open and patch as if the attacks are next.
What does AI-discovered malware-risk mean for the future?
The discovery shows the new search speed: flaws hidden for over a decade were found and weaponized-in-principle within a day once frontier models worked the problem. Expect shorter windows between finding, patching, and exploiting — and expect defensive AI to matter as much as offensive AI.
Financial Disclaimer
This article provides general cybersecurity guidance and does not constitute professional security or financial advice. Hosting configurations, patch availability, and vulnerability details evolve rapidly; verify every step against the official PHP security page, your hosting provider’s advisory, and your WordPress site-health tools before acting. The author and publisher disclaim any liability for actions taken based on this information.
