Got a WordPress site? AI found critical holes in PHP – here is how to check your site is updated

Two critical security holes in PHP, the language that WordPress and a large share of all websites are built on, let an attacker take over a web server without logging in. The holes were found with the help of AI, and updates arrived on 21 October. Amazon has seen attempts to exploit them. If your business, club or blog has its own site, here is how to check that it is protected.

On 21 October 2026 the PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They close two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. Both are rated 9.2 out of 10 for severity. According to the PHP project they affect all PHP installations that answer web requests, and they can let an attacker run their own code on the server without logging in. The PHP project urges everyone to update immediately. Sweden's CERT-SE issued a warning the same day.

Why does it affect so many? PHP is the programming language under WordPress, Joomla and Drupal, and according to the security company Wiz under 70 percent of all websites. The hole is in PHP itself, not in WordPress. Wiz showed it could take over freshly installed WordPress, Drupal and Joomla sites, and according to Automattic, the company behind WordPress.com, updating WordPress, your theme or your plugins does not protect you. It is PHP on the server that has to be updated.

This is where AI comes in. The bugs have existed for more than ten years and affect versions all the way back to PHP 5.4. Wiz writes that the AI models Gemini 4 Argon and GPT-5.6 Sol made it practical to find them and build working attacks, something that according to Wiz would otherwise have taken a team of experts months. The security company Calif and OpenAI also reported the bugs. Amazon warns of the flip side: AI makes it cheaper to turn a security update into an attack, so the time between update and attack keeps getting shorter.

How bad is it right now? Amazon detected an attempt to exploit the holes as early as 17 October, four days before they became known, and writes that PHP2Shell is now seeing broad exploitation attempts. Amazon does not know whether the attempts would have succeeded against real systems. At the same time the security company Dataminr reported only scanning and exploits that did not work, and no known break-ins. So it is not time to panic, but it is urgent.

What applies to you? If your site is on WordPress.com it is already protected according to Automattic, and you do not need to do anything. If you have an ordinary web host or an agency that runs the server, they are the ones who should update, but ask them to confirm it. If the site runs PHP 8.1 or older it no longer gets official updates, and PHP 8.2 also stops getting security updates on 31 December 2026. Then it is time to move to a newer version.

Sources

• PHP.net: Security advisory: Critical remote code execution vulnerabilities, update now (21 okt 2026) (retrieved 2026-10-24)
• CERT-SE: Kritiska sårbarheter i PHP (21 okt 2026) (retrieved 2026-10-24)
• Wiz Research: PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet (21 okt 2026) (retrieved 2026-10-24)
• AWS Security Blog: Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure (21 okt 2026) (retrieved 2026-10-24)
• BleepingComputer: Amazon says PHP2Shell exploitation began 4 days before patches (inkl. Dataminr: inga kända intrång) (retrieved 2026-10-24)
• Automattic: Your Sites Are Protected Against the PHP2Shell Vulnerabilities (21 okt 2026) (retrieved 2026-10-24)

TipAI explains AI in plain language for beginners, families and small businesses. Every article has sources and a "How to get started" section.

← All news · Try TipAI