If you run a blog on WordPress, there’s a security update this week that matters more than the usual plugin nag. It isn’t a WordPress update at all. It’s a fix for PHP, the programming language WordPress is built on, and you might need to do something about it yourself.
On 21 October 2026 the PHP project released emergency patches for two critical flaws, nicknamed “php2shell”. Here’s what happened, why bloggers should care and what to actually do.
What’s the problem?
The two bugs, CVE-2026-109618 and CVE-2026-109619, are both rated 9.2 out of 10 for severity. At worst, they let someone take over a web server without needing a login, or read data straight out of the server’s memory. That memory can hold things like passwords, login tokens and API keys.
The important part for bloggers is that the flaws are in PHP itself, not in WordPress or any plugin. A perfectly up-to-date WordPress site with a tidy, minimal set of plugins can still be vulnerable if the PHP underneath it is old. Security researchers at Wiz proved the point by showing a working attack against the latest WordPress container image.
Nearly every PHP version from the last decade is affected, going back as far as PHP 5.4.
How AI found it
The bugs were found by two seperate teams, both using AI. Calif, a security firm, found the core flaw with GPT-5.6 Sol from ChatGPT maker OpenAI. Wiz found it independently using a mix of its own Wiz Atlas tool, Google’s Gemini 4 Argon and GPT-5.6 Sol, and reported it to PHP back in August.
Wiz says that turning the bugs into a working attack meant chaining several of them together and fine-tuning for each server, which would normally take expert researchers a long time. With AI it took hours. That’s good news for finding bugs before the bad guys do, but it also means attackers can turn a published fix into a working exploit faster than ever. If you’ve ever left an update for “next week”, this is the one not to do that with.
Why your WordPress updates won’t fix it
WordPress auto-updates, plugin updates and security plugins don’t touch the version of PHP your server runs. That’s controlled by your web host (or by you, if you manage your own server). So the usual “I keep everything updated” habit doesn’t cover this one.
The patched PHP versions, according to PHP’s official security announcement, are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
What to do now
1. Check your PHP version. In your WordPress dashboard, go to Tools, then Site Health, then the Info tab, and open the Server section. It’ll tell you the exact PHP version your site is running. Your hosting control panel will usually show it too.
2. Ask your host if it isn’t patched. Most decent managed WordPress hosts will be rolling this out already. If your version number is lower than the ones above, send a quick support message asking when the security release will be applied. It’s a reasonable question and a good host will have an answer ready.
3. Get off old PHP versions. PHP 8.1 and older no longer recieve official security updates, and PHP 8.2 stops getting them on 31 December 2026. WordPress itself recommends PHP 8.3 or newer. Most hosts let you switch PHP version from the control panel. Take a backup first, then check your theme and plugins still behave afterwards, since very old plugins are the usual thing to break.
4. If you run your own server, install the update and restart every PHP worker so the the old code isn’t still running. PHP also flagged a smaller related issue on 23 October (CVE-2026-115560), which only affects an unusual set of settings. Setting session.upload_progress.enabled = 0 in your server’s PHP configuration is the recommended workaround untill the next release.
5. Don’t go looking for exploit code. Unverified “proof of concept” downloads are already doing the rounds, and some may contain malware. Curiosity isn’t worth it.
When the bugs were disclosed there were no confirmed attacks using them, mostly just scanning. With so much of the web running WordPress on PHP, that’s unlikely to last. Checking your PHP version takes about a minute, so it’s worth doing today.
WordPress Theme: Lavoie
