PHP2Shell: how AI helped defenders fix old PHP flaws

A headline says a PHP flaw puts most of the internet at risk, so you ask an AI chat what to do. You get something like this (an example written for this post, not a real model run):

"PHP2Shell is a critical remote code execution vulnerability. Patch all affected systems immediately and engage an incident response provider."

Every word is accurate, and none of it helps a small business.

PHP2Shell is a set of serious PHP flaws that researchers found with help from AI models, fixed on 21 October 2026. For most small businesses, the job is to ask your web host to confirm your site runs a fixed version, then keep your site updated and two-step login on.

What is PHP2Shell, and does it affect my website?

PHP is the programming language that runs behind a large share of websites, including WordPress, Drupal and Joomla. W3Techs, which tracks this, puts PHP on 69.3% of the websites whose server-side programming language it knows. So if you have a WordPress site, PHP is almost certainly running underneath it.

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. The PHP project's security advisory says they can let an attacker run code on a web server without logging in, and that all PHP installations serving web requests are at risk. It names the fixed versions as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

The NCSC's alert encourages UK organisations to act now and update. That sounds alarming, but for most of us the practical answer is short. If someone else hosts your website, the update is usually their job, and your job is to check it has happened.

How did AI models help defenders here?

This is the part of the story that gets lost under the headlines. According to the researchers' own write-up at Wiz, the vulnerable code had been in PHP for more than a decade. Their timeline says they found the first flaw on 19 August 2026 using AI models, reported the flaws to the PHP security team on 24 August, and patched releases came out on 21 October.

In between, the researchers say they worked with the PHP team and others to verify the fix and prepare protections for organisations that could not update straight away. That is coordinated disclosure: the people who find a problem tell the people who can fix it, and the fix comes out with the news. Tenable's FAQ notes that other researchers involved have also said they used AI models.

The researchers are also honest that the same tools make it easier for attackers to turn old flaws into working attacks. A cloud provider's threat intelligence team reports an exploitation attempt against its decoy systems on 17 October, before the public announcement, and says PHP2Shell is now seeing broad exploitation attempts in the wild. Unit 42 has seen attackers use AI agents after getting in. So AI works on both sides. This time, the people fixing things had a head start, and the fix is already available.

Why the alarming answer doesn't help

The example reply at the top was written for a company with its own servers and a security team. Most coaches, consultants and freelancers have neither. You have a website on a hosting account, a handful of plugins and a login you use now and then.

An AI chat doesn't know any of that unless you tell it. So it gives you the average answer for the average organisation, and the average organisation in security advice is a big one. The result sounds urgent and leaves you with nothing to do.

Ask, update, lock: the fix for a small website

The useful version is short, and none of it needs technical skill.

Ask. Email your hosting provider and ask which PHP version your site runs and whether it has been updated to a fixed release. The PHP advisory says Linux distributions and long-term support vendors received the patches in advance, so many hosts will already have acted. If your site is on PHP 8.1 or older, the advisory says those versions no longer get updates from the PHP project, so ask about moving to a supported version. PHP's announcement for version 8.2.35 adds that PHP 8.2 stops receiving security fixes after 31 December 2026, which is worth planning for now.

Update. Keep WordPress, your theme and your plugins up to date. The NCSC's guidance on protecting your devices says updates fix the bugs criminals could use, recommends switching on automatic updates, and suggests removing software you no longer use. Its PHP alert also asks organisations to keep watching for updates from software and services that bundle PHP.

Lock. Turn on two-step login for your hosting account, your website admin and your email. The NCSC's advice on securing your important accounts recommends passkeys where you can, or a strong, unique password with two-step verification, which it calls one of the most effective ways to protect an account.

Before and after: using AI to write the email

AI can help with the ask, as long as you give it your situation instead of the headline.

Before: "Am I affected by PHP2Shell?" That gets you the reply at the top of this post.

After: "I run a small WordPress site on a shared hosting account. I'm not technical. Write a short, polite email to my host asking which PHP version my site runs and whether it has been updated for the PHP security release of 21 October 2026." Here is the kind of reply that brief produces (again, an example written for this post):

"Hello, I saw the PHP security release of 21 October 2026 for CVE-2026-109618 and CVE-2026-109619. Could you tell me which PHP version my site runs, and whether it has been updated to a fixed release? If not, when will it be? Many thanks."

Check any version numbers it gives you against the PHP advisory before you send it. If you'd like a wider set of everyday habits, our cyber security basics post covers updates, accounts and what your AI tools can reach.

What these steps won't fix

Updating WordPress and your plugins is good practice, but it won't fix this particular problem on its own. The researchers say the flaws are in PHP itself, below the website software, which is why the PHP version matters most here.

These steps also can't tell you whether anything happened before your host updated. The NCSC suggests that organisations unable to update quickly look for signs of compromise, and the threat intelligence team above recommends looking back to 17 October. That is a job for your host or an IT professional, so ask them whether they have checked. And if you run your own server, the PHP advisory and the NCSC alert are written for you, so follow them directly.

One thing to do today

Send the email to your host. It takes a few minutes, and the reply will tell you whether you need to do anything else.

If other people, or AI tools, help you look after your website, it is also worth writing down who updates what and what each person or tool is allowed to touch. Our course on creating an AI use policy for your small team walks through setting clear rules like that.