What is PHP2Shell?

PHP2Shell is the name given to two critical vulnerabilities in the PHP core, tracked as CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10 (CVSS 4.0). Under certain conditions, they let an outsider run code on a website's server with no username, no password and no click from anyone.

PHP is the language that runs on the server, the computer where a website lives. According to figures cited by Axios and La Ecuación Digital, it powers roughly 70% of websites whose server-side language can be identified. WordPress, Drupal, Joomla and MediaWiki (the software behind Wikipedia) all run on PHP, along with a long list of online stores, banks and media sites.

What could an attacker do?

Running code on a server means the server follows instructions someone else chooses. With that control, an attacker could steal data, change what the site shows or take over the site entirely, according to the joint warning from the NSA, the FBI and CISA.

A concrete example, not a reported incident: on an online store, someone with that access could swap the real checkout page for a copy and collect every customer's card details. The site would look exactly the same.

Wiz also showed a second part of the problem. Without logging in, its researchers could read passwords, session tokens and API keys from other visitors out of the server's memory. That's why a vulnerable site's customers are exposed too, even if they have never heard of PHP.

How it was found: one researcher, an AI model and a fix stuck since 2024

The affected code is more than a decade old. Wiz says every PHP release from the last ten years carries at least one of the two flaws, and Calif traces the original code path back to PHP 5.4.

In 2024, an external audit of the PHP core, funded by Germany's Sovereign Tech Agency and carried out by Quarkslab, produced 27 findings. While those were being fixed, a PHP Foundation developer noticed the first signs of the memory problem. Nobody could prove it was exploitable remotely, and every proposed fix broke something else, so the work stalled. The PHP Foundation itself calls it "a structural failure."

In 2026 that changed:

The part we find most interesting: the AI didn't do it alone. Austin picked where to look, built the hypothesis from what he knew about old PHP bugs and judged the results. The model traced code and tested paths. Wiz describes the final exploit as "an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve," and credits frontier models with lowering that bar.

Why so many websites went dark

On October 21, the NSA, the FBI and CISA urged organizations to install the fix and, if they couldn't update quickly, to take systems offline until they could. Japan's Prime Minister Sanae Takaichi posted a warning on X before the patch was even out and suggested suspending services if needed.

That's what drove the precautionary shutdowns: government sites in France, Denmark, Finland and the Netherlands (including the Dutch cybersecurity agency), airline ANA, railway operator JR West, the bank MUFG and some Wikimedia systems, according to ABC7.

As of October 23, exploitation attempts are happening worldwide (Cloudflare reports millions), but the sources reviewed by La Ecuación Digital had not confirmed a wave of successful intrusions.

What is "Black October"?

Black October is a nickname that spread on social media for the week of October 19 to 22, 2026, when PHP2Shell and several other security incidents became public.

The label lumps together very different cases: AI-agent attacks on at least nine South Korean banks, a single operator who used the Cairn platform to breach more than 100 company websites for roughly $50 per intrusion, and a tampered release of the LiteLLM AI library that stole credentials and was downloaded about 49,000 times.

According to SecurityToday, many of those attacks had been running for months. What changed is speed: agents that work for hours without supervision, and one person running campaigns that used to take a team.

What to do if you run a website

1. Ask your hosting provider, or whoever manages your site, whether PHP has been updated. The fix lives on the server. WordPress.org was explicit: "No WordPress update is required or planned for these issues."

2. Check your PHP version. In WordPress, go to Tools › Site Health › Info › Server. Your hosting dashboard shows it too.

3. Confirm it's a patched release. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Versions 7.4 through 8.1 get no official release, and anything older than 7.4 gets no fix from the PHP project.

4. If you're below 8.2, plan the upgrade. In the meantime, ask your host whether it has applied its own patches or firewall (WAF) rules.

5. If you can't update quickly, consider taking the site offline for a while. That's the recommendation from the NSA, the FBI and the NCSC.

6. Rotate any keys stored on that server. If your site connects to AI tools, payment gateways or other services through API keys, rotate them after updating. Wiz showed they could be read from memory.

7. Turn on a password manager and two-factor authentication for your admin panels. It won't fix PHP2Shell, but it limits the damage if a credential leaked.

   
   

This story has two sides, and both are worth looking at. AI helped crack in days a problem the PHP team couldn't solve in two years, and this time it got there before the attackers. But the same combination (someone who knows a lot plus a model that does the heavy lifting) is available to anyone.

For a business, the real risk sits in the gap between when a fix is published and when someone installs it. That gap depends on knowing what software runs your site, who is responsible for updating it and how long it takes them to decide. None of that requires AI. It requires someone having the answers written down before the next alert.

Frequently asked questions

• What is PHP2Shell? It's the name of two critical vulnerabilities in the PHP core (CVE-2026-109618 and CVE-2026-109619) disclosed on October 21, 2026. Under certain conditions, they allow unauthenticated code execution on a server.

• Is my WordPress site affected? If your server runs an unpatched version of PHP, it can be. The flaw is in PHP, not WordPress, so updating WordPress or your plugins won't fix it. PHP has to be updated on the server.

• Which PHP versions include the fix? 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Versions older than 8.2 don't get an official release from the PHP project.

• Who found the flaw? Researchers at Calif and Wiz, working separately and with help from AI models. OpenAI coordinated part of the work through its Patch the Planet program.

• What is Black October? A social media nickname for the week of October 19 to 22, 2026, when PHP2Shell and other security incidents became public. It isn't an official name, and several of the cases had been going on for months.

• Have websites already been hacked through PHP2Shell? Exploitation attempts have been seen worldwide since October 17. As of October 23, 2026, no wave of successful intrusions had been confirmed.