Six o'clock, watch in hand. PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 this Wednesday, October 21 at 4 p.m. (Paris time). PHP is the language that runs around three out of four websites, including all WordPress. These versions plug the two critical flaws announced this morning under the name PHP2Shell. In short, anyone can take control of an affected server, without any password. Cloudflare was already filtering attempts since 5 a.m. But attackers are already changing their methods to circumvent its rules, according to the company. Are you hosting a WordPress site, a WooCommerce store that accepts bitcoin, or your mining pool dashboard? So the rest of this page can wait, not the update.
PHP2Shell Fix: Who's Covered, Who's Not
A flaw is an error in the code. A hacker can use it to make the server do what he wants. The php.net security advisory describes two, referenced CVE-2026-109618 and CVE-2026-109619. Both score 9.2 out of 10 on the CVSS severity scale. In both cases, the attacker sends a trapped request to the server. He then obtains the right to launch his own programs on the machine, without username or password. And this happens before the site has even started working. The problem affects all common ways of running PHP (PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed). But PHP judges the maximum risk on Apache with mod_php, because a single request is enough.
Versions 8.1 and older no longer receive official updates. However, the project did not abandon them, contrary to what the first analyzes said. He has also posted fixes for PHP 7.4, 8.0 and 8.1 on GitHub. Likewise, Linux distributions and extended support vendors had received the patches in advance. If you don't know which version you are using, your host probably manages PHP for you. In this case, it is up to him to apply the update. So just one question is enough: “Have you applied the PHP2Shell patch?” »
Temporary patches, while waiting for the update
Some can't update within an hour. For them, php.net lists workaround measures, in other words temporary patches. The project specifies, however, that “there is no such thing as complete mitigation.” The most effective is to disable upload tracking (session.upload_progress.enabled setting set to 0). You must then restart PHP, then reduce the maximum size of data that a visitor can send. Cloudflare, which filters traffic from a large part of the web, has also activated its blocking rules. They apply to all its subscriptions, including free, since 5:02 a.m. Paris time, i.e. nine hours before disclosure. The company also took the opportunity to launch a new analysis tool. This inspects both what enters the server and what leaves it.
What you need to do today, in order:
First, list all your PHP installations, including those hidden in third-party software (statistics tool, forum, old forgotten site).
Then, upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 depending on your version, or install the package from your Linux distribution.
On a version that is too old, apply the patches above and plan the migration. PHP 8.2 also ends on December 31.
Finally, watch for signs of attack. For example file uploads followed by serial 500 errors, abnormally large PHPSESSID cookies or PHP processes that restart for no reason.
A ten-year-old flaw, found by an AI in a week
The Wiz Research post answers the question everyone has been asking since Monday's leak. This cybersecurity company is behind the discovery. In fact, bugs had been lying dormant in the PHP engine for over ten years. What has changed is the tooling. The team of Sagi Tzadik, Shir Tamari, Nir Ohfeld and Tomer Schwartz found the first flaw on August 19. It relied on its Wiz Atlas tool and two recent AIs, Gemini 4 Argon from Google and GPT-5.6 Sol from OpenAI. The next day, the team confirmed remote control over Drupal, then over WordPress the day after. The report went to PHP on August 24. The acknowledgment of receipt arrived on September 21. The fix falls two months to the day after the report.
Wiz writes it bluntly. “A single researcher accomplished in one week” the work of several months of a high-level team. Because the models adapt the attack to each version of PHP, to each configuration and to each memory layout. The company therefore compares the episode to Heartbleed in 2014 and Log4Shell in 2021, two flaws which shook the entire internet. She even speaks of a tipping point for the era of offensive artificial intelligence. Raluca Ada Popa, head of Gemini security at Google DeepMind, qualifies the argument in the same post. Indeed, AI was also used to validate the patch and build the detection tools.
An embargo that ended two days too early
The coordination mobilized the PHP project, Calif.io, OpenAI and Quarkslab for the research. Then Automattic (the parent company of WordPress.com), Akamai, AWS, Cloudflare, Fastly, Google, Imperva, Microsoft and Vercel took over for protections. Amusing detail noted on X by researcher Ananay Arora, someone registered the domain php2shell.com on October 14. That is to say a week before the disclosure. Less amusing, the embargo scheduled for Thursday was lifted Monday morning, after a message on the Hacker News forum. A demonstration video even circulated before being removed. Huntress, however, had not seen any real exploitation on Monday evening. Cloudflare, however, has seen some since this morning.
