PHP2Shell: AI found a decades-old flaw in the engine under your website
AI models discovered two critical vulnerabilities in PHP, the language behind WordPress and many webshops. A WordPress update does not fix it. This is what you need to arrange this week.
Last week, well-known websites in the Netherlands suddenly went dark. DigiD, MijnOverheid, the Dutch House of Representatives and even the National Cyber Security Centre took their sites offline as a precaution. The cause is called PHP2Shell: two critical vulnerabilities in PHP, the programming language that, according to Wiz, runs about 70% of the internet. What stands out is not only the scale, but also who found the flaws: AI models. What does this mean for your website or webshop, and what should you do now?
What exactly is going on?
On 21 October 2026, the PHP development team released emergency updates for two flaws, known as CVE-2026-109618 and CVE-2026-109619. Through these flaws, an attacker can run code remotely on a web server without logging in. Both score 9.2 on the CVSS v4.0 scale, which goes up to 10. That is serious.
Security researchers at Wiz showed that they could run code without authentication on standard installations of WordPress, Drupal and Joomla. In addition, attackers can read memory that may contain passwords, login tokens, API keys and certificates.
The NCSC is clear: any system running PHP that is reachable from the internet is presumably vulnerable until it has been updated. This applies to websites on WordPress, Drupal, Magento and many custom builds, and also to webshops, customer portals and forms. On 22 October, the NCSC reported that it is investigating the first signs of successful exploitation. Sources do not agree on how widely the flaw is already being abused, but waiting for clarity on that is not a good plan.
Why this is mainly an AI story
The flaws were found by researchers at Calif, OpenAI and Wiz. According to Wiz, they had been present for decades. They were simply so hard to demonstrate, requiring an exceptionally complex sequence of steps, that they were at the edge of what human researchers could practically do. Frontier AI models have lowered that threshold considerably.
That is both good news and bad news. Good, because the flaws can now be closed. Bad, because the same kind of tools also become available to attackers. The time between "flaw found" and "flaw exploited" is getting shorter. For SMEs, that means updates you plan to do "later on" become a risk in themselves.
Why a WordPress update won't save you
This is where many entrepreneurs get it wrong. The flaw is not in WordPress or in a plugin, but in PHP itself: the layer underneath. So you can neatly update WordPress and still be vulnerable.
The solution lies in the new PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. According to the PHP team, updating alone does not fully protect a server. And note: after the update, PHP-FPM or Apache must be restarted, because running processes would otherwise keep executing the old code in memory.
Are you running an older version, such as 7.4, 8.0 or 8.1? Patches for these have appeared in the source code, but no official ready-made updates, because these versions are no longer supported. You are not alone: according to VirusTotal, around 758,000 servers that display their version still run 5.4 through 8.1, compared with 272,000 on supported versions.
Your action list for this week
- Find out which PHP version your site uses. This is often shown in your hosting package dashboard, or your web builder can tell you.
- Ask your hosting provider whether the patch has been installed and the server has been restarted. Ask about both; an update without a restart is only half the job.
- Running 8.1 or older? Plan an upgrade. Test whether your theme, plugins and custom code work properly on a newer version.
- Replace passwords and keys. Because data may have been read from memory, it is wise to change passwords for your CMS, hosting and database, and to renew API keys, for example for payment or email connections.
- Use the NCSC's tools. The NCSC has published a guide with a decision tree and maintains an overview of PHP-related software products, so you can check what is vulnerable.
Do you have multiple systems, such as a website, a webshop and a customer portal? Then check all of them. That one forgotten form or old subdomain is often the weak spot.
Looking ahead: maintenance is no longer a side issue
PHP2Shell shows where things are heading. AI finds flaws faster than teams can fix them, and that will soon apply to more than just PHP. If you see your website as something you build once and then leave alone, you face growing risk. Regular maintenance, up-to-date software and knowing who to call when things go wrong are becoming as important as a good design.
At Silvar, we work with AI every day and keep websites, apps and servers up to date for entrepreneurs across the Netherlands. Not sure whether your site is running securely, or want to finally get rid of that old PHP version? You get one fixed point of contact and hear back from us within one working day. Together we figure out what is needed, without fuss.