Critical PHP Vulnerabilities: What WordPress Website Owners Need to Do Now

Updated October 22, 2026

A major website security issue has made headlines this week, and businesses running WordPress websites should pay attention.

On October 21, 2026, the PHP project released security updates addressing two critical vulnerabilities in PHP, the programming language that powers WordPress and many other websites and web applications.

The vulnerabilities, collectively referred to in security reporting as PHP2Shell, could allow an attacker to execute malicious code on an affected web server without first logging into the website.

What makes this story especially interesting is that AI-assisted security research helped uncover the flaws. However, the vulnerabilities themselves were in PHP's underlying code, and the PHP development team was responsible for preparing and releasing the fixes.

For businesses, the immediate priority is straightforward: determine whether your website's hosting environment has been patched.

Updating WordPress, its themes, and its plugins remains important, but those updates alone do not necessarily fix a vulnerability in the PHP software running on the server.

What Is PHP, and Why Does WordPress Depend on It?

PHP is a server-side programming language. When someone visits a WordPress website, PHP runs on the web server to generate pages, process requests, communicate with the database, and perform many of the operations that make the website work.

WordPress depends on PHP, as do other popular content management systems and many custom web applications.

A useful way to understand the relationship is to think of a website as a system with several layers:

• PHP: The underlying software environment that executes server-side code.

• WordPress core: The main application that manages website content and functionality.

• Themes: The code that controls the website's presentation and layout.

• Plugins: Additional components that provide features such as contact forms, e-commerce, backups, and security tools.

• Hosting infrastructure: The web server, database, operating system, and other services that support the website.

Each layer requires appropriate maintenance.

A vulnerability in PHP can potentially affect applications running on top of it, even when those applications are not themselves responsible for the underlying flaw.

That is why this incident matters to WordPress users and to businesses running other PHP-based applications.

What Is the PHP2Shell Vulnerability?

The October 21 security release addresses two critical PHP vulnerabilities.

1. Out-of-Memory Corruption — CVE-2026-109618

PHP manages memory while processing incoming requests and executing application code.

The first vulnerability involves a failure in PHP's handling of an out-of-memory condition. Under certain circumstances, an allocation failure can leave internal request data only partially initialized. Later cleanup operations may incorrectly treat that data as valid, resulting in memory corruption.

Under the right conditions, this can be exploited to execute code on the server.

This is more serious than an ordinary situation where a website runs out of memory or displays a resource-limit error. The problem concerns how the PHP engine handles its internal state when memory allocation fails.

2. Stale Global State — CVE-2026-109619

The second vulnerability involves internal state that can remain associated with memory that has already been released.

This type of programming error is commonly called a use-after-free vulnerability.

Under certain conditions, a later request may interact with invalid internal state. Security researchers demonstrated that this issue could also lead to remote code execution in an affected environment.

Both vulnerabilities affect PHP itself rather than a specific WordPress theme or plugin.

The precise attack conditions depend on the server configuration and execution environment. Nevertheless, the potential impact is severe enough that administrators should prioritize the appropriate security updates.

For technical details, see the official PHP security announcements.

How Did AI Help Discover the Vulnerabilities?

One of the most noteworthy aspects of this incident is the role of artificial intelligence in security research.

Security researchers used AI-assisted tools to investigate PHP's underlying code, identify potential weaknesses, and help validate vulnerability reports. Multiple research teams contributed findings, and PHP maintainers worked on developing and testing the fixes.

AI can help security researchers examine large codebases, recognize unusual programming patterns, investigate memory-handling problems, and explore whether a suspected flaw could have practical security consequences.

However, discovering a possible problem is not the same as confirming a vulnerability. Researchers still need to reproduce the issue, assess its impact, validate proposed fixes, and coordinate disclosure with the developers responsible for the software.

The PHP Foundation's account of the incident describes how several research efforts helped clarify the severity of the problems and contributed to the eventual fixes.

This is an important development for cybersecurity. AI-assisted tools can help defenders discover weaknesses that might otherwise remain unnoticed for years. The same general capabilities may also help malicious actors analyze software more quickly, making timely patching increasingly important.

Read more in the PHP Foundation's explanation of the security release.

Could Your WordPress Website Be Affected?

If your website runs on a vulnerable PHP installation, it may be exposed even if you have kept WordPress and its plugins up to date.

The PHP project published the following patched releases on October 21, 2026:

PHP branch

Patched release

PHP 8.2

8.2.35

PHP 8.3

8.3.36

PHP 8.4

8.4.27

PHP 8.5

8.5.12

These are the fixed releases announced for those PHP branches. The correct upgrade depends on the version and packaging used by your hosting environment.

If your website uses an older PHP branch, do not assume that it is safe simply because it continues to operate normally. The hosting provider may need to migrate the site to a supported PHP version or supply a vendor-maintained security update.

There is one additional consideration: some operating-system vendors and hosting providers apply security fixes to their own software packages. Their version strings may not always match the upstream PHP release number exactly. Ask the provider to confirm whether the specific vulnerabilities have been addressed.

Also, PHP 8.2 is approaching the end of its security-support lifecycle on December 31, 2026. If your website is running that branch, it is sensible to discuss a longer-term upgrade plan rather than treating the immediate patch as the end of the maintenance work.

Source: PHP's official security release information.

Why Updating WordPress Alone Is Not Enough

This is the most important distinction for website owners to understand.

Updating WordPress core replaces or modifies WordPress application files. Updating a plugin or theme changes that particular component.

Neither action automatically guarantees that the PHP interpreter on the hosting server has been updated.

For example, imagine that your WordPress dashboard reports that WordPress core, all installed plugins, and the active theme are current. Those are positive signs, but they do not establish that the underlying PHP runtime has received this security fix.

The reverse is also true: updating PHP does not eliminate vulnerabilities in outdated WordPress plugins or insecure website configurations.

Website security requires maintenance at every relevant layer.

That includes the hosting environment, PHP, WordPress core, themes, plugins, user accounts, backups, and access controls.

How to Check the PHP Version Used by WordPress

If you maintain a WordPress website, you can start by checking the version reported in the administration dashboard.

1. Sign in to WordPress.

2. Open Tools → Site Health.

3. Select the Info tab.

4. Expand the Server section.

5. Look for the PHP version information.

This gives you a useful starting point, but it does not necessarily prove that the server is patched. Your hosting provider may use a vendor-maintained package containing security fixes that are not reflected by the upstream version number alone.

If you do not have access to the server configuration, contact the hosting provider or the company responsible for maintaining your website.

For additional instructions, consult the WordPress Site Health documentation.

What Should You Ask Your Hosting Provider?

If you use managed WordPress hosting, shared hosting, or an external website maintenance provider, ask them to verify the PHP2Shell issue rather than simply asking whether PHP is up to date.

You can send them this message:

Please confirm whether my website's PHP runtime has been patched against CVE-2026-109618 and CVE-2026-109619, known as the PHP2Shell vulnerabilities.

If it has not been patched, please advise on the appropriate security update or migration to a supported PHP version. Please also confirm which PHP runtime serves my website and whether any additional action is required.

A good provider should be able to determine which PHP runtime your website uses, whether the applicable security fixes have been installed, and whether any compatibility testing is required.

If you manage your own server, review the official PHP advisory and follow the instructions for your operating system and hosting configuration.

The U.S. National Security Agency has advised organizations to prioritize patching affected PHP systems. Its guidance also recommends taking an affected system offline if an immediate update is not feasible. For a business website, that decision should be coordinated with the hosting provider or qualified security professional rather than handled through an improvised configuration change.

See the NSA advisory on PHP2Shell.

What About WordPress Updates, Plugins, and Themes?

After addressing the PHP runtime, review the rest of the website's maintenance status.

Update WordPress core. Install applicable security and maintenance releases.

Update plugins and themes. Outdated components can contain separate vulnerabilities that attackers may exploit.

Remove unused components. Unnecessary plugins and themes increase the amount of code that must be maintained.

Review administrator accounts. Confirm that each administrator is authorized and uses appropriate authentication controls.

Verify backups. Ensure that a recent backup exists and that you know how to restore the website if an update fails or a security incident occurs.

Test the website. After PHP or other hosting changes, verify the public pages, administration dashboard, forms, online payments, booking functions, and other business-critical features.

Before making a significant hosting or PHP change, take a recoverable backup of the website files and database. On a business-critical website, compatibility testing can also help identify problems before they disrupt customers.

However, routine testing should not become a reason to postpone an urgent security fix indefinitely. If compatibility problems prevent an update, work with the hosting provider or a qualified website professional to find a safe path forward.

What If a Website Was Already Vulnerable?

Installing the security patch closes the relevant software vulnerability, but it does not automatically prove that a previously exposed website has never been compromised.

For that reason, website owners should take any credible signs of suspicious activity seriously.

Warning signs may include unfamiliar administrator accounts, unexpected changes to website files, suspicious redirects, malicious content, unfamiliar scheduled tasks, or unusual server activity.

These symptoms do not necessarily mean PHP2Shell was exploited; other security problems can produce similar signs. But an affected site with evidence of unauthorized access needs more than a routine software update.

The investigation may need to include server logs, file integrity checks, administrator accounts, credentials, database contents, and other systems the website can access.

If compromise is suspected, involve the hosting provider or a qualified security professional to investigate, remove unauthorized changes, and restore the site from a trustworthy source if necessary.

A Reminder That Website Maintenance Is Ongoing

This incident illustrates why website maintenance cannot stop after the initial design and launch.

WordPress is widely used, and its underlying software environment evolves continuously. Security issues can be discovered in the PHP runtime, the operating system, web-server software, plugins, themes, and other components.

A responsible maintenance process includes checking for security announcements, applying updates, maintaining recoverable backups, testing important functionality, and confirming that the hosting environment remains supported.

The fact that AI-assisted research helped uncover these particular PHP flaws is notable. More broadly, security research tools are evolving, and organizations should be prepared to respond promptly when important vulnerabilities are disclosed.

For small businesses, that does not mean panicking every time a security headline appears. It means knowing who maintains the website, understanding where the software runs, and having a process for verifying that important security fixes have been applied.

Need Help Maintaining Your WordPress Website?

Wireknots helps businesses throughout Chicago and the surrounding area with website maintenance, WordPress support, hosting, and technology security.

If you are unsure which PHP version your website uses, whether your hosting environment has addressed the PHP2Shell vulnerabilities, or how to update your site without disrupting its functionality, professional assistance can help you work through those questions.

We can help review WordPress core, plugins, themes, backups, and maintenance practices, and coordinate the necessary hosting changes with your provider.

Website Hosting & WordPress Support →
https://www.wireknots.com/web-hosting/

Cybersecurity & IT Security Services →
https://www.wireknots.com/cybersecurity/

Contact Wireknots to discuss website maintenance, security updates, and protection for your business's online presence.