PHP2Shell: The Critical PHP Flaw Found by AI, and Our Offer to Patch Your Website Free of Cost
What happened in October 2026, who is at risk, and how LogicSpice can secure your site at no charge
Published: By LogicSpice Team9 min read
Table of Contents
- Introduction: Why We Are Writing This, and What We Are Offering
- What Is PHP2Shell?
- How AI Found a Bug That People Missed for 14 Years
- What Happened in the First 48 Hours
- Is Your Website Affected?
- Our Offer: We Will Patch Your Website Free of Cost
- If You Prefer to Patch It Yourself
- What This Means for the Future of Web Security
- About LogicSpice
- Conclusion
- FAQs
- What is PHP2Shell?
- Which PHP versions are affected?
- My WordPress site is up to date. Am I safe?
- Is the LogicSpice patch offer really free?
- What do you need from me to apply the patch?
Introduction: Why We Are Writing This, and What We Are Offering
On 21 October 2026, the PHP project released an emergency security update for two critical vulnerabilities, now known together as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). PHP runs roughly three out of four websites with a known server-side language, including every WordPress, Drupal, Joomla, Laravel and Magento site. Researchers reported that the flaws had existed in PHP for around 14 years and that nearly every version from PHP 5.4 to 8.5 was affected. Within hours of the announcement, millions of attack attempts were being recorded across the internet.
LogicSpice has built and maintained PHP websites and applications for 20 years. Many of our clients, and many businesses that have never worked with us, are running sites that are exposed right now, often without knowing it. So we are doing something simple: we will check your website and apply the PHP2Shell security patch free of cost. No contract, no fee. The details are in the "Our Offer" section below.
First, here is what PHP2Shell is, how AI found it, and why it matters for you.
Free PHP2Shell patch for your website: send us your website address and we will check it and apply the fix at no charge.
What Is PHP2Shell?
PHP2Shell is a group of memory-safety bugs in the core PHP engine. They are not bugs in WordPress or any single framework; they sit inside PHP itself, so any application running on an affected PHP version can be exposed, even a very simple one.
According to the Wiz Research disclosure, the root cause is how PHP handles fatal errors during a request, especially out-of-memory errors. When a request fails in this way, PHP can leave behind corrupted internal data, and the next request handled by the same worker reuses it. An attacker who can trigger this on purpose can:
- Read server memory that may contain passwords, session tokens, API keys and certificates. One variant leaks memory into the PHPSESSID cookie of a later response, even if the application never starts a session.
- Run their own code on the server (remote code execution) without logging in, by combining a memory leak with a use-after-free bug.
The researchers demonstrated unauthenticated remote code execution against up-to-date WordPress, Drupal and Joomla installations. The highest severity score given was CVSS 9.2 out of 10.
How AI Found a Bug That People Missed for 14 Years
The vulnerable code was public and had been reviewed by thousands of developers over the years. It was found only when AI models were pointed at the PHP source and asked to look for memory-safety problems.
- 1 August 2026: Calif, a California AI red-teaming firm taking part in OpenAI's "Patch the Planet" initiative, found the first issue using OpenAI's GPT-5.6 Sol model.
- 19–21 August 2026: Wiz Research, working independently, found the same family of bugs using Google's Gemini 4 Argon, GPT-5.6 Sol and its own Wiz Atlas platform. Within two days it had confirmed working remote code execution against Drupal and WordPress.
- 24 August 2026: Wiz reported the issues to the PHP security team. OpenAI and the French firm Quarkslab also took part in the coordinated response.
- 21 October 2026: Patched PHP versions were released and the research was made public.
Wiz called the discovery "an AI inflection point". A single researcher, working with AI, finished in one week what would earlier have taken a team months. AI did not only find the bug; it helped write the exploit, adapt it to different PHP versions and validate the patch. The same tools are available to attackers, which is why the response was so fast on both sides.
What Happened in the First 48 Hours
- Reports of the vulnerability surfaced late on 20 October, a day before the official announcement, and Amazon Web Services said it had seen exploitation attempts even before the public release.
- Cloudflare reported tens of thousands of exploit attempts within 45 minutes of the news breaking, hundreds of thousands within two hours, and millions by the evening of 21 October.
- Palo Alto Networks estimated 22.6 million potentially vulnerable PHP instances exposed to the internet.
- The FBI, the NSA, the EU's computer emergency response team and agencies in Japan, the Netherlands and Finland urged organisations to update. Some government agencies took websites offline until they could patch.
- One startup owner reported that attackers stole source code, cookie data and legal documents from an unpatched server.
Security experts warned that a compromised web server is rarely the end of an attack. It becomes an entry point into the rest of the company's network, where customer data, email and internal systems live.
Recommended Read: Why Software Testing Basics Matter Even in the Age of AI and Automation
Is Your Website Affected?
If the answer to any of these is yes, assume you are affected until you have confirmed the PHP version is patched:
| You run… | Why it matters |
|---|---|
| WordPress, WooCommerce, Drupal, Joomla or Magento | All run on PHP. Updating the CMS alone does not fix the problem; the PHP version on the server must be updated. |
| A Laravel, CodeIgniter, Yii, CakePHP or Symfony application | Custom applications are affected in the same way as CMS sites. Check every environment: production, staging and old demo servers. |
| Shared hosting or a managed platform | Your host controls the PHP version. Confirm in writing that it has applied the 21 October 2026 security release. |
| An older site on PHP 7.x or 5.x | These versions no longer receive official updates. The only safe option is to move to a supported, patched PHP version. |
| PHP inside Docker images or serverless functions | Images built before 21 October 2026 contain a vulnerable PHP. Rebuild and redeploy them. |
Our Offer: We Will Patch Your Website Free of Cost
Patching is the only complete fix for PHP2Shell, but many business owners do not know which PHP version their site runs on, or who is responsible for updating it. We want to remove that barrier. For a limited time, LogicSpice is offering the following at no charge:
| What we do | Details |
|---|---|
| 1. Free vulnerability check | Send us your website address. We confirm the PHP version in use and whether the site is exposed to PHP2Shell, and tell you the result within one working day. |
| 2. Free patch installation | If the site is vulnerable and you give us access to the server or hosting panel, we install the PHP security release, restart the services and confirm the site is working. |
| 3. Free post-patch check | We review the server logs for the known signs of PHP2Shell attacks and tell you if we find anything that needs attention. |
| Who can use it | Any business, whether or not you are an existing LogicSpice client. WordPress, Laravel, CodeIgniter, Magento, OpenCart, custom PHP: all welcome. |
| What is not included | Moving a site from an unsupported PHP version (5.x, 7.x) to a current one, fixing code that breaks after the upgrade, or secret rotation. We will tell you if your site needs this and give you a clear quote before any paid work. |
| How to claim it | Use our contact form with the subject "PHP2Shell free patch" and your website address, or email [email protected]. |
Why free? Because an unpatched website is a risk to its visitors and to every other business it connects with, and because we would rather you meet us by fixing a problem than by reading about a breach.
If You Prefer to Patch It Yourself
- Update PHP first. Install the security release published on 21 October 2026 for your PHP branch, then restart PHP-FPM or your web server.
- Add interim protection if you cannot patch today. Turn on your CDN or WAF's PHP2Shell rules (Cloudflare and others have published them). This reduces risk but does not remove it.
- Check for signs of attack. Look in server logs for unusual multipart requests followed by memory-limit errors, repeated HTTP 500 responses, unusually large or malformed PHPSESSID cookies in responses, and unexplained PHP worker restarts.
- Rotate secrets. Because one variant leaks server memory, treat database passwords, API keys, session secrets and certificates on an exposed server as possibly compromised and change them after patching.
- Review old and forgotten servers. Staging sites, client demos and abandoned microsites are often the weakest link. Patch them or take them offline.
- Set up a maintenance routine. PHP2Shell will not be the last critical flaw. A monthly patch cycle and automatic security alerts turn a crisis into a routine task.
What This Means for the Future of Web Security
PHP2Shell is a preview of how software security will work from now on. AI models can read millions of lines of code and find bugs that reviewers have walked past for years, and the same tools let attackers build working exploits in hours. The gap between "a flaw is announced" and "your site is being attacked" has shrunk to minutes. Keeping software up to date is no longer optional housekeeping; it is the main line of defence.
About LogicSpice
LogicSpice is an ISO 9001 certified software development company founded in 2006, with 3,000+ projects delivered for 1,500+ clients. We have built PHP applications on WordPress, Laravel, CodeIgniter, Yii, CakePHP, Magento and OpenCart for two decades, and our website maintenance and software maintenance and support services cover PHP upgrades, security patching, dependency updates and log monitoring on an ongoing basis. If your application runs on an old PHP version, our Laravel and PHP development teams can plan an upgrade that keeps the site running while the risk is removed.
Conclusion
PHP2Shell was found by AI, exploited with AI and patched in a coordinated effort across the industry. For most businesses the next step is simple: find out whether your website is patched, and if it is not, fix it today. If you are not sure how, send us your website address and we will do it for you, free of cost.
FAQs
What is PHP2Shell?
PHP2Shell is the name given to two critical vulnerabilities in the PHP language (CVE-2026-109618 and CVE-2026-109619) disclosed on 21 October 2026. They allow attackers to read server memory and run code on the server without logging in.
Which PHP versions are affected?
Researchers reported that every PHP release of the last decade, from 5.4 to 8.5, contains at least one of the bugs. The fix is to install the security release published on 21 October 2026 for a supported branch.
My WordPress site is up to date. Am I safe?
Not necessarily. The flaw is in PHP, not in WordPress. The PHP version on your server must be updated, which is usually done by your hosting provider or server administrator.
Is the LogicSpice patch offer really free?
Yes. The vulnerability check, patch installation and post-patch log review are free for any business. If your site needs more than a patch, such as moving off an unsupported PHP version, we will tell you and quote for that separately before doing any paid work.
What do you need from me to apply the patch?
Your website address for the check. For the patch itself, access to the server or hosting control panel (SSH, cPanel, Plesk or similar). We work within your access rules and confirm the site is running normally afterwards.