A critical security vulnerability affecting nearly every version of PHP — the language that powers approximately 70% of all websites on the internet — was publicly disclosed on October 21, 2026. The flaw, named PHP2Shell by the security researchers at Wiz who discovered it, can allow an attacker to take complete control of a web server without needing a username or password.

What makes this story unusual is how it was found: AI tools did much of the heavy lifting. And what makes it urgent for Toronto small businesses is this — if your website runs WordPress, Drupal, or Joomla, your site is potentially vulnerable right now.

What Is PHP2Shell?

PHP2Shell is the name given to two related memory-safety vulnerabilities in the PHP engine itself. These are not bugs in WordPress or any specific plugin — they are flaws in PHP’s core, which means every application built on PHP is affected regardless of how well-coded it is.

The two CVEs are:

CVE-2026-109618 — Upload-progress unserializer use-after-free and remote process memory disclosure. In plain language: an attacker can send a specially crafted request to your web server and potentially read the contents of PHP’s memory — which may include passwords, API keys, session tokens, and encryption certificates your server is holding at that moment.

CVE-2026-109619 — Fatal-error backtrace use-after-free and OPcache type confusion. This one can lead to unauthenticated remote code execution (RCE) — meaning an attacker can run arbitrary commands on your server without logging in to anything.

Both vulnerabilities carry a CVSS score of 9.2 out of 10 — classified as Critical.

Which PHP Versions Are Affected?

Nearly all of them. Wiz’s research shows that at least one of these vulnerabilities affects PHP versions going back to PHP 5.4, which was released in 2012. If your site is running any PHP version that hasn’t been patched as of October 21, 2026, it is potentially vulnerable.

How AI Discovered This Vulnerability

Wiz Research used a combination of AI tools — including Gemini 4 Argon and GPT-5.6 Sol — to find, develop, and validate these vulnerabilities. According to Wiz, AI significantly reduced the effort required to:

  • Identify the root-cause memory bugs in PHP’s error handling
  • Chain the bugs into working exploits
  • Adapt exploits across different PHP versions, configurations, and memory layouts
  • Validate that proposed patches actually fix the issue

The timeline: Wiz’s AI-assisted research first identified the vulnerability on August 19, 2026. It was reported to the PHP security team on August 24, 2026. PHP released patched versions on October 21, 2026 — today.

This is a significant moment in cybersecurity. The same AI capabilities that helped find this vulnerability are now available to attackers. Security researchers and malicious hackers have access to the same tools. The gap between a vulnerability being disclosed and it being actively exploited is getting shorter every year.

What Can an Attacker Do With This?

Wiz demonstrated working exploits against WordPress, Drupal, and Joomla — but the vulnerability doesn’t depend on those platforms. Any PHP application is at risk.

In the worst case scenario, a successful PHP2Shell attack gives an attacker:

  • Full server access — the ability to read, modify, or delete any file on your server
  • Database access — your customer data, order history, email addresses, and any stored credentials
  • Memory contents — API keys, session tokens, passwords held in memory at the time of the attack
  • Lateral movement — the ability to use your server as a jumping point to attack other systems on the same network

For a Toronto small business, a successful attack could mean customer data stolen, your website defaced or held for ransom, your server used to send spam or host malware, and serious reputational and legal consequences under PIPEDA (Canada’s privacy law).

What You Need to Do Right Now

1. Update PHP Immediately

This is the only complete fix. The PHP security team released patched versions on October 21, 2026 that fix the root cause of both vulnerabilities.

How to check your PHP version:

  • In WordPress: go to Tools → Site Health → Info → Server — your PHP version is listed there
  • In cPanel: look under Software → Select PHP Version
  • Ask your hosting provider

If you’re on managed WordPress hosting (WP Engine, Kinsta, Flywheel, etc.), contact them — they may have already applied the patch or will be doing so urgently.

If you manage your own server (VPS, Lightsail, etc.), update PHP through your package manager:

bash

# Ubuntu/Debian
sudo apt update && sudo apt upgrade php

# CentOS/RHEL
sudo yum update php

Then restart your web server:

bash

sudo systemctl restart apache2   # Apache
sudo systemctl restart nginx      # Nginx + PHP-FPM
sudo systemctl restart php8.x-fpm # PHP-FPM specifically

2. If You Can’t Patch Immediately

Several CDN and security providers published out-of-the-box mitigations on the same day as disclosure:

  • Cloudflare — has published WAF rules that block PHP2Shell exploit attempts
  • Fastly, Google Cloud, Vercel — have also published mitigations

If your site runs behind Cloudflare (free or paid), enabling their WAF provides a temporary layer of protection while you arrange patching.

3. Check for Signs of Compromise

Application logs may show little evidence of a PHP2Shell attack. Look for:

  • Unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses
  • Unusually large or malformed PHPSESSID cookies in your access logs
  • Unexpected PHP worker restarts or unusual memory usage spikes
  • New admin accounts in WordPress you didn’t create
  • Modified core files — run a WordPress file integrity check via Wordfence

4. Rotate Your Secrets

If your server has been running an unpatched PHP version and was exposed to the internet (almost certainly yes), assume that memory contents may have been read. Rotate:

  • WordPress database password (in wp-config.php and in your database user settings)
  • Any API keys stored in wp-config.php or .env files
  • SMTP credentials used by your site for sending email
  • Any payment gateway API keys (Stripe, PayPal, etc.)

What This Means for WordPress Site Owners in Toronto

Most Toronto small business websites run on WordPress, which runs on PHP. The vast majority of WordPress hosting — shared hosting, cPanel hosting, VPS — puts PHP version management in the hands of the site owner or their IT provider.

This is exactly the kind of vulnerability that managed IT support exists to handle. When a critical security patch drops, a managed IT provider applies it the same day, checks for signs of compromise, and rotates credentials if needed. A business owner managing their own hosting finds out about it days or weeks later, if at all.

Common Mistakes to Avoid

Assuming your host patched it automatically — many shared hosts do not automatically update PHP. Check your version and confirm with your host.

Waiting to see if you get attacked — by the time you know you’ve been compromised, the damage is done.

Only updating WordPress plugins, not PHP — plugin updates do not fix this vulnerability. The PHP engine itself must be updated.

Ignoring this because your site “doesn’t have anything valuable” — attackers use compromised servers to send spam, host phishing pages, and attack other targets. Your site being compromised costs you even if nothing is stolen from it directly.

Need Help Patching Your WordPress Site?

If you’re a Toronto business owner and you’re not sure what PHP version your site is running or how to apply this patch safely, this is exactly what Dyvonix IT Solutions handles for our managed IT clients.

We can:

  • Check your current PHP version and patch status
  • Apply the PHP security update to your server
  • Run a WordPress file integrity check and malware scan
  • Rotate database and API credentials as a precaution
  • Set up ongoing monitoring so you’re never the last to know about a critical vulnerability

Contact Dyvonix IT Solutions →

Or learn more about our WordPress security and managed IT services for Toronto businesses →

Summary

PHP2Shell is one of the most significant web vulnerabilities disclosed in recent years — two critical flaws in PHP’s core engine, found with the help of AI, affecting virtually every PHP version since 2012. Patches were released October 21, 2026. If your WordPress site hasn’t been updated yet, it is potentially vulnerable to unauthenticated remote code execution right now. Update PHP today.

Sources: Wiz Research — PHP2Shell · Fortune · CNN