Is Your WordPress Site Safe? AI Discovers Major PHP Security Bug!

If your website runs on WordPress, WooCommerce, Magento or Drupal, this one is urgent. Researchers using artificial intelligence have uncovered critical security flaws inside PHP itself, the programming language that powers roughly 70% of all websites. And these bugs had been hiding in plain sight for more than ten years.

In this guide, we explain what happened, who is at risk, and the exact step-by-step actions small business owners should take right now.

---

What Happened? The PHP2Shell Vulnerability Explained

On October 21, 2026, security firm Wiz Research disclosed a group of critical vulnerabilities in the core PHP engine, nicknamed PHP2Shell. The PHP team released security patches the same day.

The two main flaws are:

• CVE-2026-109618 – Lets attackers read leftover memory from the PHP worker without logging in (a memory-handling flaw).
• CVE-2026-109619 – Lets attackers corrupt shared PHP state left on the server and run their own code.

The flaws carry a top severity score of 9.2 out of 10, and almost every PHP version released in the last decade is affected, going back to PHP 5.4. Reports say government and organization websites in the US and Europe were temporarily taken offline while teams applied fixes, and the FBI warned the bugs could allow remote code execution.

How AI Found a 10-Year-Old Bug

What makes this story remarkable is how it was found. Wiz used its own AI research system, Wiz Atlas, together with Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol to discover and validate the flaws.

The bugs survived for over a decade because they were extremely complicated to find and exploit by hand. AI removed that barrier.

That cuts both ways. The same kind of AI tools can help attackers scan thousands of websites in minutes looking for unpatched servers. That’s why acting quickly matters.

Why Updating Plugins and Themes Won’t Fix It

This is the most important point for site owners: the flaw is in the engine, not your website code.

Updating your WordPress theme, plugins or even WordPress core will not fix this issue. The vulnerability lives inside PHP on your hosting server. Even a perfectly built website stays exposed until the PHP underneath is patched.

Is Your Website at Risk?

Platform	Risk Level
WordPress & WooCommerce	🔴 High
Magento (Adobe Commerce)	🔴 High
Drupal, Joomla, custom PHP sites	🟠 At risk – patch PHP
Shopify, Wix, Squarespace	🟢 Not directly affected (the platform manages the servers)

Good news for Shopify store owners: Shopify, Wix and Squarespace are hosted platforms, so you don’t manage PHP yourself. There’s nothing you need to patch.

Check Your PHP Version

Your PHP version decides how easily you can be protected.

• PHP 8.2, 8.3, 8.4, 8.5 – Supported. Ask your host to apply the latest security patch.
• PHP 8.1, 7.4 or older – No longer officially supported, so they won’t receive official fixes. You need to upgrade to a supported version.

How to find your PHP version in WordPress: Go to Tools → Site Health → Info → Server.

If your site hasn’t been updated in 3–4 years and runs very old PHP (like PHP 5.x), it may not work with modern PHP at all. In that case, plan a rebuild or a professional upgrade, since running unsupported PHP is a serious risk.

Step-by-Step Action Plan for Small Business Owners

Step 1: Contact Your Hosting Provider

Send your host a message today asking whether they have applied the PHP2Shell patch. Here’s a template you can copy:

**Subject: Urgent – PHP2Shell security patch (CVE-2026-109618 / CVE-2026-109619)**Hi team, Please confirm whether the PHP security patches released on October 21, 2026 for CVE-2026-109618 and CVE-2026-109619 have been applied to the server hosting my website [yourdomain.com]. Please also confirm which PHP version my site is running and whether it is still supported. Thank you.

Step 2: Update Your PHP Version

Log in to your hosting control panel (cPanel, Plesk or your host’s dashboard), find the PHP version selector, and switch to the latest supported version. Take a full backup first and test your site afterwards.

Step 3: Enable a Web Application Firewall (WAF)

A WAF such as Cloudflare, Sucuri or Wordfence adds a protective layer that can block attack attempts while patches roll out.

Step 4: Apply a Workaround if Patching Is Delayed

If your host can’t patch right away, ask them about temporary mitigations recommended in the official PHP and Wiz advisories, and keep your firewall rules active.

Step 5: Monitor Your Site

Watch for unusual admin users, unknown files, or sudden slowdowns, and keep regular off-site backups.

Which Hosting Companies Are Responding?

Many major hosts are rolling out patches. WP Engine notified customers that the patch has been applied. If you’re with Kinsta, Pressable, GoDaddy, Bluehost, SiteGround, DigitalOcean, AWS or Linode, send them the message above to confirm your server is protected. On cloud servers (DigitalOcean, AWS, Linode), you may be responsible for updating PHP yourself.

Frequently Asked Questions

Is my WordPress site hacked because of this bug? Not necessarily. Being vulnerable isn’t the same as being hacked. But you should patch immediately and check for signs of compromise.

Will updating WordPress fix the PHP vulnerability? No. The flaw is in PHP on the server, so your hosting provider or server admin must update PHP.

Are Shopify stores affected? No direct action is needed. Shopify manages its own infrastructure.

What is PHP2Shell? It’s the name given to a group of critical PHP core vulnerabilities disclosed on October 21, 2026, discovered with the help of AI.

Final Thoughts

This is a wake-up call: AI is now finding (and helping exploit) bugs that stayed hidden for years. The fix is simple but urgent: contact your host, update PHP, and add a firewall. Don’t wait until your site is targeted.

👉 Watch the full video for a visual walkthrough: https://youtu.be/c0n0VhhKhsY

Found this helpful? Subscribe to our YouTube channel for the latest AI and website security news.