The one-sentence takeaway
On October 21, 2026, PHP released fixes for two critical vulnerabilities known as PHP2Shell: CVE-2026-109618 and CVE-2026-109619 (CVE is the international identifier for a vulnerability). Both have a CVSS score of 9.2 (CVSS is a severity score out of 10). Cloudflare, a network services company used by many websites to block attacks, and Wiz say that unpatched versions starting with PHP 5.4 are affected.
The fastest step: paste your PHP information into ChatGPT
If you use WordPress, copy the PHP information from Tools > Site Health > Info > Server. Others can look in their hosting control panel. If you cannot find it, ask your host. Remove passwords and keys, then paste it into ChatGPT or Claude along with the prompt below.
Here is the PHP information for my website from WordPress's "Site Health > Info > Server" or my hosting control panel.
Find the PHP version and first compare it with the upstream stable versions that include this fix (compare within the same branch): 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Upstream support has ended for 8.1 and older branches.
Explain separately whether it meets the upstream version threshold and whether it is patched. A host or Linux distribution may backport a fix to an older version number. Without the full package version and an applicable security advisory or proof from the host, mark the patch status as "Unable to confirm". Do not conclude that it is vulnerable just because its version number is older. Also do not call it safe if there is no version, the version cannot be identified, or it is a prerelease. Then help me ask my host: "Has the website's PHP received the PHP2Shell security update from October 21, 2026? Do I need to switch versions in the control panel?"
(Paste the information here)Understand it in a minute
An attacker may be able to make a server execute their code without logging in. Security company Wiz says that a successful attack could let the attacker take control of a server, steal sensitive data, and alter the website on it.
The vulnerabilities are in PHP itself. Cloudflare warns that updating the website’s software or plugins will not fix them; PHP must be updated. WordPress.org also says a WordPress update is neither needed nor planned for this issue.
Let AI scan for you
OpenAI published php2shell-checker on GitHub. It checks the PHP version of a website or local machine, sends no attack requests, runs on Node.js, and needs no additional packages. It consists of two skills for Codex (OpenAI’s AI coding assistant), meaning instruction files written for an AI to follow.
URL only (check a website you own)
In Codex, enter the first line to install both skills, then use the second line to check. Replace the URL with yours:
$skill-installer install both skills from https://github.com/openai/php2shell-checker$phpcheck-url check your-urlThere are three possible results:
OK: The version is newer than the same-branch baseline built into the tool, dated October 20, 2026. It compares only version numbers and does not separately verify the fix.VULNERABLE: The version is at or below the baseline. First check the package advisory or ask your host whether an update is needed.UNKNOWN: The version is not visible or cannot be recognized. UNKNOWN does not mean it is patched.
This check only reads the X-Powered-By and Server headers in the website response. These headers may be hidden or changed, and distribution fixes may not change the version number. It is useful for quickly checking many websites you own. To be sure, check on the server.
Server access (VPS or a host you can log into)
First connect the AI to the website server, then run the check. The PHP on your local machine does not represent the website. After installing the skill in Codex, enter:
$phpcheck-server check the PHP version serving my siteYou can also use Claude Code (Anthropic’s AI coding assistant) or Codex and paste this prompt:
Check whether the website I own or manage, 【enter URL】, is affected by PHP2Shell (CVE-2026-109618, CVE-2026-109619).
1. First confirm that you are connected to the server for this website. If you cannot connect or cannot confirm which PHP installation serves the website, report "Unable to confirm". Make read-only checks only. Do not create a test page, install packages, modify or restart services, or read or return passwords, keys, or certificates.
2. Identify the PHP actually serving the website (PHP-FPM or Apache) and compare it with the result of php -v.
3. Report the PHP version and full package version. If you cannot confirm them, report "Unable to confirm".
4. Compare against the fixed versions, within the same branch: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If system packages are used, check the distribution security advisories: Ubuntu USN-8948-1, USN-8948-2, and Debian DSA-6574-1. Configuration alone cannot prove that it is patched.
5. List the steps to update and restart services, and wait for my confirmation before taking action.
6. Do not run any attack code or PoC.OpenAI’s skill also warns that the result of php -v should be checked against the PHP-FPM or Apache instance actually serving the website. A distribution may backport fixes to an older version number.
Shared hosting / WordPress dashboard
Use the prompt above.
Notes on AI scans
- Only check websites you own or manage. Do not scan other people’s websites.
- Do not test with attack code or a PoC (proof of concept). OpenAI’s two skills also say not to perform attack probing.
- Treat AI’s assessment as a starting point. Before taking action, confirm with your host or the distribution’s security advisory.
Fixed versions
If you manage the server yourself: Install the version in the table or the security update from your package source, then restart the service used by the website, such as PHP-FPM or Apache. Confirm that the website is using the patched PHP.
| PHP branch | Fixed version |
|---|---|
| 8.5 | 8.5.12 |
| 8.4 | 8.4.27 |
| 8.3 | 8.3.36 |
| 8.2 | 8.2.35 |
| 8.1 and older | Upstream support has ended. Install the distribution security update or upgrade. |
When checking versions, compare within the same branch: 8.2.20 is older than 8.2.35 and is not fixed; version 8.2.35 or later is fixed. For Ubuntu, Debian, and other system packages, do not use this table. Check whether the full package version matches their security advisory.
PHP 8.1 and older: The PHP project has ended support; source fixes are also available for 7.4, 8.0, and 8.1. Distribution security updates can also fix the issue. Check the full package version; Ubuntu Pro is required for the fix on Ubuntu 20.04 LTS. If you manage the server and your PHP is below 8.2, WordPress.org recommends considering temporarily taking the site offline if you cannot patch it right away.
If you use Cloudflare: Cloudflare says free and paid WAF (web application firewall) plans have had default protection since 2026-10-21 03:02 UTC. Paid plan users should confirm that the managed rules are deployed and set to block. PHP still needs to be updated.
Timeline: AI found it first, then details leaked
OpenAI says that, to its knowledge, the most advanced AI found these vulnerabilities before attackers did, giving defenders time to patch first. The PHP Foundation published this timeline:
- August 11: Calif researcher Ryan A reported an unconditional RCE (remote code execution: making a server run an attacker’s code). OpenAI independently reported the same root cause on the same day. OpenAI says Calif used GPT-5.6 Sol in the Patch the Planet program; Wiz also independently found and reported the issue.
- October 20, around 15:00 UTC: The two CVE identifiers leaked online, accompanied by an incorrect CVSS score of 10.0 and no technical details. PHP moved the release date up by one day.
- October 21: After the leak, Calif accidentally published a PoC video. It was deleted, but had already been shared, speeding up the development of attack code. Chainguard published patched images early at 2026-10-21 07:41 UTC, breaking the embargo (an agreement not to disclose information before a set time). PHP had originally planned to release the fixes that day at 2026-10-21 14:00 UTC.
- Earlier this year: The PHP Foundation also scanned PHP with Claude Mythos.
Cloudflare says it observed attack traffic during the leak. Security company Huntress says it had not seen in-the-wild exploitation among its partner customers as of 2026-10-21 14:00 UTC (10am ET). The PHP security team said that, at release time, it had found no working attack code among the public PoCs it checked.
OpenAI also committed $1 billion in Daybreak usage credits through Daybreak for Frontline Defenders, for organizations with limited security resources that protect critical services.
Penchan’s Take
AI helped find these vulnerabilities, and AI can also help you check your website.
You can act tonight: if you have a server, ask Codex or Claude Code to run a read-only check. If you use shared hosting, paste the PHP information from your control panel into AI, then ask your host. Let AI check; confirm before you update or restart anything.