PHP websites are getting hacked: here is how to protect yourself

Let us start with the name, because it helps to grasp the scale of the problem. PHP2Shell is not a bug in a plugin or a theme: it is a defect in the PHP engine itself, the program that interprets and runs website code on the server. When the defect sits there, it does not matter how well the website on top of it is written: it is exposed anyway. And PHP runs roughly 69% of the world’s websites, WordPress included.

Technically there are two distinct vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The first exploits memory exhaustion: if the server runs out of memory at the wrong moment, the internal structures of a request are left only half initialised, yet the end-of-request cleanup treats them as complete and ends up writing where it should not. The second concerns global state: data from one request outlives the memory that held it, and the next request on the same process finds it and uses it. In both cases an attacker sending carefully crafted requests ends up executing code on the server, with no password, no account and no form involved.

The bug had been there for years, from version 5.4 up to 8.5. A hint had already surfaced in 2024, but with no known exploit nobody treated it as urgent. It was found in August 2026 by two independent groups, researchers at Wiz and OpenAI’s Patch the Planet project, both using AI models to read the source code in search of errors. That detail struck us: the same technology that finds the flaws is the one that later exploits them.

Patches came out on 21 October: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anyone on 8.1 or earlier, now out of support, has no release to install and must migrate. No partial mitigation holds: the PHP maintainers say so, and we can confirm it, having followed the story from the first reports. Amazon intercepted an exploitation attempt as early as 17 October, four days before the flaw went public, and several European governments chose to switch their websites off rather than take the risk.

The second story made us think even harder. Reuters reported an investigation by security firm NorForge: a Chinese-speaking group set AI agents to work against more than 1,200 websites across the United States, Canada, Australia and Japan, and breached over a hundred of them. Nobody was typing commands: the agent explored the site, tried the possible routes and carried on by itself, for an average of 23 hours per target.

The tools were nothing exotic: DeepSeek, GLM, Grok and Claude Code. The last one is a program, not a model, and in the configurations found it was often wired to models other than Anthropic’s. In one of the documented intrusions the way in was PHP again, but at a different point: unsafe deserialisation of objects and old components of the Zend framework. Legitimate code, written years ago, never updated and left listening on the internet.

Put together, the two stories say one thing. The time between the discovery of a flaw and its exploitation is now measured in days, and on the other side there is no longer a person picking the target but software that tries everything, everywhere, until something gives.