PHP security alert: Why WordPress and other websites need urgent updates

Websites around the world are facing a serious cybersecurity alert after researchers identified two critical vulnerabilities in PHP, the programming language used to run web applications. The flaws, known as PHP2Shell, could allow attackers to execute malicious code on affected servers without needing login credentials.

OpenAI says its GPT-5.6 Sol model helped identify one of the vulnerabilities, while cybersecurity firm Wiz independently discovered and reported both. The PHP development team has released security updates, and India’s Computer Emergency Response Team (CERT-In) has issued a critical warning.

What Is PHP2Shell And Why Is It Dangerous?

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Both have a reported severity score of 9.2 out of 10 under the CVSS 4.0 system. Successful exploitation could let attackers execute code remotely or access sensitive information held in a server’s memory.

In simple terms, attackers could potentially exploit a vulnerable server by sending specially crafted requests, without first signing in. Depending on the affected system, this could lead to server compromise, data exposure or changes to website content.

PHP powers a substantial share of websites and web applications, making the vulnerabilities a concern for organisations using affected versions. Some government and other organisations have reportedly taken websites offline as a precaution while assessing their exposure. That does not mean every PHP-powered website has been hacked.

Which PHP Versions Need Urgent Updates?

CERT-In has warned that the vulnerabilities affect PHP versions earlier than these patched releases:

- PHP 8.5.12

- PHP 8.4.27

- PHP 8.3.36

- PHP 8.2.35

Website owners should install the appropriate security update immediately. PHP 8.1 and older versions are no longer supported by the PHP project, so organisations using them should consult their hosting provider or software distributor about available fixes and upgrade options.

What Should Website Owners And Users Do?

Organisations should identify all PHP installations, update affected systems, check third-party applications and review server logs for suspicious activity. If an exposed system cannot be patched promptly, administrators should follow official guidance on restricting access or temporarily isolating it. Ordinary users do not need to stop browsing the internet. They should remain alert to suspicious links and phishing messages, avoid entering sensitive information on unfamiliar websites, and use strong, unique passwords with two-factor authentication where available.

The incident also highlights AI’s growing role in cybersecurity: AI tools can help researchers uncover serious weaknesses, but rapid disclosure makes timely patching and responsible security practices essential.