From EMA
Critical security vulnerabilities in PHP, the widely used software technology that powers millions of websites (including those built with WordPress and other popular content management systems), have been publicly disclosed this week. Collectively referred to as “PHP2Shell,” these issues affect a large share of the web—by some estimates, roughly 70–75% of websites whose server-side language is known.
The vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have existed in PHP versions dating back many years (from 5.4 onward). Think of the vulnerability as a lock that has long been present, and an exploit as the key. Until recently, no one had publicly demonstrated a practical key. Over the summer, frontier AI models assisted researchers (including teams connected to OpenAI’s “Patch the Planet” effort and Wiz) in identifying and developing practical exploits for these longstanding flaws.
On Tuesday, details of the issues and related exploit information leaked online. A successful exploit allows an attacker to send a specially crafted request to an unpatched website, execute unauthorized code on the server without needing to log in, and potentially take complete control of the server. Emergency patches were released by the PHP project on October 21, 2026, for supported branches.
What EMA members and their organizations should do now
-
Contact your website administrator or hosting provider. Ask them to confirm that the PHP version running your website has been updated to a patched release (PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or an equivalent distribution security update) and that all PHP workers/processes have been restarted.
-
Check your website software. Ensure your content management system, plugins, themes, and other server software are current.
-
Verify your backups. Confirm that recent website and database backups are available and can be restored if needed.
-
Review website activity. If you manage your own site, monitor for unusual activity, unexpected files, unfamiliar administrator accounts, or other signs of unauthorized access.
-
Follow up if your host manages updates. Request explicit confirmation that the appropriate security patches have been applied.
-
Updating PHP addresses these specific vulnerabilities, but it does not guarantee a site is free from other risks or that it was not compromised before the update. Older end-of-life PHP branches (8.1 and earlier) have limited or no official binary fixes; migration or vendor-supported backports should be prioritized where possible.
What happens next
Leading-edge AI models are now more advanced than many traditional code review teams or human cybersecurity experts in certain discovery tasks. It is not yet clear whether this episode is a one-off or the start of more frequent discoveries of previously hard-to-exploit flaws. Members are encouraged to keep website software current, maintain reliable backups, and monitor relevant security advisories so they can react quickly.
EMA encourages members to share this advisory with relevant technical contacts, clients, or stakeholders as appropriate. For the most current official details, refer to the PHP project’s security advisories and your hosting provider’s status updates.
