PHP vulnerability: what to check if you use WordPress

What happened with PHP

The two flaws, logged as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, allow remote code execution without logging in, according to the CISA alert, from the US cybersecurity agency. They affect every PHP installation that serves web pages, and on 26 October CISA added them to its catalogue of vulnerabilities that are already being exploited.

What sets this story apart is the part played by artificial intelligence. The researchers at Wiz say they used AI models such as Google's Gemini, among other tools, to find the flaws, adapt the attack to different versions and check the patch, and that they demonstrated the attack against the latest versions of WordPress, Drupal and Joomla. By their account, a single researcher did in a week what would once have taken a top-tier team months.

• Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to CISA.
• Unsupported versions: PHP 8.1 and earlier no longer get official updates; for 7.4, 8.0 and 8.1 there are minimal fixes for those who build PHP themselves, according to Help Net Security.
• Attacks: Amazon spotted an attempt to exploit the flaw on 17 October, four days before it was made public, reports Help Net Security.
• Reach: Wiz says PHP runs 70% of the world's websites, a figure it gives without saying where it comes from.

A tutoring school that didn't know it used PHP

Imagine Rocío runs a tutoring school with two teachers. Her website was built a few years ago: timetables, an enrolment form and fee payments. It works, parents use it, and the hosting renews itself every year on the school's card.

One Tuesday, between lessons, a friend forwards her an article about a serious flaw in PHP. Rocío reads it twice. She has no idea whether her site uses PHP, she can't remember the password for the hosting panel and she isn't sure who to call. All she knows is that the form holds the names, phone numbers and payment details of families who trust her.

Why do so many websites go without updates?

The scene is made up, but it looks a lot like many we come across. A website gets commissioned, delivered and celebrated. After that it becomes like the office router: it sits there, it works, and nobody looks at it until something breaks.

The catch is that every website rests on parts that age even if nobody touches them: the PHP language, the content management system, the plugins. CISA itself points out that PHP often comes bundled inside other software, so it is not always obvious that it is there. If the contract doesn't say who updates those parts, the usual outcome is that nobody does.

What is at stake if your site goes unpatched?

Until now, there was usually some time between a flaw being found and someone exploiting it. With AI, that window is narrowing from both sides: the same models that help find a flaw help build the attack. In this case, the first known attempt came before the public warning.

For a small business, the risk is far from abstract. Wiz showed the flaw could also be used to read the server's memory, which may hold passwords and keys. A compromised website can mean customer data out in the open, days without taking payments online and awkward conversations with people who trusted you with their details.

What should I do if my site has the PHP vulnerability?

You don't need to know how to code to take the first steps. These are the ones we would take with any client:

• Ask your hosting provider today, in writing, which PHP version your site runs and whether it already has the 21 October patch.
• If the answer is PHP 8.1 or earlier, ask for a plan to upgrade: it is no longer supported, and CISA recommends taking offline any system that cannot be updated straight away.
• If your site sits behind Cloudflare, bear in mind it has switched on protection rules for all its customers, according to Help Net Security; they are a stopgap, not a substitute for the update.
• If your site has been exposed, consider changing the passwords and keys it stores, such as those for your payment gateway or email.
• Put in writing who updates the site, how often, and how they will let you know when an urgent patch comes out.

That last point is the one most often forgotten, and the one that matters most next time. This won't be the last serious flaw that AI turns up, and the gap between a scare and a real problem usually comes down to how quickly you react.

How we help at digizone

At digizone we sit down with each business to see what software it really uses, what parts it depends on and who looks after each one. Through our technology consulting we help you map all that out, deal with what is urgent first and decide what is worth keeping, updating or rebuilding.

When we build something, security is part of the design from day one. For Granittor we developed a client platform with sign-in by password or by passkey with Face ID and Touch ID, and row-level security on every table so that each user sees only what is theirs.

Start by knowing who looks after your website

You don't need a grand cybersecurity plan to get going. At Rocío's school, the first version would be a single page: which PHP version the site runs, who updates it, where the backups are and who to call if something goes wrong. That way, when the next warning arrives, Rocío will have the version and the number of whoever has to update it to hand.

If you would like to see how it would work for you, our free workshop, in Spanish, walks through it step by step.