PHP2Shell vulnerabilities found with AI disrupt major sites

Two AI-found PHP vulnerabilities caused major site disruptions and exposed WordPress servers; operators need to check PHP versions and patch quickly.

What happened

Two PHP vulnerabilities found with AI assistance caused major disruptions on the day of publication for 4chan, DeviantArt, Wikipedia, and smaller sites such as a local bar blog that posts dog photos. The PHP Group said the flaws allow "unauthenticated remote code execution," meaning an attacker could run code, change content, and access stored data without an administrator login or password.

The vulnerabilities are not new. Wiz said the flaw had been present in PHP for roughly 20 years but exploiting it "required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve." AI models have now made that kind of obscure bug easier to turn into dangerous vulnerabilities. On the day of publication, Cloudflare's CTO said the company was "seeing early attacks emerging." Dutch and Finnish government agencies took their sites down as a precaution, and the NSA Cybersecurity account on X recommended organizations take systems offline if "an immediate update is not feasible."

OpenAI said an AI security group called Calif identified a critical PHP flaw using GPT-5.6 Sol, and Google-owned Wiz independently discovered and reported the vulnerabilities using AI. The PHP Foundation said an exploit for one vulnerability "was theorized" in 2024, but "no concrete vectors were found" at that time.

Key facts

• W3Techs says PHP is used by "69.3 percent of all the websites whose server-side programming language we know."
• VirusTotal's scanner currently registers about 3.8 million sites running PHP with at least one port open.
• The two vulnerabilities are CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp).
• PHP has contained the underlying issue for roughly 20 years; an exploit was theorized in 2024 but no concrete vectors were found then.
• Wiz called the flaws "among the most severe vulnerabilities discovered … in software history."

Our analysis

The scale of affected infrastructure matters because PHP underpins WordPress and a large share of server-side websites. A vulnerability that allows attackers to take full control of a server can expose passwords, API keys, cryptographic certificates, and databases. The fact that the flaw sat dormant for roughly 20 years while an exploit was only theorized suggests that AI-assisted discovery is changing the risk timeline: previously impractical attack chains can become real quickly once disclosed.

For creators and social media managers, this is not just an IT story. Platforms like 4chan and DeviantArt going down or being patched can interrupt community workflows, content distribution, and brand monitoring. Small WordPress blogs and portfolio sites are also directly exposed because many run on shared hosting with PHP. A site that sells products or holds user data could become a vector for malware distribution.

The source reports that attackers need no admin login or password to exploit the flaws. That likely means a compromised site can be used to attack other servers or to serve malicious content to visitors, making user caution and host-side patching equally important.

What it means for operators

• Check what version of PHP your site uses immediately. If you run PHP 8.1 or older, assume it is affected and upgrade to a newer version, because no official fix is coming for unsupported versions.
• If you use Squarespace or Wix, you are in the clear because those services do not support PHP; otherwise, contact your managed hosting provider or web host such as Hostinger, GoDaddy, or Bluehost to confirm when the fixed release will be deployed.
• If you sell products or services or store sensitive data on your servers, disable your site until your host patches their PHP version rather than leaving it exposed.
• Monitor the social accounts of sites and services you frequently use for update notices before visiting, and watch for unexpected behavior on your own WordPress or PHP-based properties.