Originally published at: PHP2Shell Vulnerabilities Put 70% of Websites at Risk - TidBITS
Although security vulnerabilities in Internet infrastructure software are generally more technical than I would cover in TidBITS, the new PHP2Shell vulnerabilities will have repercussions across the Web. Expect to see numerous websites go down or serve “Page not found” errors as they update PHP, the programming language that underpins 70% of websites. If you run a WordPress, Drupal, or Joomla site, this affects you directly.
The vulnerabilities, which have existed for more than a decade, were discovered by Wiz Research, a security firm that used Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol frontier AI models along with its own Wiz Atlas autonomous AI system for vulnerability research. This is just the latest example of how AI can be used to find and fix vulnerabilities, but in the wrong hands, it can also be used to exploit them. The executive summary to Wiz Research’s blog post lays it all out:
- Wiz Research uncovered multiple critical vulnerabilities in core PHP, a popular general-purpose scripting language that powers 70% of all websites in the world. Successful exploitation could allow attackers to take control of affected servers, steal sensitive data, and deface the websites running on them.
- PHP is a backbone of the web: it’s the programming language powering WordPress, Joomla, Drupal, Wikipedia’s MediaWiki, and many others.
- These vulnerabilities include memory disclosure and unauthenticated remote code execution in PHP itself, independent of the application running on top of it, putting every affected website in immediate risk.
- Every PHP version released in the last decade is affected by at least one of these vulnerabilities, going back to version 5.4. Attackers can exploit them remotely, in some cases fairly easily. Immediate patching is strongly advised.
- On October 21, 2026, PHP released the patch fixing multiple memory-safety vulnerabilities in the core engine.
- These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history. The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.
Practically speaking, if you run a website, update PHP immediately or contact your hosting provider to confirm they’ve applied the patch—and pass this warning along to anyone you know who runs a site. Security experts say that exploits are already being deployed against unpatched sites.