01What PHP2Shell is and how it works
PHP2Shell is a serious flaw in PHP, the software behind about 70% of all websites. It could let a stranger take over a website without ever logging in.
PHP is the language that builds most web pages. If you have a WordPress site, your site runs on PHP. Each time someone visits, PHP puts the page together behind the scenes.
Julian Goldie explains it with a shop. Your website is the shop and PHP is the building it sits in. Most security problems are one shop leaving its back door open.
This one is a crack in the building itself.
That is why it matters so much. You can have a clean site, good passwords and every plugin up to date, and still be at risk. The problem sits underneath all of that.
The flaw had been there for over 10 years and nobody caught it. It was announced on October 20th, and an emergency fix came out the next day.
02How the PHP2Shell bug works in simple terms
When your website gets a visitor, PHP sets aside a bit of memory to build the page. Think of a waiter carrying a tray. Sometimes PHP runs out of memory halfway through, and when that happens it stops and cleans up fast.
The problem is the cleanup. PHP can leave its memory in a messy state when a request ends early. It is like the waiter dropping the tray, rushing to clean up and leaving a few things on the table.
The next customer then sits down and gets served off that messy table. Bits left over from one visitor can survive after they should be gone. The next visitor's request reads those leftovers before things get reset.
- A sneaky person can set up those leftovers on purpose.
- That is how they get in.
- Both flaws come from the same root issue.
PHP's team says the risk is highest for one popular setup called mod_php. There, a single request from a stranger can set things off before any of the website's own code even runs.
03What an attacker could do with PHP2Shell
The flaws could let a person run their own code on a web server without logging in. In plain words, they get to act like your own server. That is a lot of power over a site.
Julian gives a few examples of what that could mean for you:
- Grab your customer list.
- Change what is on your pages.
- Send your visitors somewhere bad.
If you care about getting found on Google, a hacked site is one of the fastest ways to lose that. Google warns people away from sites that look unsafe. Years of work on a site can take a hit in a single afternoon.
There is also a people problem. Most websites are not watched. Somebody built the site, it works, it brings in leads, and nobody has looked at the server in two years.
A fix only helps if someone puts it on your site. PHP can ship a fix in a day, but it cannot walk over to your server and install it for you.
04How AI found the PHP2Shell flaw
The first discovery came from a security firm called Caliph, using OpenAI's GPT 5.6 Sol. Wiz, a security firm Google brought in in March, then found the flaw on its own. Wiz used Google's Gemini 4 Argon, GPT 5.6 Sol and its own system called Wiz Atlas.
So two of the biggest AI labs, with different teams, found the same hole separately. Wiz says Gemini did more than point at the problem.
- It helped find the bug.
- It helped build working break-ins.
- It helped spot break-in attempts.
- It helped check that the fix worked.
Wiz said these flaws had been there for decades. Proving they could be used took a very complex chain of steps, right at the edge of what human researchers could manage. Frontier AI lowered that wall.
The hole was always there. People just could not get all the way through to it. AI could.
05The PHP2Shell numbers and timeline
Julian walks through the numbers to show how big this is. They tell a clear story about speed.
- Danger score: PHP's own team rated it 9.2 out of 10. The security firm Watchtower gave it a full 10.
- Timeline: The first bug was found with AI on August 19th and reported to PHP on August 24th. PHP started building the fix on September 21st, gave public notice on October 20th, and shipped fixed versions on October 21st.
- Speed: Wiz says one researcher built working break-ins across several apps in one week. That would have taken a world-class team months.
That quiet stretch in the middle, about two months, is how the good guys got ready.
Before the fix even came out, people were already trying to use the flaw. Cloudflare says the details leaked before the official date. It saw break-in traffic aimed at its customers, so this was happening live.
06How to check your site for PHP2Shell today
The fix is in four PHP versions. If your site runs on one of these or newer, you are covered for this one. If it runs on something older, you are not.
- Find out which PHP version your site runs on. Ask your host or the person who built the site.
- Compare it with the fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- If your version is older than the fixed one for its line, ask your host to update it.
- Check again after the update to confirm the new version is live.
- Put a reminder in your calendar to look at your site's software on a regular schedule.
The hard part is no longer the fix. It is getting people to check and install the update.
Julian's point is that a site nobody looks at is the real risk. Agents can check on your site for you while you focus on getting more customers.
07What happened after the fix and the defenders window
OpenAI calls the two months before the announcement the defenders window. The work came out of something OpenAI calls Patch the Planet. It was an OpenAI-funded audit of PHP's code done by Caliph.
The idea is to use AI to find the worst holes in software the whole internet uses before the bad guys do.
It mostly worked, because the big players got ready early.
- Cloudflare says its customers on both free and paid firewall plans were protected by default from 3 a.m. UTC on October 21st.
- Imperva got the details in private before the announcement, so it could check its protection and watch customer traffic.
- Wikimedia switched off one of its tools as a precaution, and some government websites in Europe went offline on purpose to fix it.
There was a catch. PHP had planned the fix for 2 p.m. UTC and brought it forward after the details leaked online.
The time people had to update shrank. One security firm expected mass break-ins within 15 minutes of the fix going public.
08Does AI deserve the credit for PHP2Shell, and who should care
Not everyone agrees AI deserves all the credit. One writer pointed out that Caliph found the bugs 18 days before Wiz, and that the flawed code had been public for over a decade. His view is that AI models on their own did not connect the dots, and humans had to see them.
One of the teams said something similar. They warned that no model can find every bug from a basic prompt, at least for now. Julian's summary is that humans led and AI did the heavy lifting.
Together they did in weeks what humans alone had not done in over 10 years.
This is also the second time this year. In July, WordPress pushed out emergency fixes for WP2Shell, a flaw that also let strangers run code without logging in. WordPress forced automatic updates, yet a check of 124,580 sites found an 81.6% patch rate.
Almost one in five had not updated.
OpenAI says more files like this are in the queue. If you run any site that brings in leads, you can no longer leave it alone for two years.
