PHP2Shell, the PHP flaw found with GPT-5.6 Sol: how to tell if your site is at risk and how to fix it

PHP2Shell is a critical flaw in PHP, the language behind about 70% of websites, and it lets an attacker take over the server with no password and without anyone clicking anything. The only real fix is updating PHP to a patched version: 8.2.35, 8.3.36, 8.4.27 or 8.5.12. If you run a site on WordPress or PHP, the steps below are for today.

The flaw was found with help from GPT-5.6 Sol, OpenAI’s model. The fixes shipped on October 21, 2026, but details had already leaked and Cloudflare saw attack traffic aimed at its customers’ sites.

What can an attacker do with PHP2Shell?

An attacker exploiting PHP2Shell gets full control of the server your site runs on. In practice they can:

• read every password and every payment API key;
• read all of the site’s secrets, meaning the credentials stored in its configuration;
• change the site’s pages;
• hide a backdoor, a concealed way in that lets them come back whenever they want.

A PHP2Shell attack takes a single specially crafted request to the site: no password, and nobody has to click a phishing email.

Which sites are affected by PHP2Shell?

PHP2Shell hits PHP itself, so every site running on PHP is potentially exposed: WordPress, Joomla, Drupal and most of the sites you visit every day. Wiz, which published the technical analysis, says every PHP version released in the last decade has at least one of the two vulnerabilities, going back to 5.4.

There are two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2 out of 10. Wiz demonstrated the attack against the standard WordPress, Drupal and Joomla images. OpenAI called it one of the most impactful vulnerabilities in recent memory.

How does PHP2Shell work, in plain terms?

When PHP runs out of memory in the middle of a request, it leaves pieces of dirty data lying around. An attacker sends the site a request with data built to exploit those leftovers, and gets the server to run their commands.

That’s why the problem has nothing to do with how well your site is built. Even a fully up-to-date WordPress site is vulnerable if the PHP underneath is an unpatched version.

How do you protect a site from PHP2Shell?

First, if you’re not sure your site is protected, put it in maintenance mode until you’ve finished these steps. A site that’s offline for a few hours costs less than a compromised server.

1. Check your PHP version.
2. If you’re on PHP 7 or older, move to at least 8.2.
3. On shared hosting, write to your host today.
4. On your own server, have Claude Code update PHP.
5. Look for suspicious files and don’t trust miracle plugins.

1. How do I check my site’s PHP version?

On WordPress, the PHP version is under Tools › Site Health › Info › Server.

If your site isn’t on WordPress, OpenAI published a free tool on GitHub that checks a site’s PHP version: github.com/openai/php2shell-checker. You run it with Node and pass the site’s address, for example node phpcheck.js "https://yoursite.com".

If php2shell-checker answers UNKNOWN, your site isn’t necessarily safe: it means the tool couldn’t work out the version, for example because the server hides it. In that case, ask your hosting provider directly.

2. Which PHP versions are safe?

The PHP versions that fix PHP2Shell are:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

If you’re on PHP 7 or anything older than 8.2, there is no official patched release: you need to upgrade to at least 8.2. The PHP project only published minimal source patches for 7.4, 8.0 and 8.1, meant for people who build PHP themselves: for a normal website, the way out is a version upgrade.

3. My site is on shared hosting: what do I do?

On shared hosting, your host handles the PHP update. Still, write to them today and ask explicitly: "Have you already installed the PHP version that fixes PHP2Shell?". Don’t assume they’ve done it.

4. I run my own server: how do I update PHP?

If you manage your own server, open Claude Code on it and ask: "Update PHP to the version that fixes PHP2Shell and restart the site". The restart matters: according to Wiz, everything that runs PHP has to be restarted, meaning Apache, PHP-FPM and long-running worker processes.

5. Why check for suspicious files and skip the plugins?

Attacks started before everyone could update, so a site patched today may already have been compromised yesterday. Have your site checked for suspicious files, for example PHP files that showed up in the uploads folder.

And don’t install plugins that promise to fix PHP2Shell: the flaw lives in PHP, underneath WordPress, and a plugin can’t patch it. The only real fix is updating PHP, which is also Wiz’s conclusion.

Who discovered PHP2Shell?

The good news is that AI found PHP2Shell before attackers started using it. Researchers at Calif used GPT-5.6 Sol to find a first version in August, OpenAI’s team found a broader version in September, and Wiz found both independently.

Over the past two months, OpenAI led a coalition with the PHP maintainers, security researchers like Wiz and companies like Cloudflare. Together they prepared fixes and protections before the flaw went public, and brought in US government agencies such as CISA to warn the people who run essential services.

As a developer with 5 years in cybersecurity, I see one clear takeaway: AI models are finding flaws in software we’ve used for ten years, and they’re getting faster at it. The window between discovery and attack keeps shrinking, and sites left on an old PHP version are the first to pay for it.

If you know someone with a WordPress or PHP site, send them these five steps: today they really need them.