.svg)
Introduction
On October 21, 2026, Wiz Research disclosed two critical remote code execution flaws in PHP itself, flaws that had been hiding in the codebase for more than a decade and that frontier AI models finally made practical to exploit.
The pair is now known as PHP2Shell. Here's the short version:
- The CVEs: CVE-2026-109618 and CVE-2026-109619
- Affected: nearly every PHP version released since 5.4
- Getting patches: only the supported 8.2 through 8.5 branches
If your WordPress site runs PHP 8.1 or older, this is the moment to make a decision. No upstream fix is coming for your version.
What PHP2Shell actually is
PHP2Shell is two bugs in the language engine, not in any application that runs on top of it.
That distinction matters: updating WordPress core won't fix these. The flaws are:
- CVE-2026-109618 (out-of-memory bailout): PHP uses a longjmp-style bailout for out-of-memory errors. Some contexts don't clean up request memory properly before that bailout, and the shutdown procedure can then read or branch on memory in an invalid state. Multiple OOM strategies can trigger this consistently, leading to remote code execution.
- CVE-2026-109619 (stale global state): PHP global state can temporarily point into request memory. When that state isn't reset correctly (for example, during fatal-error backtraces), later requests can read or branch on freed memory. Multiple strategies trigger this, also leading to remote code execution.
The result isn't theoretical. Wiz demonstrated pre-authentication remote code execution against WordPress.
Why AI changes the math
These bugs weren't new. What changed is who could exploit them.
They stem from architecture decisions made more than a decade ago. Wiz Research used frontier AI models to close a gap that previously protected the ecosystem.
Proving a longstanding memory bug is exploitable normally requires chaining several flaws and adapting to each target's memory layout. Here's how that changed:
- Before: work measured in weeks of expert effort
- Now: hours, as Wiz reports, with the models developing and adapting working exploits across multiple applications
That's the real story of PHP2Shell, and Wiz frames it deliberately alongside Heartbleed and Log4Shell.
The bug class isn't new. The speed at which research-grade findings become working exploits is new. Complexity no longer functions as a meaningful barrier.
What this means for WordPress security
The exposure is the server, not the application.
WordPress is PHP end to end. All of this passes through the interpreter:
- Core
- Themes
- Plugins
- Every page render
When the language has a pre-authentication RCE, there's no firewall rule and no plugin update that removes the risk.
Self-hosted vs managed, at a glance
The decision frame that PHP2Shell sharpens is simple: who is responsible for the language your site runs on?
| Self-hosted WordPress | Managed platform (Webflow) | |
|---|---|---|
| PHP runtime | Yours to update and patch | None, not part of your stack |
| Server patching | Your host, your verification | The platform's job, invisibly |
| Language-level RCE | Your exposure, your remediation | Not applicable |
| End-of-life risk | Inherited whenever a dependency dies | Owned by the vendor |
| Plugin attack surface | Core + themes + plugins + server | Closed, managed ecosystem |
The strongest argument for managed infrastructure was never design or speed. It's this table.
When a language-level vulnerability lands, the difference between "apply this patch" and "rebuild this site" is which row you live on.
The skeptic's questions, answered
Can I just wait for my host to fix this?
Only if your host can show you the applied patch. That means a real version number, not a support-ticket promise.
On PHP 8.1 or older, upstream has no fix, so you're waiting on a distribution backport that may never arrive. Check today. Don't assume.
Is WordPress secure?
- On patched PHP with a maintained stack: yes.
- On the stranded versions: no, and the stranded versions are a large slice of the install base.
Will updating WordPress core protect me?
No. PHP2Shell is a WordPress vulnerability that lives in the PHP engine below the CMS itself. A fully updated WordPress install on unpatched PHP is still exposed.
My site is small. Do attackers care?
This is the vulnerability class where size doesn't protect you.
- Pre-authentication RCE means exploitation happens before anyone logs in.
- AI-assisted tooling makes attacks cheap to adapt across targets.
- Automated scanners don't distinguish between a small business site and an enterprise. Both become commodity targets.
Should I migrate off WordPress entirely?
Not every site needs to. On patched PHP with a maintained stack, WordPress remains a reasonable choice.
The migration decision is for sites whose stack can't reach 8.2 without a rebuild. At that point, you're paying rebuild costs anyway.
Where to go from here
Start with a five-minute check: log into your hosting dashboard and find the PHP version. That single number tells you which path you're on.
Treat the next three as your WordPress security best practices, in order:
- 8.2 or newer: apply the fixed version from the table above, then verify with your host.
- 8.1 or older: ask your host directly whether a backported fix exists. If the answer is anything less than a confirmed version number, you have an upgrade-or-migrate decision to make.
- Upgrade or migrate: if reaching 8.2 means rebuilding themes and plugins, compare that cost against a platform move. Our WordPress to Webflow migration guide walks through what a migration actually involves, and our Webflow vs WordPress comparison lays out the infrastructure difference.
When you're ready to scope either path, Coherent builds and migrates on Webflow so the language layer is never yours to patch again.
