Published 2026-10-23 · Last updated 2026-10-23
Between October 12 and October 21, 2026, GitLab, a certificate authority, Python, PHP, Node.js and an AI developer tool called LiteLLM all had emergency security news, and social media decided the whole internet was in chaos. Most of it will never touch a small business. One piece might. If your business website runs on WordPress, Joomla, Drupal or most cPanel hosting, it runs on PHP, and the bugs people online are calling PHP2Shell (or, more dramatically, Black October) affect it until your hosting company updates PHP on its server. PHP fixed the two critical bugs, CVE-2026-109618 and CVE-2026-109619, on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The single most important fact for an owner is the one most people miss: updating WordPress, a plugin or a theme does not fix this, because the bug lives in PHP itself. We are Optimus Business Solutions in Salem, New Hampshire. We build custom-coded websites that do not run PHP, and we wrote this so any owner, on any platform, knows exactly what to ask and what to check.
Why did the whole internet seem to be in chaos?
Because the alerts came in a run, even though they were not one attack. On October 12, GitLab patched a flaw rated a perfect 10 that let a stranger take over a server, and on October 21 it patched a second, separate one. On October 17, a researcher found that eight keys belonging to the certificate authority eMudhra, the kind of keys that vouch for a website being who it says it is, had been generated weak. Mozilla says local AI agents recovered them on the first try, and Firefox blocked the bad certificates about three hours after the report. Python's team told developers to upgrade their tools on October 20, because Python's own team says any pip before version 26.2.2 keeps trusting those certificates. Then October 21 brought PHP's emergency patches, a Node.js security release, and a poisoned release of LiteLLM that, according to LiteLLM, sat on Python's public package library for almost two hours.
Four unrelated causes landed back to back: a certificate authority's key generation, bugs in PHP itself, a GitLab bug and a hijacked release pipeline. Browsers were protected within hours, GitLab's own hosted service was patched before the news, and LiteLLM only affects developers who installed it in that window. For most small business owners, the one that needs anything from you is PHP.
What is PHP2Shell, in plain words?
PHP is the programming language that sits underneath most of the web. According to W3Techs, it runs about 69 percent of the websites whose server language is known, and WordPress, which is written in PHP, runs about 40 percent of all websites. PHP2Shell is the nickname for two memory bugs inside PHP that, according to PHP's own security notice, can let an attacker run their own code on a server that answers web requests, without a password. The official CVE records rate both bugs 9.2 out of 10, which is the Critical band. In plain words: a stranger could send the right request to an unpatched server and take it over, before your website's own code ever runs.
Security firm Wiz, one of the teams that found the bugs, showed the attack working against the standard, out-of-the-box WordPress, Drupal and Joomla setups. That is why governments, banks and large sites around the world took pages offline as a precaution while they patched.
What did AI have to do with it?
A lot, and mostly on the defenders' side. The official CVE records for both bugs credit OpenAI, along with the security firms Calif and Wiz. Wiz says it used AI models from Google and OpenAI to find the flaw, build a test exploit and check the fix, and that one researcher did in about a week what would once have taken a full team months. The same thing happened on the other side of the web: the Brotli bug fixed in the October Node.js security release is credited to OpenAI's Codex Security tool. So the honest headline is not that AI set the internet on fire. It is that AI is now finding serious bugs much faster than before, which means more fixes, more often, and a much shorter window between a fix being published and attackers trying it.
That last part is where the risk lives. Security researchers quoted by 404 Media say AI speeds up writing attacks too, even if turning a bug into a working break-in still takes real skill. The gap between a patch and an attack used to be weeks. For heavily attacked WordPress bugs, Patchstack measured a median of about five hours.
Has anyone actually been hacked?
Attackers are trying, hard. Cloudflare's chief executive, Matthew Prince, told reporters the company saw tens of thousands of attempts within 45 minutes of the disclosure and millions after that. Wordfence, which protects WordPress sites, says its firewall blocked more than 74,000 attempts in the first days. Yet Wordfence also says it had not seen a confirmed break-in from these bugs, and on October 21 CISA, the U.S. government's cybersecurity office, said it had not yet observed exploitation. Both say the same thing about that good news: it is not a reason to wait. Many published attack tools are fake or broken, but some security firms report private ones that work.
Why doesn't updating WordPress fix it?
Because WordPress is the house and PHP is the ground it stands on. When you press Update in your WordPress dashboard, you update the house: the core files, the plugins, the theme. PHP is installed and run by your hosting company, underneath all of that. Wordfence put it simply: updating WordPress itself does not update PHP. On ordinary shared hosting, only the host can make the fix. Most large hosts moved fast. Hostinger, for example, says it finished rolling the patched versions across its platform on October 22, for every plan except self-managed VPS servers. But you should not assume. You should ask, and get the answer in writing.
What should a small business owner do right now?
This is the checklist we would hand to a friend. None of it needs a developer.
- Find out whether your site runs PHP. WordPress, WooCommerce, Joomla, Drupal, Magento and most cPanel sites do. Your host's dashboard usually shows a PHP version setting.
- Email your host one exact question: is my site on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later, or a build dated October 21, 2026 or later that includes the PHP2Shell fix, and have the PHP workers been restarted? Keep the reply.
- If your site is on PHP 8.1 or older, ask to move to 8.3 or newer. Those older versions get no official fix, and PHP 8.2 stops getting security fixes on December 31, 2026. Test your plugins and theme on a copy of the site first if your host offers one.
- If you run your own server, update PHP, restart PHP-FPM or Apache, and, until then, turn off session upload progress in php.ini, which is the stopgap PHP itself recommends.
- Update WordPress, every plugin and every theme anyway, and delete the ones you do not use. That does not fix PHP2Shell, but outdated plugins are still the most common way WordPress sites get broken into.
- Turn on a web application firewall. Cloudflare's free plan has rules for these bugs switched on by default, and Wordfence has a free version. Treat it as a seatbelt, not the fix.
- Lock down your logins: a long, unique password and two-factor sign-in for every admin account, and remove any admin user you do not recognize.
- Know where your last backup is and what date it is from, and make sure a copy lives off the server.
- Watch for warning signs: new admin users, files you did not add, repeated errors or a site that suddenly slows down. If anything looks wrong, assume the passwords and keys on that server are exposed and change them.
One note on the advice going around social media to ask your AI to scan your system. Using an assistant to read your host's PHP information page and explain what needs updating is a good idea. Pasting passwords or keys into a chatbot, or running a so-called scanner or exploit you found on GitHub or social media, is not. Researchers reported that many of those tools are fake, and some carry malware.
Is WordPress the problem, or is it the plugins?
Fair question, and the fair answer is mostly the plugins. WordPress core itself is well maintained. Patchstack counted only six vulnerabilities in WordPress core during 2025, all low priority, and WordPress has a large security team and automatic updates that push fixes out quickly. The trouble is everything bolted on around it. Patchstack counted 11,334 new vulnerabilities in the WordPress world in 2025, 42 percent more than the year before, and 91 percent of them were in plugins. Almost half had no fix from the developer when they became public. Sucuri, which cleans hacked websites, found WordPress was 95.5 percent of the infected sites it handled in its 2023 report, partly because WordPress is so common, and mostly through outdated software, vulnerable add-ons and weak passwords.
A typical small business WordPress site has a page builder, a forms plugin, a gallery plugin, a security plugin and a dozen more, each written by a different developer, each one more door into the same house. PHP2Shell added a crack in the ground under the house. That is a lot to keep watch over for an owner whose real job is running a business.
| Question | A typical WordPress site | A custom-coded site like ours |
|---|---|---|
| Was it exposed to PHP2Shell? | Yes, until the host updated PHP. | No. It does not run PHP. |
| Who has to act on a runtime bug? | Your host, and you have to ask them. | We do, and the hosting platform updates the runtime itself. |
| How many outside add-ons does it trust? | Often a dozen or more plugins, each from a different developer. | A short list of well-known code libraries we choose and update. |
| Is it immune to bugs? | No. | No. Our stack had its own critical fixes in October 2026 too. |
Are custom-coded sites immune?
No, and anyone who tells you their website can never have a bug is selling something. The same fortnight PHP2Shell went public, the JavaScript tools that modern sites are built with shipped their own critical fixes: Next.js published two critical advisories on October 14, 2026, and Node.js released security updates on October 21, 2026. The difference is not that one kind of site has bugs and another does not. The difference is how many separate pieces you depend on, and whether someone who knows exactly what is in your site is watching for the fix.
What did that look like for the sites we look after?
None of our websites run PHP. They are built on Next.js and run on Node.js, on a short, known list of tools, deployed on a platform that keeps the server runtime itself updated. So PHP2Shell was a news story for us, not a weekend of emergency work. Our own tools still needed their fixes, and every website we host was running the patched version of Next.js on October 23, 2026, the same day the security alert reached us.
Then we did what an attacker would do. We tried to break into our own websites, from the outside and without a password, before anyone else could. We fixed every serious issue that turned up and re-checked each fix on the live site. We locked the older saved copies of every site, which a hosting platform keeps, so that only we can open them. We reviewed our hosting account's deployment, configuration and access records and the server logs our host keeps, and found no sign that any of our sites was compromised. That same night we updated the Python tools on our own machines for the certificate fix too. Our clients did not have to lift a finger.
That is the point of the work: big-company technology and security, built for small businesses, so the owner stays on the job while someone who knows exactly what is in the website watches it. If you are not sure what your own site runs, or who would fix it, we are happy to look.
Common questions
Does PHP2Shell affect WordPress sites?
Yes. WordPress runs on PHP, and Wiz showed the attack working against a standard WordPress setup. The fix is a PHP update on your hosting server (versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later), not a WordPress update, so ask your host to confirm it in writing.
Will updating my WordPress plugins protect me from PHP2Shell?
No. Wordfence notes that updating WordPress does not update PHP. Keep your plugins updated anyway, because outdated plugins remain the most common way WordPress sites are broken into, but the PHP2Shell fix has to come from your host.
Did AI cause PHP2Shell?
No. The bugs were in PHP's code already. AI helped find them: the official CVE records credit OpenAI, along with the security firms Calif and Wiz. Researchers say AI also helps attackers build exploits faster, which is why patching quickly matters more than it used to.
Was anyone hacked through PHP2Shell?
Attackers made millions of attempts after the October 21 disclosure, according to Cloudflare's chief executive. Wordfence had not seen a confirmed compromise in the first days, and CISA had not observed exploitation when it issued its alert. That can change, so do not treat it as a reason to wait.
Was Python hacked in October 2026?
No. Python has no bug here. A certificate authority, eMudhra, generated eight weak keys, so Python, Go, Node.js and the browsers all had to stop trusting them. Python's team says any pip before 26.2.2 keeps trusting the bad certificates, so developers should upgrade pip and certifi. Browsers were protected within hours, so a typical business website owner has nothing to do.
Is the Ahold Delhaize outage connected to PHP2Shell?
There is no evidence of that. Ahold Delhaize, which owns Stop & Shop, Hannaford, Food Lion and Giant, disclosed its cybersecurity incident on October 12, 2026, nine days before PHP2Shell was public, and a company spokesperson said there was no reason to assume a link.