On Wednesday, October 21, 2026, the PHP project and security firm Wiz disclosed two critical vulnerabilities in the core of PHP, the programming language that runs a large share of the world's websites. Within hours, Finland temporarily shut down government web services, the BBC and the Edinburgh council took pages offline, and security agencies including the UK's NCSC told organisations to act immediately.
If your business has a website, there is a good chance this affects you. Here is what happened, why the way these bugs were found matters, and what Indian businesses should do this week.
What happened: two critical flaws in PHP itself
The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed "PHP2Shell", carry a CVSS severity score of 9.2 out of 10, rated Critical. In plain terms: under certain conditions, an attacker could run their own commands on a vulnerable server without needing any login. That means they could steal data, deface the site, or use your server to attack others.
The scope is unusually wide:
- Vulnerable: every PHP version from 5.4 through 8.5.11.
- Patched: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on October 21.
- Not patched: PHP 8.1 and anything older. Those versions are end of life, so the PHP project is not releasing fixes for them at all.
That last point is the uncomfortable one. If your site runs on an old PHP version, there is no patch coming. The only fix is upgrading.
The new part: AI found these bugs
What makes this disclosure a milestone is how the vulnerabilities were discovered. Wiz Research used AI models to identify the flaws and help validate the fix, and Google said its Gemini 4 Argon model made what it called an invaluable contribution to finding the vulnerability, developing the exploit, and validating the patch. OpenAI separately said a researcher identified a critical flaw using its GPT-5.6 Sol model.
OpenAI described the gap between AI-assisted discovery and public disclosure as a "Defender's Window": a short period in which maintainers and infrastructure providers can prepare patches before attackers develop the same capability. Security research now runs on a much faster clock. A memory bug that might have taken researchers months to weaponise can now become a working exploit in weeks.
For defenders, this cuts both ways. AI will find more bugs before criminals do, which is good. But it also means every business needs to be able to patch quickly, because the window between disclosure and real-world attacks is shrinking.
Why Indian businesses should care
PHP is not an obscure technology. WordPress, which powers a huge share of Indian small and medium business websites, runs on PHP. So do countless custom-built sites, e-commerce stores, and the quick, low-cost websites many NCR businesses launched years ago and have not touched since.
Those older sites are exactly the ones at risk here. We regularly see business websites in Delhi NCR still running PHP 7.x or even 5.x, versions that stopped receiving security updates long ago. For those sites, PHP2Shell is not a patch-and-move-on event. It is a forced upgrade, and the longer it is delayed, the longer the front door stays open.
There is also a practical reality: many small businesses do not know what PHP version their website runs, or even who hosts it. If that is you, this week is the time to find out.
What to do this week
- Find out your PHP version. Ask your developer or hosting provider, or check your hosting control panel. Your CMS admin dashboard often shows it too.
- If you are on PHP 8.2 to 8.5, patch now. Update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or later) and redeploy. Managed platforms are rolling out patched base images, but sites you or your developer maintain yourselves need manual action.
- If you are on PHP 8.1 or older, plan an upgrade, not a patch. No fix is coming for those versions. Moving to PHP 8.2 or newer is the only safe path, and it may require code changes on older sites.
- Add a defensive layer while you patch. A web application firewall with updated managed rules can block known exploit patterns while upgrades are in progress.
- Test after updating. Major version jumps can break older plugins, themes, or custom code. Check forms, payments, and login flows before calling it done.
The bigger lesson
PHP2Shell will not be the last event of its kind. AI-assisted security research means critical flaws will be found, and exploited, faster than before. The businesses that come through these events unscathed are not the ones with the fanciest websites. They are the ones whose websites are actively maintained: software kept current, updates applied within days, and someone clearly responsible for security.
If your website was built years ago and nobody has looked under the hood since, treat this as your reminder. At VAIR IT Technologies, we build and maintain websites for businesses across Noida and Delhi NCR, including security updates, version upgrades, and ongoing maintenance plans. If you are unsure whether your site is affected, reach out for a free consultation and we will help you check.
