SURREY, B.C. - If your business has a website, it probably runs on PHP, and PHP is at the centre of one of the most serious security fixes in years. On October 21, OpenAI announced that its Patch the Planet initiative helped uncover two critical vulnerabilities in PHP itself. The flaws are patched now. For most Surrey shop owners the fix is simple: check the PHP version on your hosting account and update it, or ask your hosting company to do it.
The engine under most small business websites
PHP is a programming language that runs on the server hosting your site. When a customer opens your online store, the server runs PHP code to build each page, load your products and take their order. WordPress, the website builder most small businesses use, is written in PHP, and so is WooCommerce, the store add-on many Surrey retailers rely on. The researchers behind the disclosure say PHP powers about 70 per cent of websites, including WordPress, Drupal and the MediaWiki software behind Wikipedia.
What the two flaws let an attacker do
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and the researchers call the pair PHP2Shell. The first is a memory corruption problem in how PHP handles out-of-memory conditions. The second involves stale internal state carried from one web request to the next, which can be turned into a memory error called a use-after-free. The researchers rate the severity at 9.2 out of 10.
In testing, the researchers showed that an attacker needs no account and no password to execute code on servers running WordPress, Drupal and Joomla. That kind of access can let someone take control of the server, read or change the data behind a website, or deface its pages. The second flaw can also expose the memory of the PHP process, which can hold passwords, sign-in tokens, payment related keys and security certificates from your site and its visitors. That memory data can also be stolen without running code first, which can make the activity harder to spot.
One point matters for owners: the bug sits in PHP itself, not in your theme or plugins. Even a simple test page on a vulnerable version is exposed, and updating WordPress does not close the hole, because WordPress updates do not change the PHP version underneath.
Found by AI, patched before the announcement
For two months, OpenAI led a coalition of maintainers, researchers and security providers preparing this fix. A researcher at the security firm Calif identified a critical flaw using OpenAI’s GPT-5.6 Sol model, and the cloud security firm Wiz independently discovered and reported both vulnerabilities. PHP’s own maintainers led the work on the fixes, while partners including Wiz and Cloudflare prepared protections ahead of the announcement. OpenAI calls the head start a Defender’s Window: to its knowledge, AI found these flaws before attackers did, so patches could be ready first.
OpenAI also committed $1 billion in subsidized access to Daybreak, its security program, through Daybreak for Frontline Defenders, aimed at organizations with limited security resources protecting essential services. It also published a free PHP version checker as a Codex skill, a small tool developers and hosting operators can use to find vulnerable versions.
The versions that are safe
The patched releases are out now. Your site is covered if it runs one of these versions or later:
- PHP 8.2: update to 8.2.35
- PHP 8.3: update to 8.3.36
- PHP 8.4: update to 8.4.27
- PHP 8.5: update to 8.5.12
Anything lower on those branches is vulnerable. The problems reach back to PHP 5.4, and nearly every older version is affected by at least one of the two issues. The fix list covers the currently supported branches, 8.2 through 8.5. If your account runs PHP 8.1 or anything older, ask your host to move you to a supported, patched release.
How to check your PHP version in two minutes
If your site uses WordPress, log in to your dashboard and go to Tools, then Site Health, then the Info tab. Open the Server section to see your PHP version, and compare it with the list above.
If you do not use WordPress, sign in to your hosting control panel. In cPanel, the common panel many Canadian hosts use, look under Software for MultiPHP Manager or Select PHP Version, which shows the version for each site.
What to do if your version is on the vulnerable list
First, back up your website with your host’s backup tool or your backup plugin before changing anything. Second, switch to the patched version in the control panel, or open a support ticket asking your host, in writing, to update PHP on your account to the latest patched release and restart the PHP service. Your account may already be patched, since hosts prepared during the two months before the announcement; the two-minute check tells you for sure. Third, click through your site afterward, including your contact form and checkout. Very old themes and plugins can break on a newer PHP version, and a developer can usually fix that faster than a hack can be cleaned up. If you cannot update right away, ask your host what temporary protections, such as firewall rules, they have in place, since security providers prepared mitigations ahead of the disclosure.
For most owners, this is a short task that protects the site your customers trust with their orders and card details. Check the version today.
Sources: OpenAI, “Patch the Planet: global response coordination as agents uncover critical vulnerabilities,” October 21, 2026, openai.com; PHP2Shell disclosure and PHP upgrade guidance, php2shell.com; PHP release history, php.net.
