Insight 2 min read
AI helped find two serious PHP holes. Email your host.
AI helped find and fix two critical flaws in PHP, the software under WordPress. The fix is your host's job, so ask them to confirm it.
Try it: Is my PHP version fixed?
Check your PHP version against the October fix and get an email ready to send your host.
Copy and paste
FILL THIS IN (then copy everything into your AI chat)
My PHP version (the number from your host, like 8.3.20; type I don't know if you don't have it): 8.3.20
My host (your web host's name, like Bluehost or SiteGround): Bluehost
--- Don't change anything below this line ---
You are a calm website security helper for someone who isn't technical. My website runs on PHP, and my version and host are above. Help me make sure the October 2026 PHP security fix is on my site, in as few steps as possible.
Facts to use, don't change them: the PHP project's fixed versions for the October 21, 2026 security fixes (called PHP2Shell) are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or newer in the same line.
Give me:
1) The answer first, in one line starting with ✓ or ✗: my version, the fixed version for its line, and whether mine is at or above it. If "My PHP version" says "I don't know", give me the one-line path to find it instead and stop there. If mine is below, tell me to ask my host to update to that fixed version or later, and remind me that a lower number doesn't always mean trouble, because many hosts add the fix without changing the number.
2) If I'm on 8.1 or older, explain in one or two sentences why I should ask to move to 8.3 or newer.
3) A short, polite email to "My host", ready to send, asking them to confirm in writing that the fix is installed on my server.
4) "How to read their reply": 3 short lines. What a good answer says, and which answers mean I should ask again (for example, one that doesn't say the fix is installed on my server).
5) A 3-item checklist I can do myself today without touching code or contacting my host, like making sure I have a recent backup I can restore.
Don't tell me what my host does or has already done; you can't see my server. Don't ask me for passwords or logins, and don't send anything. I'll send the email myself. If you're not sure about something, say so. No general security tips beyond these steps, and stop after part 5 (no closing recommendation).
Example result
We filled in: My PHP version: 8.3.20. My host: Bluehost.
1. Your PHP security status
- No: Update needed
Your PHP version: 8.3.20 | Fixed version: 8.3.36 | Your version is below the fixed version.
Ask Bluehost to update your PHP to 8.3.36 or newer in the 8.3 line.
Important: A lower version number doesn't always mean you're unprotected. Some hosting companies install security fixes without changing the displayed PHP version. That's why it's important to get written confirmation.
2. Do you need to move to a newer PHP line?
Not applicable. You're already using PHP 8.3, so you don't need to move from an older version.
3. Email to Bluehost
Subject: Please Confirm October 2026 PHP Security Fix
Hello Bluehost Support,
My website is currently running PHP 8.3.20.
I'm contacting you to confirm that the October 21, 2026 PHP security fixes (PHP2Shell) have been installed on my server.
The fixed PHP version for my line is 8.3.36 or newer.
Could you please:
- Confirm whether the October 2026 PHP security fix is installed on my server.
- If it is not installed, update my server to PHP 8.3.36 or newer.
- Confirm in writing when the fix is installed.
If the fix has already been applied without changing the displayed PHP version, please confirm that specifically.
Thank you for your help.
Best regards
4. How to read their reply
- Good answer: They confirm the October 21 security fix is installed on your server.
- Ask again: They only say your PHP version is supported or up to date without confirming the specific fix.
- Ask for an update: They confirm the fix is missing or cannot verify that it is installed.
5. Your 3-item checklist for today
Today's checklist
0 of 3 complete
Check that your website has a recent backup.
Make sure you know how to restore that backup if needed.
Check that you can access your Bluehost hosting dashboard and locate your website's PHP version setting.
Does this matter to you?
It matters if Your site runs WordPress or PHP, or you look after one that does.
Skip it if You have no website.
What to do
- Check your PHP version in WordPress: go to Tools, then Site Health, then the Info tab, then click Server to open it, and write down the version.
- Compare it with the fixed versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or newer in the same line. A lower number does not always mean trouble, because many hosts add the fix without changing the number. On 8.1 or older? That version no longer gets regular updates, so ask your host to move you to 8.3 or newer, or to confirm in writing that they have applied a backported fix. PHP 8.2 stops getting security fixes on December 31, so 8.3 or newer is the safer ask.
- Send your web host one email asking them to confirm the fix. Copy the email below into a support ticket. If you run your own server, the update is yours to install.
- On Squarespace, Wix or Shopify? Those companies run their own servers, so there is nothing for you to update.
What happened. On October 21, the PHP project released fixes for two critical security flaws, nicknamed PHP2Shell (official IDs CVE-2026-109618 and CVE-2026-109619). PHP is the behind-the-scenes software that runs WordPress, Drupal, Joomla and a huge share of small business websites. Both flaws are rated 9.2 out of 10 for severity. In the worst case, an attacker can take over the server that runs a website without logging in, or read private data from its memory, like passwords and keys.
Why it is an AI story. The weak spots had been in PHP for more than a decade. Security researchers at Wiz say frontier AI models are what made it practical to turn them into working attacks, and they used AI to help find and fix the problem before going public. Their words: "With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work." That cuts both ways. AI helps defenders find old bugs faster, and it helps attackers too.
Is anyone attacking yet? Yes. On October 26, the US government's cyber agency CISA added both flaws to its list of known exploited vulnerabilities and told organizations to update right away. Researchers also confirmed attackers broke into at least one test server set up to watch for attacks. Wiz says the number of organizations with an exposed, vulnerable server fell by nearly half in the week after the fixes came out, as people patched, upgraded or locked servers down. As of November 5, PatchBell's tracker shows only 34 of 76 hosting providers say they have patched.
What it means for you. Updating WordPress, your theme or your plugins does not fix this. The fix lives one layer down, in the PHP software on the server, which is usually your hosting company's job. Some hosts patch without changing the version number, which is why asking them directly matters.
The email to send your host. Copy this into a support ticket:
Hi, please confirm that the PHP running my site, [your website address], includes the fixes for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell). Please also confirm the PHP workers were restarted after the update, and let me know if anything on my account is still waiting for the fix. Thank you.