On October 21, 2026, the PHP team released emergency updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, together known as "PHP2Shell". They let an attacker run code on a web server, or read the server's memory, without logging in. Both received a CVSS score of 9.2.
If your website runs on WordPress, it runs on PHP. This article explains what is going on, which four questions to ask your developer or hosting provider today, and what this kind of flaw has to do with how well AI assistants can find your site.
What is going on
The flaw is in PHP itself, the language that WordPress, Drupal, Joomla and many other systems run on. All PHP versions from 5.4 through 8.5.11 are affected. The fixes are in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The PHP project does not release a fix for PHP 8.1 or older.
Researchers at Wiz showed the attack working against the latest versions of WordPress, Drupal and Joomla. Details leaked on October 20, a day before the official patch. Amazon saw an exploitation attempt in its own honeypot network as early as October 17.
In the Netherlands, DigiD, MijnOverheid, the website of the Dutch House of Representatives and the site of the Dutch National Cyber Security Centre were among the services taken offline as a precaution on October 21. The UK's National Cyber Security Centre advised organisations to consider taking systems offline if they cannot be patched right away.
Why an up-to-date WordPress does not help here
Many site owners think: my WordPress is on the latest version, so I am fine. With PHP2Shell, that is not the case. The flaw is not in WordPress but in the PHP layer underneath it, on the server. That layer is updated by your hosting provider or whoever manages your server, not by the update button in WordPress.
Large managed hosting providers patch this centrally. If your site runs on its own server or VPS, it depends entirely on whoever manages that server.
Four questions for your developer or hosting provider
Ask these today. "Everything is up to date" answers only one of them.
- Is PHP updated to 8.2.35, 8.3.36, 8.4.27 or 8.5.12? On 8.1 or older there is no official patch, so an upgrade is needed. Such an upgrade often breaks older themes and plugins, so expect more work than a single click.
- Was the web server restarted afterwards? A new PHP package only takes effect once the running PHP processes restart. Until then, the old code keeps running.
- Has anyone checked whether the site was already compromised in the meantime? Attacks started before the update was available. A patch does not remove access that is already there.
- Were passwords and keys rotated? Think of the database password, API connections and the WordPress salts. The flaw can read the server's memory, and that is exactly where those live.
The bigger lesson: every layer is maintenance
PHP2Shell is not an isolated case. This year alone:
- July 2026: "wp2shell", a critical exploit chain in WordPress itself (fixed in 6.8.6, 6.9.5 and 7.0.2), actively exploited.
- September 2026: CVE-2026-87902, another critical WordPress flaw (fixed in 7.1.2), exploited within a day of the patch.
- October 2026: PHP2Shell, in the layer underneath WordPress.
On top of that come plugins and themes, where the large majority of WordPress vulnerabilities are found. A typical WordPress site has four layers, each with its own update rhythm: PHP, WordPress, plugins and the theme. With every new alert, someone has to act quickly. That is not a failure of WordPress; it is the cost of a system with many moving parts.
What this has to do with AI visibility
A secure site is not automatically a visible site. But the same setup that makes a site hard to maintain often stands in the way of AI visibility too. We see three things come back in our measurements.
AI crawlers are often blocked at server level
To keep attacks out, hosting providers deploy firewalls and bot filters. Those regularly block legitimate AI crawlers as well, without the site owner knowing: robots.txt allows everything, but the server drops the connection. We see this pattern across multiple sites in our access checks. An AI model that cannot read your site cannot cite it either.
AI cites what it finds in search results
When we trace in Lens why an AI assistant does not mention a business, the most common cause is not that the site is unreadable. It is that the site was not among the sources the model consulted. AI assistants build on search results. A fast site with a clear page for each question has a better chance there than a slow site with a few general pages.
Speed and simplicity count
Every plugin adds code, requests and maintenance. A lighter setup loads faster, is easier to crawl and easier to change. When we moved hiveminds.nl to server-side rendering on May 12, 2026, average AI crawls went from 39.43 to 80.31 per day (7 days measured before the move, 94 days after). That move was from a JavaScript app, not from WordPress. WordPress already renders on the server, so this number is not a prediction for a WordPress site. It does show how directly AI crawlers respond to what a server returns.
When moving makes sense, and when it does not
Moving to a new setup does not guarantee more AI citations. Citations come from being present in search results and from content that answers exactly what a customer asks. A well-maintained WordPress site can do that perfectly well.
Moving does make sense when:
- the site runs on PHP 8.1 or older, and an upgrade already means major changes;
- there is no dedicated party keeping PHP, WordPress, plugins and the theme up to date;
- the site processes personal data through forms, and you want to shrink the attack surface;
- you want to make changes yourself without worrying that something breaks.
The sites we moved to a static setup this year have no PHP on the server. PHP2Shell does not affect them.
What we do
We measure how visible a business is in ChatGPT, Claude, Perplexity and Google AI Overviews, and why it is or is not mentioned. Where needed, we move a site to a fast, low-maintenance setup, with content and domain carried over.
Want to know where your site stands? Request an AI visibility check.