The risk level just changed. When emergency patches for the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) shipped on October 21, the threat was serious but still largely theoretical — security researchers acknowledged that building a working exploit was difficult. That qualifier is now gone.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that hackers are actively exploiting a pair of critical security vulnerabilities in the widely used PHP web software, and has ordered civilian federal agencies to fix their systems within three days. For anyone running a WordPress site, WooCommerce store, membership platform or any other PHP-powered project, the calculus has shifted from “patch soon” to “patch today.”
What Changed Since the Emergency Patches Shipped
The urgent new warning comes less than a week after the makers of PHP rolled out patches for the two bugs, which allow hackers to remotely break into a vulnerable system over the internet without the need for passwords. The patches were available — the problem is that “available” and “applied” are two very different things, especially when you’re relying on a shared hosting provider to act on your behalf.
While the bugs are rated critical, security researchers said that developing a working exploit to hack into vulnerable systems was initially challenging — but not impossible. Confirmed in-the-wild exploitation now puts extra pressure on organisations to patch their systems to prevent malicious compromises, disruption, and data breaches.
CISA did not provide details about who was exploiting the bugs in its Monday statement, but its statement comes soon after security researchers said they found evidence that the PHP bugs were being exploited. The identity of the attackers and the full scale of exploitation outside federal systems remain unknown — but the confirmation of real-world remote-code-execution attempts is the signal that matters.
A Quick Recap of the PHP2Shell Vulnerabilities
The bugs, known as PHP2Shell, exploit vulnerabilities in the software that went undiscovered for years. They were initially uncovered two years ago, but the nonprofit foundation that maintains PHP said there was no practical way for hackers to exploit them, leaving the bugs unpatched. That assessment turned out to be wrong in a particularly uncomfortable way.
That was until earlier this year, when researchers at security firm Calif uncovered a way to exploit the two dormant vulnerabilities with the assistance of an AI model. The two bugs are among countless vulnerabilities that have not yet been discovered or have been deprioritised for years but now pose a risk due to advances in AI models’ ability to find and exploit vulnerabilities, including by chaining multiple flaws together. That’s a structural shift worth noting: the threat surface for aging web infrastructure is expanding, not shrinking.
PHP is one of many aging web technologies that help keep the internet running but have been under-resourced and under-funded for years, making it difficult for open source projects like PHP to pay for security reviews that might have uncovered flaws sooner. The PHP software is reportedly used by some 70% of web-facing servers, putting major websites and applications at risk — and the severity of the bugs prompted some governments and big companies to take their sites offline to fix them.
What This Means for Your Side Hustle Site
Remote code execution is about as bad as it gets. An attacker who successfully exploits these bugs doesn’t just read your files — they can run arbitrary commands on the server, exfiltrate customer data, install malware, redirect your visitors, or quietly use your infrastructure for further attacks. None of that requires your password. None of it leaves an obvious trace until the damage is done.
Most side hustlers don’t manage their own servers — they’re on shared hosting, managed WordPress hosting, or a platform like WooCommerce running on a VPS. That’s actually fine, because it means the host is responsible for the PHP runtime. But “responsible” only helps if they’ve acted. You need to verify, not assume.
Three things to do right now
- Check your PHP version. In cPanel, look under “Software” → “Select PHP Version.” In a managed WordPress dashboard (Kinsta, WP Engine, Flywheel, etc.), it’s usually under “PHP Engine” or “Site Settings.” You can also install a plugin like Version Info or simply check
phpinfo()if you have access. You’re looking for 8.5.12, 8.4.27, 8.3.36, or 8.2.35. - If you’re not on a patched version, contact your host today. Don’t open a ticket and wait three days. Use live chat. Ask specifically: “Has PHP been patched for CVE-2026-109618 and CVE-2026-109619?” A host that can’t answer that question clearly is a host worth reconsidering.
- If you self-host or manage your own VPS, update PHP now. This is not a scheduled-maintenance task anymore. CISA’s three-day federal deadline is a useful benchmark for urgency — apply the same standard to your own infrastructure.
What We Don’t Know Yet
It’s worth being clear about the limits of what’s confirmed. CISA’s advisory added the bugs to its Known Exploited Vulnerabilities catalog and confirmed active exploitation — but it did not identify the threat actors involved, and the scale of attacks against non-federal targets remains unclear. Security researchers found evidence of real-world remote-code-execution attempts, but there’s no public data yet on how many sites have been successfully compromised.
That uncertainty cuts both ways. It means the situation could be more contained than the headlines suggest — or it could be significantly worse and simply not yet fully visible. Given that PHP underpins an estimated 70% of web-facing servers, the attack surface is enormous. Waiting for more clarity is the wrong call when a patch is already available and exploitation is already confirmed.
The Bigger Picture
This incident is part of a broader pattern that TechCrunch’s reporting flags explicitly: AI models are accelerating the discovery and exploitation of vulnerabilities in aging open-source infrastructure that has historically been under-funded and under-reviewed. PHP is not unique in this respect. The same dynamic applies to other foundational web technologies that power a huge proportion of the internet’s commercial layer — including the platforms most side hustlers depend on.
The practical upshot is that the window between “patch released” and “active exploitation confirmed” is getting shorter. Treating security updates as something to get around to eventually is a posture that no longer fits the threat environment.
Verify your PHP version today. If your host has already patched, great — confirm it in writing and move on. If they haven’t, escalate immediately. The federal three-day deadline is a useful frame: if it’s urgent enough for government agencies, it’s urgent enough for your online store.
