Recent Cyber-attacks: What PHP2Shell and AI-Found Flaws Mean for Your Website

TL;DR

Recent cyber-attacks in October 2026 brought multiple serious incidents, most notably PHP2Shell: two critical flaws in the PHP programming language that attackers actively exploited. AI is helping find vulnerabilities quicker, but attackers can weaponise them faster than they can be fixed. Make sure your site runs a current, patched PHP version, keep your plugins updated, and regularly test backups.

KEY TAKEAWAYS

• PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets attackers execute code on unpatched servers without logging in. Fixes are available in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12.
• The US cybersecurity agency CISA confirmed active exploitation on 26 October 2026. Attackers attempted exploitation before the flaws were made public.
• AI is speeding up vulnerability discovery and being able to exploit them. Researchers behind PHP2Shell used frontier AI models to identify and build working exploits.
• Attacks also happened through a flaw in a popular WordPress backup plugin and a poisoned developer AI tool release.
• Your hosting provider manages server security, but keeping your CMS plugins, passwords, and backups up to date is your responsibility.

What Happened in October 2026

The number of recent cyber-attacks and security breaches in October 2026 has shown the different ways websites and their software can be compromised and hacked. Somewhat ironically, October is traditionally Cyber Security Month.

PHP2Shell: The Flaw That Put Most Websites at Risk

PHP (PHP: Hypertext Preprocessor) is the programming language that powers WordPress and millions of other websites. On 21 October 2026, the PHP team released emergency patches for two critical memory-handling vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively dubbed PHP2Shell.

CVE stands for Common Vulnerabilities and Exposures. CVSS, the scale used to rate flaw severity, scored it as a 9.2 out of 10.

Attackers could use it for Remote Code Execution (RCE). That means they could access and run malicious commands on servers without logging in. They could also expose sensitive server memory containing passwords and API keys.

Most importantly, the flaws are in PHP itself, so updating WordPress core software doesn’t fix them. At least one of them affects unpatched PHP versions going all the way back to 5.4; the current version is 8.5.

The details leaked on 20 October, ahead of the patch shipping on 21 October. On 26 October, CISA (Cybersecurity and Infrastructure Security Agency) added both to its Known Exploited Vulnerabilities (KEV) catalog.

A separate PHP vulnerability, CVE-2026-115560, remained unpatched as of 30 October. However, hosting providers can mitigate it with a configuration change.

A Backup Plugin That Could Hand Over Your Site

On 15 October 2026, Wordfence announced a WordPress vulnerability caused by a flaw in the Backuply plugin affecting more than 600,000 websites via SQL injection.

This meant attackers with a basic subscriber account could insert malicious database commands that run when an admin restores a backup, giving them full access to the website.

The flaw affected versions up to 1.5.8, but it was fixed in the fully patched version 1.5.9. This is a good (yet again ironic) reminder that even security plugins meant to protect your site still need regular updates.

Poisoned Developer Tools

Not all of the recent cyber-attacks involved website code or software vulnerabilities.

On 21 October 2026, hackers injected harmful code into the LiteLLM release pipeline, a popular open-source AI developer tool. The infected version 1.107.0 was then published to official sites like PyPI (an app store for Python code) and Docker.

LiteLLM’s incident report confirmed the release contained a dangerous infostealer and remote-access trojan, which are relatively self-explanatory.

This is known as a supply chain attack, where malware is hidden in software from trusted sources, so users download it without suspecting anything. The infected packages were pulled within hours.

On the same day, Node.js, a platform for running JavaScript apps, released emergency updates for its 22.x, 24.x, and 26.x versions. These patches addressed several serious vulnerabilities, including a Brotli decoder flaw (software that unpacks compressed files) reported by OpenAI’s Codex Security.

Breaches Through Third Parties

On 27 October 2026, US school administration software platform Frontline Education sent out an official data breach notification.

Hackers accessed their systems via a third-party vulnerability between 14 and 15 August, gaining access and exposing students’ and staff members’ personal information.

For businesses, the lesson is that even if your systems are secure, flaws in software supplied by third parties can still expose your data.

Why This Keeps Happening: AI is Finding Gaps Faster Than People Can Fix Them

The PHP2Shell flaws weren’t new. Some of them had been in PHP’s code for more than a decade. What changed was how quickly they were found and turned into working exploits.

This is largely due to AI. According to Wiz Research, during its PHP2Shell research one researcher completed what would normally have taken an elite team months in about a week using frontier AI models, including Gemini 4 Argon and GPT-5.6 Sol.  The AI helped analyse code, connect vulnerabilities, test whether they could be exploited, and verify patches.

The same technology also helped OpenAI’s Codex Security identify a serious Node.js vulnerability.

The issue is that while finding vulnerabilities is becoming faster, fixing them still takes time.

Even with AI, developers need to write and test patches. Hosting providers need to install them. Website owners then need to apply the updates.

Meanwhile, AI cyber-attacks aren’t waiting.

The PHP2Shell case shows how quickly that gap can become a problem. Attack attempts were detected before public disclosure, details leaked before official patches shipped, and older PHP versions needed complex backported fixes.

It also increases the risk of zero-day attacks, where attackers exploit flaws before a fix is available.

For online businesses, this highlights the need to apply security updates as soon as they’re released, reducing the time you’re exposed to new vulnerabilities.

Who Fixes What: Your Host vs You

When multiple cyberattacks and vulnerabilities make the news in such a short period, it’s not entirely unreasonable to ask if your host has dealt with them for you. The answer depends.

With shared, WordPress, and Managed cPanel Hosting, your provider takes care of:

• Applying PHP and Operating System (OS) security patches on the server.
• Setting firewall rules to filter malicious HTTP requests.
• Server-level malware scanning and intrusion detection.

You’re responsible for:

• Checking the PHP version selected in cPanel.
• Updating WordPress core software, plugins, and themes.
• Managing user accounts, permissions, passwords, and backups.
• Everything on a self-managed VPS, including PHP, Node.js, and Python packages.

For those who want VPS hosting but prefer not to deal with server maintenance and patching, Domains.co.za Managed cPanel Hosting includes OS updates, security hardening, monitoring, and backups handled by our team.

Regarding PHP2Shell, Domains.co.za deployed backported fixes on 21 October as they became available from CloudLinux and then updated the supported PHP versions (8.2, 8.3, 8.4, 8.5) early on 22 October across our Web Hosting and WordPress Hosting servers.

Five Things to Do Today

No hosting provider or tool can make a site completely invulnerable to attack. What matters is reducing the time between a fix becoming available and applying it. Here are five things you can do to get started:

1. Check your PHP version: Log in and check your PHP version in cPanel and move to a supported version where the PHP2Shell fixes are included (8.2.35, 8.3.36, 8.4.27, and 8.5.12 or later). Use a checklist when you upgrade PHP[RF1] .

2. Update and Remove: Install and apply any available software, plugin, and theme updates and delete anything you no longer use. If you use Backuply, check that you are running version 1.5.9 or later.

3. Look for Unusual Activity: Check for admin accounts you don’t recognise, unexplained files or pages, suspicious redirects, and spam content on your site.

4. Test Backups: Make sure you have recent backups stored off-site and that they can actually be restored. You’ll also need to know which backups were created before the problem started.

5. Secure Accounts: Enable Two-Factor Authentication (2FA), and change important passwords, API keys, and credentials, especially if you ran an unpatched PHP version for an extended period because PHP2Shell could expose server memory.

For more on keeping your data and visitors safe, read our 8 quick ways to improve your website’s security guide.

NOTE FOR DEVELOPERS:

Have you installed LiteLLM 1.107.0 and followed its incident-response notes? If you use Node.js, check the October 2026 security releases.

Not sure which PHP version your website is on? Check it in cPanel, and if you’re stuck on an unsupported version, PHP Extended Support lets you run on legacy versions until you’re ready to upgrade.

How to Choose & Register the PERFECT Domain Name

VIDEO: How to Choose & Register the PERFECT Domain Name

FAQS

Other Blogs of Interest

– 7 Top Cyber Threats In South Africa & How To Defend Your SME

– How to Enhance Cybersecurity and Build Digital Trust in your Business

– Cybercrimes — The Latest Trends in South Africa

– How to Protect your Website and Personal Info from Cyber Security Risks

– Cyber Security Risks and your Business