PHP’s critical remote-code-execution advisory lists PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as patched releases. Updating to a release containing the fix is the only complete mitigation for that issue, according to the maintainers.
Those releases are part of the October 21, 2026 coordinated disclosure of vulnerabilities described as PHP2Shell. OpenAI says Calif identified one critical flaw using GPT-5.6 Sol through its existing Patch the Planet program. Wiz independently discovered and reported both vulnerabilities, according to OpenAI, while PHP maintainers led the fixes and release.
OpenAI also published an open-source version checker, available as Codex skills or a Node command-line tool. It can help identify outdated PHP installations, with an important limit: an “OK” result is a version comparison, not independent verification that a security fix is installed.
Patch the PHP Runtime, Not Just the Application
The immediate response should follow PHP’s advisories and the security guidance for the package or hosting service actually running the site.
Updating a WordPress plugin or changing application code does not, by itself, replace a vulnerable PHP interpreter. In its PHP2Shell research, Wiz reports demonstrating unauthenticated remote code execution against deployments of WordPress, Drupal and Joomla using their latest container images at the time of testing. Those applications were demonstration targets, not a complete list of affected software.
For operators, the practical sequence is:
- Identify the PHP runtime serving production requests, including separate pools, containers and hosting environments.
- Apply the relevant PHP release or a provider-confirmed package containing the fixes.
- Restart the affected PHP workers and verify the runtime now serving traffic.
- Check the related PHP advisories and provider guidance rather than treating one version check as complete remediation evidence.
A local command-line PHP installation may differ from the one used by the web server, especially on a host with several PHP versions or separately managed application containers.
Distribution packages create another complication: a vendor may backport a security fix without changing the upstream version number. In that case, the vendor’s package advisory is more informative than a simple comparison against upstream release numbers.
For installations that cannot update immediately, PHP documents configuration mitigations but explicitly warns that they are incomplete. Temporary controls should buy time for an update, not become a reason to postpone it indefinitely.
