Turns Out It Wasn't the Plugins

In July I wrote a eulogy for WordPress. I said its only real pitch — you don't need a developer — died the day AI could build you a site, and that every plugin you installed was a door you left unlocked. Fourteen doors, fourteen strangers.

I was wrong about the doors. The problem was under them.

What actually happened

Researchers at Wiz disclosed two critical flaws in PHP itself — CVE-2026-109618 and CVE-2026-109619, together nicknamed PHP2Shell. An uninitialized pointer, CVSS 9.2, unauthenticated remote code execution. No login. No stolen password. Just a request.

PHP shipped fixes on October 21: 8.2.35, 8.3.36, 8.4.27, 8.5.12. Everything back to PHP 5.4 is affected, and 7.4, 8.0 and 8.1 are end-of-life — there is no patch coming for those, ever.

And to be precise, because the distinction is the whole point: this is not a WordPress bug. WordPress.org says no WordPress update is needed or planned, and they're right. The hole is one layer down, in the language the site runs on.

So why does it land on WordPress hardest

Because almost nobody running a WordPress site knows what PHP version is underneath it.

Clicking “Update All” in your dashboard does nothing here. Every plugin you own can be perfectly current and your site can still be wide open, because the flaw isn't in anything that dashboard can see. It's in the floor. Somebody with server access has to go fix the floor, and for most small businesses that somebody doesn't exist.

That's the argument I've been making for a year, and it was never really about plugins. You didn't buy a website. You inherited an operating job. Most of the bill for that job stays invisible — until a Tuesday when all of it arrives at once.

Here's what I had to do when this dropped: nothing. Not one line. Nothing I ship runs PHP — not the CRM, not a single client site. That isn't luck and it isn't a flex. It's the entire reason I build the way I do.

An AI found it

The researchers used AI models to do the finding. I've written about this from the other side — Claude is my beta tester now, catching my bugs before my customers do, and the leash keeps getting longer on what I let it do unsupervised. Same tool, bigger haystack: this time it combed the language running a huge slice of the internet and found a way in that humans had walked past for years.

Credit where it belongs — humans found and reported this. AI was the instrument. But sit with the implication for a second. If AI can surface a long-buried hole in PHP, it can surface the one in whatever you're running. So can everybody else's AI.

What to do about it

My mentor Rich Washburn wrote this up before I did, and his instructions are the right ones. Go read him.

My version is shorter: find out what PHP version your site runs on today. If nobody can tell you, that's your answer.

Then ask the real question. Not “is it patched.” Who's going to notice the next one.

No flowers. Still just a redirect.