PHP2Shell Explained: What AI Found Hiding in PHP for More Than a Decade

Short answer: AI-assisted security researchers found two critical memory-safety flaws inside the PHP engine itself now tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. Under the right conditions they let an attacker with no login run their own code on a web server. Researchers say every PHP release going back to PHP 5.4 (released in 2012) is affected by at least one of them. PHP shipped fixes on October 21, 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 and the only complete protection is updating to one of those (or your host’s or Linux distribution’s patched equivalent).

That is why on October 21 and 22 you may have seen government portals banks and ordinary apps temporarily go offline. Most of them were not hacked. They were patching.

Below is what was actually found how AI was involved why a bug this old survived so long what people are getting wrong about it and what to check on your own site.

PHP2Shell at a glance

Item	What’s confirmed
Names	CVE-2026-109618 and CVE-2026-109619 together called PHP2Shell
Severity	Critical rated 9.2 on CVSS v4.0 by the PHP security team
Where the flaw lives	The PHP interpreter (memory management and error handling) not any single app or plugin
Affected versions	PHP 5.4 and later according to Wiz Calif and Cloudflare (PHP itself has not named the oldest affected version)
Fixed versions	PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 plus patched packages from Linux distributions
Patch date	October 21, 2026 14:00 UTC (moved forward one day after a leak)
Who found it	Calif (with OpenAI’s GPT-5.6 Sol) OpenAI and Wiz Research independently
Proven targets	Default WordPress Drupal and Joomla installs; Magento 2.4.9 and other PHP apps
Exploitation status	Disputed and changing; see the section below

What is PHP and why does one bug matter to so many websites?

PHP is the server-side programming language that builds web pages before they reach your browser. It was created in the early 1990s and as AFP reported helps run an estimated 70% of the world’s websites. WordPress Drupal Joomla Magento and countless custom business portals all sit on top of it.

Most security news you hear about WordPress involves a single plugin or theme. PHP2Shell is different. It is a flaw in the layer underneath all of them. Wiz said even a basic “Hello World” PHP page on an affected version could be vulnerable. So a site with a perfectly updated CMS and zero plugins could still be exposed if the PHP runtime below it was not patched.

What exactly did AI find?

The two flaws are related and both come down to how PHP cleans up after something goes wrong mid-request.

CVE-2026-109618: memory corruption when PHP runs out of memory

The PHP Foundation explains that if a request hits PHP’s memory_limit at precisely the wrong moment PHP can leave half-built internal data behind and later trust it as if it were valid. That corrupts memory. On Apache running mod_php an unauthenticated request can trigger this before any website code runs and full remote code execution was demonstrated with default settings. It was also confirmed on PHP-FPM (the setup most modern hosts use) through application-level code paths.

CVE-2026-109619: leftover state from a previous request

Here a fatal error at the wrong point can leave PHP holding a pointer to memory that belonged to an earlier request. The next request served by the same worker process can then reuse that freed memory a classic “use-after-free” bug. Wiz’s write-up groups this with a crash-backtrace issue and an OPcache type confusion problem and says it reached pre-authentication code execution on Drupal and WordPress.

The quieter risk: reading server memory

Wiz also showed it could read the memory of PHP worker processes without fully taking over the server. That memory can hold database passwords session tokens and API keys. This matters for cleanup later because patching stops future leaks but does not un-leak anything already exposed.

How was AI actually involved?

This is the part that made headlines and it is worth being precise about who did what.

• Calif a California security firm began auditing PHP’s source code on July 30, 2026 as part of OpenAI’s funded Patch the Planet programme. Researcher Ryan Austin used OpenAI’s GPT-5.6 Sol model and on August 11 Calif reported an unconditional remote code execution to PHP.
• OpenAI independently reported the same root cause the same day then sent further attack paths in September.
• Wiz Research working separately found its first PHP issue on August 19 using its own Wiz Atlas tooling together with Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol confirmed an unauthenticated attack on Drupal the next day and reported to PHP on August 24.
• Earlier in 2026 the PHP Foundation had also scanned PHP with Anthropic’s Claude Mythos through the Alpha-Omega project and now uses OpenAI’s Daybreak Red to help validate incoming reports.

OpenAI described the discovery as a sign that AI can now find bugs with “internet-scale impact.” Calif struck a more measured tone saying its researchers’ knowledge of PHP’s history mattered more than the model itself. Both things are probably true and that tension is the real story (more on that below).

Why did a bug survive in PHP for over a decade?

The honest answer is that it was not completely unknown. It was known unproven and hard to fix.

• Calif traces the idea back to 2004 when researcher Stefan Esser found the first remote vulnerability tied to PHP’s memory limit.
• A bug describing the out-of-memory condition was reported to the PHP project in 2020.
• In 2024 PHP’s first external security audit in years (funded by Germany’s Sovereign Tech Agency run through OSTIF and carried out by Quarkslab) led a PHP developer to the first signs of the problem. A possible exploit was theorised but nobody could show a concrete attack path.

Without proof of real-world impact the fix kept losing out. The PHP Foundation is unusually candid about this: every proposed fix risked breaking backward compatibility opening new denial-of-service problems or forcing changes on many third-party extensions. Its small security team working by consensus kept stalling. The Foundation itself calls the delay a structural failure caused by both its decision process and a lack of resources.

What changed in August 2026 was not that someone finally noticed the bug. It was that AI-assisted researchers proved quickly and repeatedly that it could be turned into a working attack. Once that proof existed the fix became the Foundation’s top priority.

Why did so many websites go offline?

Coordinated disclosure was supposed to end with a release on October 22. It did not go to plan.

• October 20, around 15:00 UTC: the two CVE IDs leaked onto forums and social media with a wrong release time and an inflated 10.0 score. PHP responded by publishing a pre-announcement and pulling the release forward by a day.
• That evening Calif mistakenly published a video of its proof-of-concept working against several targets. Copies spread after it was deleted which sped up public exploit attempts.
• October 21, 07:41 UTC: the PHP Foundation says Chainguard published patched images more than six hours early letting anyone study the fix.
• October 21, 14:00 UTC: the official fixes and full disclosures went out from PHP Calif Wiz and OpenAI.

Faced with a critical bug public details and patches that still had to be rolled out many organisations chose to take services offline rather than run unpatched. AFP reported outages including the Paris police website and a Pokémon sleep-tracking app while Reuters photographed the Dutch government portal mijn.overheid.nl unavailable and a Japanese asset manager Sumitomo Mitsui DS Asset Management temporarily suspending some services. CISA in the US and Germany’s BSI both advised disconnecting vulnerable systems if they could not be patched promptly.

Are hackers actually exploiting PHP2Shell?

Reports conflict and they are moving by the hour so treat this as a snapshot from October 22, 2026:

• CISA said on October 21 that it had not observed exploitation at the time of its alert and neither CVE was in its Known Exploited Vulnerabilities catalogue that evening.
• The PHP security team said it had not identified any functional exploits among the public proofs-of-concept at the moment of release.
• watchTowr reported active exploitation attempts against both CVEs on its honeypot network later that day.
• Amazon quoted by ABC News said proof-of-concept exploits appeared within hours of the embargo lifting and PHP2Shell was now being broadly exploited.
• Huntress told CyberScoop it had not confirmed any successful break-in on live customer systems.

The practical reading: attackers are clearly trying confirmed compromises were scarce at the time of writing and that gap tends to close fast. A previous critical PHP flaw CVE-2024-4577 drew exploit attempts within a day of disclosure.

What people are getting wrong about PHP2Shell

“My WordPress plugins and theme are all updated so I’m fine.” Not necessarily. The flaw is in PHP which your host or server controls. A fully updated WordPress install on an unpatched PHP runtime is still exposed.

“That site went offline so it got hacked.” Usually the opposite. As Swinburne University’s Dimitrios Salampasis told AFP pulling a site while updates go in can be a responsible precaution.

“I’m behind Cloudflare so I don’t need to patch.” Cloudflare says customers on its free and paid WAF were protected by default from 03:02 UTC on October 21. That is a genuinely useful layer but PHP states plainly that updating is the only complete fix. Mitigations reduce specific attack paths; they do not make an installation safe.

“My server says PHP 8.1.x so I’m definitely vulnerable.” Maybe maybe not. Ubuntu Debian and other distributions often backport security fixes into older-looking version numbers and mark the fix in the package revision not the PHP version. Check your distribution’s advisory rather than the version string alone.

“PHP 7.4 is old nobody targets it.” The opposite is true. PHP 8.1 and older are end-of-life upstream. The PHP team supplied minimal source backports for 7.4 8.0 and 8.1 as an exception but these are not ready-made packages or a return to normal support. Old forgotten servers are exactly what mass scanning finds.

“AI found it so AI hackers will find everything now.” This one deserves a real answer below.

The bigger shift: AI made proof cheap

The most important lesson in PHP2Shell is not that AI found something humans had never seen. Humans had circled this bug since 2004. What AI changed was the cost of proving it mattered.

For years PHP’s out-of-memory problem sat in a familiar limbo: probably dangerous no working exploit expensive to fix. Projects with small teams reasonably prioritise bugs with demonstrated impact. AI-assisted researchers collapsed that limbo in weeks turning a theoretical weakness into chained working exploits against real software. That forced the fix.

Two consequences follow and they cut in opposite directions:

• For defenders this time it worked. To OpenAI’s knowledge frontier AI found these flaws before attackers did and the industry had roughly two months to prepare patches WAF rules and distribution packages.
• For maintainers the workload is exploding. The PHP Foundation says its security team has published 15 CVEs since July 1 2026 and worked through more than 100 reports that turned out to be invalid duplicates or not reproducible. AI finds candidate bugs faster than a handful of experts can decide on safe fixes.

Expect more “decade-old bug found by AI” stories in other foundational software. The bottleneck is shifting from finding problems to fixing them well which is why the Foundation is openly asking companies hosts and governments that depend on PHP to fund its security team.

What to do now: a practical checklist

If you run a WordPress or other PHP site on shared or managed hosting

1. Find your PHP version. In WordPress go to Tools → Site Health → Info → Server. Most hosting panels (such as cPanel’s PHP selector) also show it.
2. Ask your host one direct question: “Is my site running a PHP build patched for CVE-2026-109618 and CVE-2026-109619?” A version number alone may not answer this on managed platforms.
3. If you are on PHP 8.1 or older move to 8.2 or newer where your host allows it after testing on staging if you can.
4. Turn on a web application firewall (Cloudflare’s free plan or your host’s WAF) as an extra layer while you confirm the patch.

If you manage your own server or VPS

1. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or install your distribution’s patched package.
2. Restart PHP-FPM and/or Apache. Old worker processes keep running vulnerable code until they are restarted.
3. Prioritise internet-facing servers especially any using Apache with mod_php where the attack can trigger before your application code runs.
4. Look for PHP you forgot about: staging sites old microsites admin tools and third-party appliances. As UNSW’s Rahat Masood told AFP if a vendor you depend on runs vulnerable PHP patching your own server does not fully protect you.
5. If you cannot patch promptly CISA and BSI advise taking the system offline.

After patching

1. Rotate secrets that live in PHP memory on any server that was exposed: database passwords API keys payment and email service tokens.
2. Review logs from October 20 onward for unusual large multipart uploads repeated fatal or out-of-memory errors and unexpected new files or admin users.
3. Keep watching official sources (php.net and your distribution’s security tracker) for any follow-up releases.

If you want a broader foundation beyond this one incident our guide to cybersecurity basics everyone should know covers the habits that limit damage when a bug like this appears and how to improve software security and prevent cyber threats goes deeper on patching routines and layered defence.

What to realistically expect

Patching closes these two holes. It does not guarantee your site was never touched before you patched and it will not protect third-party services you rely on. Large organisations will likely be patched within days. As James Cook University’s Steve Kerrison warned many smaller sites and personal blogs may stay unaware for weeks or months and those are the ones most likely to be quietly abused for spam or malware. If you look after a small business site a client site or a family member’s blog a five-minute check today is worth it.

Questions people are asking next

Does PHP2Shell affect sites built on Wix Squarespace or Shopify?

Those are hosted platforms where the provider manages the underlying stack so there is nothing for site owners to patch directly. Self-hosted WordPress Drupal Joomla and Magento sites are where owners need to act.

Is this as bad as Log4Shell or Heartbleed?

Security researchers have made that comparison because of PHP’s reach. The key difference so far is that patches and WAF rules were largely ready at disclosure though the leak cut the head start short.

Will AI keep finding bugs like this?

Almost certainly. OpenAI says the PHP flaws are among several serious vulnerabilities it has already found. The open question is whether maintainers of critical open-source projects get the funding to keep up.

Next, if you are curious how AI is reshaping more than security see how AI search is transforming Google and SEO.