php2shell — AI-Found Flaws in PHP Itself and a Global Scramble

On 21 October 2026, the PHP development team released emergency security versions — PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, known together as php2shell. PHP is the programming language behind much of the web, and because the flaws are in PHP itself, an application is affected even when its own code is sound. Around the release, national agencies advised taking sites offline if they could not be updated at once, and sites around the world briefly disappeared.

What makes php2shell a landmark is not only its scale. The flaws had been present for more than a decade, yet turning them into a working exploit had been hard enough that they went unaddressed. What turned them into a real threat was AI.

What was wrong

php2shell is a set of memory-safety flaws stemming from how PHP handles fatal errors during a request, particularly out-of-memory errors. Classed as use-after-free (CWE-416), both carry a CVSS 4.0 severity of 9.2 (critical). Under the right conditions, an unauthenticated remote attacker can run code on the server, and can also read process memory that may hold credentials, tokens and API keys from other requests. The PHP team said every PHP setup that serves web requests — PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed — is at risk, with the risk highest for mod_php, because an unauthenticated request was shown to trigger the issue before any application code runs.

To show the reach, Wiz demonstrated remote code execution on WordPress, Drupal and Joomla, but stressed these were only examples: since the flaw is in PHP itself, even a "Hello World" application on an affected version can be vulnerable. Wiz cited an estimate that about 70% of the web uses PHP and said php2shell could be a turning point on a par with Heartbleed in 2014 and Log4Shell in 2021. The affected code goes back to PHP 5.4 (2012).

The PHP Foundation revealed that a 2024 audit had surfaced the first signs of one of the problems (the out-of-memory issue behind CVE-2026-109618). But the team could not agree on how to fix it — torn between breaking backward compatibility, creating new denial-of-service potential, and forcing changes on many extensions — and with no known path to code execution, the work stalled and restarted over months. "The delay was a structural failure," the Foundation wrote.

AI lowered the barrier

What pushed the flaws from theory to exploit was AI. Ryan Austin, a researcher at the California security firm Calif, used OpenAI's GPT-5.6 Sol during an August audit of PHP as part of the company's "Patch the Planet" initiative, found an unconditional remote code execution, and reported it on 11 August. Google's cloud-security firm Wiz found both vulnerabilities independently, using its own Wiz Atlas tool together with Gemini 4 Argon and GPT-5.6 Sol, and an internal Wiz researcher is said to have found the same problem around the same time. Wiz coined the name "php2shell." OpenAI reported further attack vectors on 18 September.

The researchers all traced the decade of silence to the difficulty of exploitation by hand. "Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours," Wiz wrote. The same capability speeds both defence and attack — that is the heart of the episode. The PHP Foundation said AI-assisted reports had surged, with 15 CVEs published since 1 July and more than 100 further reports that proved invalid, duplicate or not reproducible — but a person made every call and wrote every patch.

Leak, a day early, and precautionary shutdowns

Coordinated disclosure held until two days before the target date. On 20 October the CVE identifiers — with a wrong severity and release time — began circulating on online forums and social media. PHP brought its pre-announcement forward and moved the release from 22 October 14:00 UTC to 21 October 14:00 UTC. In the process, one of the reporters, Calif, mistakenly published a proof-of-concept video that kept circulating after deletion and accelerated the building of exploits. The distributor Chainguard published fixed images more than six hours before release, letting anyone study the flaw from the patch diff.

Exploitation attempts were seen even before disclosure. Amazon's threat-intelligence team said it had caught an attempt against a decoy system in its MadPot network on 17 October, four days before disclosure, from an anonymised address, and that it was unclear how the actor had learned of the flaw under embargo. WatchTowr said it observed in-the-wild attempts through its honeypots on 21 October but none that succeeded, and the US CISA said it had not observed exploitation as of that day. As of 26 October, no confirmed successful exploitation had been reported. Because the flaws run below the application layer, they leave little trace, and every advisory repeated that updating is the only complete remedy.

After disclosure, sites worldwide went offline as a precaution. Acting on advice from CERT-EU and the UK's NCSC, the Dutch government portal, Finland's public-facing government web services and the French Interior Ministry's sites went down, as did some Canadian government sites. The US NSA advised taking systems offline if an immediate update was not feasible. The Wikimedia Foundation shut down many of the services supporting Wikipedia, and the Internet Archive briefly went offline. In Japan, well-known services including the childcare SaaS CoDMON, the game Shadowverse: Worlds Beyond, the online-store service BASE and the Sakura and Xserver hosts entered emergency maintenance, and Prime Minister Sanae Takaichi urged people to check whether their public websites ran on PHP; Japan's National Cyber Office asked for the fastest possible response. On 23 October the PHP team published additional information on a separate remote-code-execution flaw, CVE-2026-115560, not fixed by the 21 October release.

Who guards PHP

The PHP Foundation tied the episode to a question of resources. PHP underpins a large share of the web, including government services, online stores, banks and media, yet security work on PHP itself rests on a small group of foundation-funded developers and a little volunteer help, it wrote. OpenAI committed US$1 billion in subsidised Daybreak access so defenders could use these capabilities, and said it had helped coordinate with government agencies. Even so, deciding how to change a long-standing design choice, weighing the compatibility trade-offs, and reviewing the patch is work only engineers who know the whole codebase can do — and there are too few of them. The Czech volunteer Ondřej Surý was credited with a crucial role in preparing installable packages for older versions.

Background: Log4Shell; Claude Mythos Preview and Project Glasswing on AI finding vulnerabilities; AI agents breaking containment out of test environments; and the cybersecurity and AI timelines.