AI Safety

AI-Found PHP2Shell Flaws Put PHP Websites at Risk

Oct 22, 2026·4 min read·By Rahish Saifi

An opened unbranded rack server on a wooden workbench cabled to a laptop where a sysadmin's hands type in a terminal under a desk lamp.

On October 21, 2026, the PHP project shipped emergency security releases for two critical engine flaws nicknamed PHP2Shell—CVE-2026-109618 and CVE-2026-109619, each rated CVSS 9.2. Under the right conditions they can let an unauthenticated attacker achieve remote code execution or read sensitive memory from a PHP worker. What makes the story an AI headline is how the bugs were found: Wiz Research used frontier models including Gemini 4 Argon and GPT‑5.6 Sol to discover and weaponize decade-old memory-safety mistakes, while security firm Calif reported related work through OpenAI's Patch the Planet program, also using GPT‑5.6 Sol. The flaws live in PHP itself—not in WordPress, Drupal, or your application logic—so patching the runtime is the only complete fix.

Key facts

Item	Detail
CVEs	CVE-2026-109618 (OOM / upload-progress path; memory disclosure and RCE demonstrated) and CVE-2026-109619 (stale global state; fatal-error backtrace and OPcache issues; RCE demonstrated)
Severity	CVSS 9.2 each (Wiz; PHP Foundation pre-announcement cited 9.2 under CVSS v4.0)
Fixed versions	PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 — released Oct. 21, 2026 (php.announce/513)
Unsupported	PHP 8.1 and older receive no fix from the PHP project; upgrade to a supported branch (CISA; PHP Foundation)
AI discovery	Wiz: Wiz Atlas, Gemini 4 Argon, GPT‑5.6 Sol (first finding Aug. 19, 2026; reported to PHP Aug. 24). OpenAI: Calif identified a critical flaw with GPT‑5.6 Sol via Patch the Planet; Wiz independently found both
Demonstrated impact	Pre-auth RCE on `wordpress:latest`, `drupal:latest`, `joomla:latest`; application-agnostic worker memory disclosure (Wiz)
Scale (attributed)	Wiz: PHP powers 70% of all websites in the world. Cloudflare blog: PHP is used by almost 70% of websites
Exploitation at disclosure	CISA (Oct. 21): had not observed exploitation at publication. Cloudflare CTO Dane Knecht (Oct. 21): early attacks emerging before patches. DigitalOcean (Oct. 21): public PoC exploit code available

What PHP2Shell is

Both CVEs stem from how PHP handles fatal errors—especially out-of-memory failures—during early request setup. A worker that survives an aborted request can leave corrupted or stale internal state that the next request treats as valid, enabling use-after-free bugs, memory disclosure, or remote code execution. Wiz demonstrated four primitives grouped under the two CVEs, including Heartbleed-style worker memory reads and pre-auth RCE chains. The PHP Foundation ties CVE-2026-109618 to OOM corruption and CVE-2026-109619 to globals pointing at freed memory. PHP rates risk highest on Apache with mod_php, where an unauthenticated request can hit the bug before application code runs; PHP-FPM and other web-facing SAPIs remain in scope.

How AI changed the timeline

Wiz's Oct. 21 write-up frames PHP2Shell as an inflection point: with frontier models, a single researcher completed in a week what previously would have taken a world-class team months of work. The team credits Gemini 4 Argon with an especially large role in discovery, exploit development, detection, and patch validation. Google DeepMind's Raluca Ada Popa echoed that theme in a quote Wiz published:

“Using Gemini 4 Argon, the team at Wiz has shown why frontier AI is a game-changer for cyber defense. For over a decade, these critical vulnerabilities remained unaddressed because vulnerability discovery and exploitation were incredibly complex. We're pleased to see Gemini 4 Argon help defenders bridge that gap, finding vulnerabilities and helping patch them.”
— Raluca Ada Popa, Head of Gemini Security, Google DeepMind

OpenAI's Patch the Planet post says Calif identified a critical flaw using GPT‑5.6 Sol, with Wiz independently finding both bugs. The PHP Foundation credits Calif's August 11, 2026 report and OpenAI's same-day report for clarifying the OOM root cause. OpenAI believes frontier AI found the flaws before attackers—while warning attackers can also move faster once details leak.

Disclosure drama and response

Coordinated disclosure wobbled on October 20 when CVE IDs leaked with wrong metadata; PHP moved its release to October 21 at 14:00 UTC. CISA urged immediate patching and said it had not observed exploitation at publication. Cloudflare CTO Dane Knecht posted on X that Cloudflare was “seeing early attacks emerging” and updating mitigations as new vectors appeared. DigitalOcean noted public proof-of-concept exploit code and that only patching fully addresses the issue. The Verge reported disruption at Wikipedia, 4chan, and DeviantArt, and that Dutch and Finnish government agencies took sites offline as a precaution.

What to do now

1. Inventory PHP everywhere. CISA and PHP both stress that PHP hides inside CMS platforms, control panels, and legacy apps—not only obvious LAMP stacks. Ask hosting providers and managed platforms whether their runtime is patched.

2. Patch to a fixed release. Upgrade to 8.5.12, 8.4.27, 8.3.36, or 8.2.35, then restart PHP-FPM, Apache, or other workers so new binaries load. Package versions may differ from php -v output; verify distro changelogs list both CVEs.

3. Leave unsupported branches. If you still run PHP 8.1 or older, the PHP project will not ship these fixes. Plan an upgrade to 8.2+ (or a distribution LTS backport if your vendor offers one). CISA says organizations that cannot update immediately, or that still run PHP 8.1 or earlier, should take PHP-based systems offline until they can be patched or updated.

4. Use WAF rules only as a bridge. Cloudflare, DigitalOcean, and others published emergency WAF guidance; Cloudflare product lead Matt Bullock called the deployed rules “a STOPGAP only” ahead of PHP's release. PHP's Oct. 21 announcement states there are no complete mitigations besides updating. Keep WAF rules current as exploit variants appear.

5. Monitor and hunt. Watch for unusual multipart uploads, memory-limit errors, HTTP 500 bursts, abnormal PHPSESSID cookies, and worker churn (Wiz). CISA suggests watching for PHP processes launching shells or downloading tools. If you find signs of exploitation, treat the host as compromised and investigate before returning it to service.

Bottom line

PHP2Shell shows AI accelerating both defense and offense on engine-level bugs. Fixed builds are out and agencies are urging action: inventory every PHP runtime, upgrade to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, and retire 8.1 and older. Wiz attributes roughly 70% of all websites to PHP—a measure of how widely this patch matters.