PHP patches two critical PHP2Shell flaws that AI helped researchers find and exploit

What PHP released

The PHP project shipped emergency security releases on Wednesday for two critical flaws in the language itself. In its security advisory, the PHP team said PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two vulnerabilities "that can allow unauthenticated remote code execution", and that all PHP users "are strongly encouraged to update immediately." The releases went out at 14:00 UTC on 21 October, a day after the project gave advance notice that a critical update was coming.

The two bugs are tracked as CVE-2026-109618 and CVE-2026-109619, and the PHP team rates both 9.2 on the CVSS 4.0 severity scale. The researchers who found them call the combined attack PHP2Shell. According to the advisory, the people at risk are "all PHP installations serving web requests", including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team considers mod_php the riskiest setup, with "a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs."

That last point is what makes this unusual. Most web security bugs live in a particular application, such as a WordPress plugin. These live in the PHP engine underneath, so a site can be exposed even if its own code is clean. Wiz says PHP powers about 70 percent of websites, and Sansec cites W3Techs data putting PHP at 69.3 percent of sites whose server-side language is known.

How the bugs work

Both flaws come from the same weakness: what PHP does when a request dies part-way through, especially when it runs out of memory. The PHP advisory describes CVE-2026-109618 as remote code execution through out-of-memory corruption, where memory handling "can interrupt PHP while internal request data is only partially initialized" and cleanup then treats the invalid data as valid. CVE-2026-109619 is remote code execution through stale global state, where request-owned state "can survive after its backing memory has been freed" and a later request on the same worker uses it.

In plainer terms, an attacker sends a specially crafted upload request that pushes PHP over its memory limit at a precise moment. PHP stops, but leaves pointers to memory it has already thrown away. The next request handled by that worker trips over the leftovers, and a skilled attacker can shape what is in that memory. Wiz lists four exploitable bugs grouped under the two CVEs, including a use-after-free in the upload-progress unserializer, a fatal-error backtrace use-after-free and an OPcache type confusion.

One variant also leaks memory without needing to run code. Sansec describes it as a Heartbleed-style leak: after the fatal error, PHP's upload-progress handler can hand freed worker memory back to the attacker inside a session cookie. Wiz says that memory may hold passwords, authentication tokens, API keys and certificates belonging to other requests or the server. The earliest affected code dates to PHP 5.4, released in 2012.

The role of AI in finding them

Three groups turned the old weakness into working exploits this year, and all three say frontier AI models made the difference. OpenAI, in a post about its Patch the Planet programme, says the security firm Calif "identified a critical flaw using GPT-5.6 Sol" as part of that initiative, while Wiz "also independently" discovered and reported both vulnerabilities. Sansec's timeline says Calif, working with OpenAI, started on 1 August and reported the first bug to PHP on 11 August, and Wiz reported on 24 August.

Wiz says it used its own Wiz Atlas tool, Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol, and credits Gemini 4 Argon with "an invaluable contribution" to finding the vulnerability, building the exploit, detecting attacks and validating the patch. Its researchers argue that the flaws had been visible for years but that exploiting them required "an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve." Models, they write, made it practical to adapt working exploits across multiple applications in hours.

The history supports that reading. Sansec notes that a 2020 PHP bug report described long multipart fields exhausting memory, and a 2024 audit by OSTIF and Quarkslab found a related out-of-memory issue, but in both cases nobody proved it was exploitable, so it stayed unfixed. The pattern matches other recent cases AI Lookout has covered, such as XBOW's GPT-5.6 Sol Chrome exploit chain and the flood of AI-found reports that pushed curl to take low and medium vulnerability reports public.

What has been shown so far

Wiz says it combined the bugs into a single exploit script and demonstrated unauthenticated remote code execution against the latest container images of WordPress, Drupal and Joomla. It stresses that those were chosen as examples: "even a simple 'Hello World' application running on an affected PHP version can be vulnerable." Sansec reports that Calif confirmed pre-authentication code execution against Magento 2.4.9 and ten other applications, including WordPress, Drupal, MediaWiki, Nextcloud, phpMyAdmin and Laravel.

Details appear to have escaped early. Cloudflare says the vulnerability "was leaked before the official release date" and that it observed attack traffic targeting its customers, with attackers changing their payloads to try to slip past its rules. It says it had been building web application firewall protections since early October and switched them on by default for free and paid customers from 03:02 UTC on 21 October, about nine hours before disclosure. Cloudflare's chief technology officer, Dane Knecht, called those rules "a STOPGAP only" in a post quoted by Sansec.

Some organisations did not wait. WIRED reported, citing Reuters and other reports, that several Finnish government sites, French government websites and the Port of Rotterdam's site were offline as a precaution, and Sansec lists Dutch sites including the House of Representatives and the national cyber security centre. The FBI asked anyone who finds signs of compromise to preserve web server and PHP logs and report it.

What administrators should do

The advice from the PHP team is blunt: update. Servers on PHP 8.2 to 8.5 should move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Linux distributions and long-term-support vendors received the patches in advance, so distribution packages should be appearing. PHP 8.1 and older no longer get official releases, but because of the severity the PHP team published minimal source backports for 7.4, 8.0 and 8.1, and some vendors ship their own backported fixes.

For anyone who cannot patch at once, the advisory lists measures that "reduce exposure to specific attack paths but do not make an installation safe", such as setting memory_limit to -1 in a way applications cannot override, lowering post_max_size, and enforcing request-size and multipart limits at the web server or proxy. PHP core developer Gina Peter Banyard, quoted by Sansec, said the only real mitigation is patching, and Sansec adds that taking a PHP server offline or making a store read-only is safer than relying on configuration changes.

The UK's National Cyber Security Centre told organisations to find every system running PHP, starting with internet-facing ones, and not to limit the search to obviously outdated versions. Wiz suggests watching for unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, oversized PHPSESSID cookies and unexplained PHP worker restarts, because these attacks run below the application and may leave little in application logs.

OpenAI's coordination plan

OpenAI is using the episode to pitch a process for handling AI-found bugs in widely used software. It says it led a coalition of maintainers, researchers and security providers for two months, engaged the White House's Super Intelligence Force, the Office of the National Cyber Director and CISA, and helped infrastructure providers prepare protections before disclosure. Its proposed framework has five stages: validate and fix the bug upstream, give affected organisations time to act, coordinate with governments, prepare updates across products, and publish guidance once a patch is out.

The company is also offering a PHP version checker and says a Codex skill to help operators find vulnerable versions is coming. It says it has committed $1 billion in subsidised access to Daybreak, its cybersecurity offering that AI Lookout covered when Sophos adopted it, through a programme for under-resourced organisations that protect essential services. OpenAI also warns that these bugs "are among several significant vulnerabilities we've already found and are working to fix", and that it expects such findings "to increase sharply in the coming months."

What is still unclear

Several questions remain open. Nobody has yet published a count of compromised servers, and the PHP team's own advisory does not describe exploitation in the wild, even though Cloudflare says it saw attack traffic. Researcher estimates of exposed hosts quoted by Tenable run from about 1.3 million to 1.9 million, but these are rough counts, not measurements of vulnerable servers. Public code claiming to exploit the flaws is circulating, and Tenable warns that such code is sometimes laced with malware.

The credit is also shared in ways that differ by source. OpenAI's post centres GPT-5.6 Sol and its programme; Wiz's post highlights Gemini 4 Argon; Cloudflare lists Calif, Wiz, OpenAI and Quarkslab as the disclosing parties. What all of them agree on is the broader point: AI is shrinking the time and expertise needed to turn a long-known weakness into a working attack, which means defenders now have less time to patch than they used to.