On 21 October 2026, the team behind PHP, the programming language that powers a huge share of the world's websites, released emergency security patches for two critical flaws — tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell — after artificial intelligence tools helped researchers uncover weaknesses that had gone unnoticed for years, forcing organisations everywhere into a race to patch before attackers could exploit them.
Illustration: A web server under threat from a critical software flaw, concept illustration.
What Happened
Emergency fixes for the two flaws landed on Wednesday 21 October 2026 in four simultaneous PHP releases: versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to security coverage of the disclosure. Both flaws carry a severity score of 9.2 out of 10 on the CVSS scale, and both can allow an attacker with no login credentials to run malicious code on a vulnerable server — what security professionals call unauthenticated remote code execution — as well as to read memory that may hold sensitive information such as passwords.
The disclosure did not go to plan. Details of the vulnerabilities leaked publicly on 20 October, one day ahead of the planned embargo date, forcing the PHP security team to accelerate its release timeline, according to MarketFlux and other reports of the incident. Security firms and government agencies then urged organisations to patch immediately. The United States National Security Agency advised that any site unable to update at once should be taken offline until it could be secured, and the United Kingdom's National Cyber Security Centre gave similar advice, according to Computer Weekly and other coverage.
The scale of the exposure is what made the incident so alarming. PHP is a free, open-source, server-side language created in 1994 that assembles page content, talks to databases and delivers finished pages to visitors. According to W3Techs data cited in the coverage, it sits beneath roughly three-quarters of all websites whose programming language can be identified, including sites built on content-management systems such as WordPress, Drupal and Joomla. Wiz Research, one of the firms involved, reported that it had turned the bugs into unauthenticated remote code execution against those three platforms in testing.
Illustration: AI tools scanning software code for hidden vulnerabilities, concept illustration.
Background
The most unusual part of the story is how the flaws were found. The vulnerabilities are memory-safety errors in how PHP handles fatal failures, particularly when it runs out of memory. According to Wiz Research's disclosure, the problem lives in the language runtime itself rather than in any plug-in or framework, which means even a bare test script on an affected version could be exposed. The technical mechanism involves PHP's out-of-memory handling and its use of a function called longjmp, which can leave the system in an unstable state that an attacker can manipulate to execute arbitrary code.
Computer Weekly reported that the flaws affect every release dating back to PHP 5 in 2004, while other coverage described the vulnerable code as dating back to version 5.4, released in 2012. Either way, the weaknesses had escaped human audits for well over a decade. They were finally found with the help of frontier AI: OpenAI's GPT-5.6 Sol model independently identified one flaw through the company's "Patch the Planet" initiative in August 2026, while Wiz Research independently discovered and reported both flaws using a combination of Google's Gemini 4 Argon, Wiz Atlas and GPT-5.6 Sol. Wiz first found a PHP2Shell vulnerability on 19 August 2026 and confirmed remote code execution against Drupal and WordPress within two days, according to Learning Tree's summary of the timeline.
The discovery followed responsible disclosure: the researchers worked with the PHP team and partners including Amazon Web Services, Cloudflare, Microsoft and Automattic to test fixes before publication. OpenAI said researchers found the flaws before attackers, with no known exploits at the time of disclosure, according to The AI Insider. But the leak changed the arithmetic. Once details were public, defenders and attackers alike could study them, and security researchers reported exploit attempts climbing as administrators raced to patch.
Why It Matters
PHP2Shell matters for three reasons. First, it shows how deeply a single piece of shared infrastructure sits beneath software that organisations do not realise depends on it. A flaw in the language runtime is not a flaw in one website or one plug-in; it is a flaw in the foundation under millions of sites, from small business pages to large online stores. Wiz Research drew a direct comparison with Heartbleed in 2014 and Log4Shell in 2021, two earlier incidents in which a hidden weakness in widely used software forced a global emergency response.
Second, the incident marks a turning point for AI in cybersecurity. For years, finding this kind of deep, old vulnerability required rare human expertise and long manual effort. Now AI models can search code at a scale and speed that humans cannot match, and they are finding flaws that survived decades of review. That cuts both ways: the same capability that helps defenders find and fix weaknesses can also help attackers adapt exploits to different versions and configurations, which is why Wiz warned that AI has removed a barrier that once made these flaws hard to exploit.
Third, the incident exposes the long tail of unsupported software. The emergency patches cover only PHP 8.2 and newer. Older branches that have reached end of life receive no official release, although the PHP security team published minimal source backports covering versions 7.4 through 8.1. Organisations running very old versions face an uncomfortable choice: upgrade, apply a vendor backport where available, or take the system offline.
Illustration: The race between attackers and defenders to patch vulnerable websites, concept illustration.
What Happens Next
The immediate task is patching. Administrators should upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on their branch, and verify that the update is actually running in production rather than merely downloaded. A web application firewall can reduce some attack paths, according to Datadog analysis cited in the coverage, but it cannot fix the underlying flaw — patching PHP is what actually resolves the vulnerabilities. Organisations that cannot patch immediately should follow the official advice and consider taking affected systems offline until they can be secured.
Security teams will also be watching for exploitation in the wild. The leak before the embargo meant attackers had a head start, and the history of Heartbleed and Log4Shell suggests that mass scanning and exploitation attempts continue for months after disclosure, especially against systems that are slow to update. Expect vendors, hosting providers and cloud platforms to push automatic updates, and expect regulators and insurers to ask organisations to prove they patched.
Longer term, PHP2Shell is likely to accelerate the use of AI in both offence and defence. Security firms are already building AI agents that hunt for vulnerabilities, and the PHP case gives them a powerful proof point. Governments are paying attention too: the same week, China proposed draft export controls covering AI-assisted vulnerability discovery, a reminder that the capability to find flaws automatically is now treated as strategically sensitive. The question for the industry is no longer whether AI will find the next critical flaw, but whether defenders will patch faster than attackers can exploit it.
Sponsored: explore today's featured sponsored offers
FAQ
What is PHP2Shell?
PHP2Shell is the nickname for two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated attackers to run code on vulnerable servers. Both carry a CVSS severity score of 9.2 out of 10.
Which PHP versions are affected?
According to Computer Weekly, the flaws affect every release dating back to PHP 5 in 2004. Official patches were released for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with minimal source backports published for versions 7.4 through 8.1.
How were the flaws discovered?
They were discovered with AI assistance. OpenAI's GPT-5.6 Sol model found one flaw through the "Patch the Planet" initiative, while Wiz Research found both using Gemini 4 Argon, Wiz Atlas and GPT-5.6 Sol, and reported them through responsible disclosure.
What should website owners do?
Upgrade to a patched PHP version immediately and confirm the new version is running. If immediate patching is not possible, official advice is to consider taking the affected system offline until it can be secured.
Does a firewall alone fix PHP2Shell?
No. A web application firewall can reduce some attack paths, but because the flaw lives inside the PHP engine itself, only patching PHP fully resolves it.
Sources
- Reuters, "AI-discovered bugs may soon trigger fresh disruptions, cyber experts say", 24 October 2026.
- Computer Weekly, "What to do as critical PHP flaws puts millions of websites at risk", 21 October 2026.
- MarketFlux, "AI-Discovered PHP2Shell Flaws Trigger Global Patching Race as Exploit Attempts Hit Millions", 22 October 2026.
- Wiz Research disclosure, via NeuralWired, "PHP2Shell Vulnerability 2026: AI-Found PHP Flaws Explained", 23 October 2026.
- The AI Insider, "AI Tools Uncover Two-Decade-Old PHP Flaws as NSA Urges Urgent Patching", 22 October 2026.
Comments
Post a Comment