PHP2Shell: AI-assisted research exposed two critical PHP flaws, and attackers moved within days

What was fixed

The two flaws are CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 scale. One comes from how PHP handles running out of memory partway through a request; the other leaves internal data pointing at memory that a previous request has already released. In the PHP project's advisory, the risk covers all PHP installations that serve web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The project rates the risk highest for mod_php, where an unauthenticated request can trigger the attack before any application code runs.

The PHP project says updating is the only complete fix; temporary settings reduce exposure to specific attack paths but "do not make an installation safe". PHP 8.1 and older no longer get official updates. Because of the severity, the PHP security team published minimal source backports for 7.4, 8.0 and 8.1 for people who build PHP themselves, and some Linux distributions and long-term support vendors ship their own patched packages. On 23 October the project added a further, lower-risk advisory (CVE-2026-115560) about an unlikely attack path in an unusual configuration, to be fixed in the next regular release; it recommends keeping one of the temporary mitigations in place until then, so ask your host whether it has.

Where AI came into it

According to OpenAI, Calif identified a critical flaw using GPT-5.6 Sol as part of OpenAI's Patch the Planet initiative, and Wiz independently discovered and reported both flaws. OpenAI says it then spent about two months helping coordinate the response with PHP's maintainers, Wiz, Cloudflare and US government agencies including CISA.

The root problem was not new. The PHP Foundation says a developer it contracts saw the first signs of the memory issue in 2024, but no practical attack was known and work on a fix stalled and restarted repeatedly for months. The foundation calls that delay "a structural failure". Calif's report on 11 August showed an unconditional remote code execution with the same root cause, and further reports from Wiz and OpenAI followed.

Calif itself plays down the idea of AI finding everything on its own. As TechCrunch reports, Calif says AI assisted the exploitation work but most of it rested on the researchers' existing knowledge of PHP. Its write-up adds: "No model is simply capable of unearthing 'all bugs' with simple prompts. At least for now."

The volume is rising anyway. The PHP Foundation says the security team has published 15 CVEs since 1 July and worked through more than 100 reports that turned out to be invalid, duplicates or impossible to reproduce. OpenAI says it expects similar findings "to increase sharply in the coming months" and has committed $1 billion in subsidised access to its Daybreak security tools for under-resourced organisations that protect essential services.

Attackers did not wait for the patch

The coordinated release did not go to plan. The PHP Foundation says the two CVE numbers began circulating online on 20 October with a wrong severity score, so the release was brought forward by a day to 14:00 UTC on 21 October. It also says the software supplier Chainguard published patched images more than six hours before the agreed time, which let anyone study the fix early.

Amazon Threat Intelligence reported an exploitation attempt against its honeypot sensors dated 17 October, four days before disclosure, from an anonymising network. It says it is unclear how the attacker got the details, and that it is unclear whether the attempts it logged before the release would have worked on real systems. By 21 October it described "broad exploitation attempts in the wild". TechCrunch reported on 24 October that Palo Alto Networks and Trail of Bits had confirmed compromises and post-exploit activity linked to the bugs.

Amazon's conclusion is aimed at anyone who owns a server: for critical flaws in internet-facing systems, patch timelines should be measured in hours, because AI-assisted analysis makes it cheaper to turn a published fix into a working exploit. It advises investigating from 17 October, not from the disclosure date.

What this means for a small business website

PHP is everywhere. W3Techs counted it on 69.2% of websites whose server-side language it can identify on 26 October, and WordPress, Drupal and Joomla all run on it. The fix sits in PHP itself, so updating WordPress plugins or themes does not close this gap; whoever runs the server has to install a fixed PHP release. On managed hosting that is usually the host, and you can ask for written confirmation of the PHP version your site now runs.

The same W3Techs data show about a third of PHP sites still on version 7 or older, which the PHP project no longer supports. Versions 8.0 and 8.1 are unsupported too, and php.net lists 31 December 2026 as the end of support for 8.2. For sites on unsupported versions the question is who will supply a patched build, or how quickly the site can move to a supported version.

The UK's National Cyber Security Centre asks organisations to find every system running PHP, put internet-facing ones first, update, and consider taking a system offline if it cannot be updated or mitigated quickly. It also asks them to check for signs of compromise and to watch for updates to appliances and services that bundle PHP. TechCrunch notes that PHP also runs inside some routers, storage devices, firewalls and VPNs.