PHP2Shell: AI Found a Hole in PHP Itself. Here's What to Do Before Attackers Use AI Too
Two critical PHP flaws allow remote code execution on almost any PHP version, and AI did much of the finding. How the bugs work, which versions fix them, and what the speed of AI-assisted research means for patching.
On October 21, 2026, PHP shipped security releases for every supported branch to fix two critical flaws, CVE-2026-109618 and CVE-2026-109619, together known as PHP2Shell. They can lead to unauthenticated remote code execution, and according to Wiz Research, every PHP version released in the last decade is affected by at least one of them, going back to PHP 5.4.
The bug itself is serious. The way it was found is the bigger story: researchers at Wiz, and separately at a firm working with OpenAI, used AI models throughout the work, from finding the flaws to building the exploit chain.
What is broken
These are memory-safety bugs in PHP's core, not in WordPress, Drupal or any framework. They all come from how PHP handles a fatal error, especially running out of memory, in the middle of a request. When that happens, some internal state is left behind, and the next request on the same worker can reuse it.
Wiz describes several variants under the two CVEs:
- use-after-free bugs in session upload-progress handling and in the fatal-error backtrace,
- a memory disclosure where a later multipart request can leak worker memory inside a
PHPSESSIDcookie, even if the application never starts a session, - an OPcache type confusion between workers after a failed allocation.
Chained together, they gave Wiz unauthenticated code execution against test installations of WordPress, Drupal and Joomla. Because the flaw is in PHP itself, a very simple application on an affected version can be exposed too.
What to do now
- Update PHP. The fixed versions are
8.5.12,8.4.27,8.3.36and8.2.35. PHP's own advisory says there is no complete mitigation; updating is the only safe option. - Check what you don't run yourself. Shared hosting, managed WordPress, old Docker base images and forgotten staging servers all have their own PHP. Ask the provider or check the image, don't assume.
- Plan for PHP 8.1 and older. These no longer get fixes from the PHP project. Some Linux distributions and vendors backport patches; if yours doesn't, this is the moment to upgrade.
- Use the temporary shields if you can't patch today. Cloudflare, Fastly, Google, Vercel and others published mitigations. They buy time, they don't fix the bug.
- Watch for the signs Wiz lists: unusual multipart requests followed by memory-limit errors, bursts of HTTP 500 responses, oversized or malformed
PHPSESSIDcookies and unexplained worker restarts.
A related, separate issue, CVE-2026-115560, was announced two days later. Until the next bugfix release, PHP suggests setting session.upload_progress.enabled=0, which most sites don't need anyway.
Why the AI part matters
According to Wiz's timeline, the first bug was found on August 19, working remote code execution against Drupal followed the next day, and the report reached the PHP team on August 24. Wiz itself says the exploit chain was at the edge of what human researchers could practically achieve, and that AI changed how quickly such chains could be built.
That speed works for defenders here: the bugs were found, reported and fixed under coordinated disclosure. But the same tools are available to everyone. Two things follow for anyone running software in production:
- The window between disclosure and exploitation is shrinking. "We'll patch in the next maintenance window" is a plan from a slower era. Runtimes, not only libraries, need a fast update path.
- Old code is no longer safe just because nobody has looked at it. Bugs that sat in PHP's core for more than ten years were found in weeks once AI was pointed at them. Every long-lived codebase should expect the same.
The boring habits still win
None of this needs a new kind of defence. Know which runtime versions you run, everywhere. Keep base images current and rebuild them often. Make updating PHP, Java or Node a routine change instead of a project. The teams that already do this will spend PHP2Shell week updating a version number. The others will spend it searching for servers.
Sources
- Wiz Research: PHP2Shell, AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
- PHP: release announcements for 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (21 October 2026)
- Fortune: AI helped discover the PHP vulnerability that could take down 70% of the internet
- CNN: Websites shut down globally after AI finds cybersecurity flaw
