AI-Discovered PHP Flaws Trigger a Global Patching Scramble

Key Takeaways

• On 21 October 2026, the PHP project released emergency security updates fixing two critical vulnerabilities, collectively known as PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619.
• Both flaws are rated 9.2 out of 10 for severity and can allow an unauthenticated attacker to run code remotely on an affected server or read server memory, according to researchers.
• The flaws were found with the help of frontier AI models. Researchers at Calif reported the first flaw using OpenAI’s GPT-5.6 Sol, and Wiz reported the second using models including Google’s Gemini 4 Argon.
• Patched versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and earlier receive no official fix, although some Linux distributions have issued their own patches.
• The release was brought forward after details leaked on social media on 20 October 2026, and several governments took websites offline as a precaution while patching.
• The US National Security Agency and the UK National Cyber Security Centre advised organisations to patch immediately, or take sites offline if they could not update at once.

On 21 October 2026, the PHP project released emergency updates for two critical vulnerabilities that sent system administrators around the world scrambling to patch their servers. The flaws, collectively nicknamed PHP2Shell by researchers at Wiz, affect PHP, the programming language that powers a large share of the web, including major platforms such as WordPress, Drupal, and Joomla. What makes this incident different from a routine security update is not only its scale, but how the flaws were found: with the help of frontier AI models that turned a long-standing weakness into a working exploit far faster than traditional research had managed.

What PHP2Shell is

PHP2Shell is the collective name for two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 on the CVSS severity scale, which places them in the critical range. According to researchers, they allow an unauthenticated attacker to run code remotely on an affected server, without needing to log in, and to read memory that may contain sensitive information such as passwords. That combination, remote code execution without authentication, is why the response was urgent rather than routine.

The technical details, as reported by Wiz and others, centre on memory handling inside the PHP engine. One flaw involves memory corruption during out-of-memory handling, where an interrupted operation leaves request data partially initialised and cleanup routines then process that invalid state. The other is a use-after-free condition, where PHP retains references to request data after the backing memory has been freed, and a later request accessing those stale references can trigger execution. Neither flaw requires authentication, and neither is limited to a single application. Because the flaws sit inside PHP itself, rather than in WordPress, Drupal, or any other platform built on PHP, fixing the application alone does not fix the problem. Only patching PHP, or applying a vendor backport, addresses the underlying engine flaw.

The affected code is old. Wiz says every PHP version back to 5.4, released in 2012, is affected by at least one of the issues, and other coverage describes the underlying memory-handling weakness as dormant for even longer. The precise origin date varies between reports, with some citing 2012 and others pointing to earlier PHP 5 code, so this article does not present a single origin year as settled fact. What is clear is that the weakness survived in widely used code for more than a decade before AI-assisted research turned it into a working exploit. That longevity is part of why the incident matters: it shows that critical flaws can hide in mature, heavily used infrastructure for years, even when many eyes have looked at the code.

How AI found the flaws

The AI angle is central to this story, and it deserves careful reporting. According to the PHP Foundation and researchers involved, PHP Foundation researchers had identified a theoretical flaw in 2024 but could not work out how it might be exploited. After the foundation joined OpenAI’s Patch the Planet initiative in July 2026, progress accelerated. Researchers at the security firm Calif reported the first flaw on 11 August 2026 using OpenAI’s GPT-5.6 Sol. Wiz, a security firm owned by Alphabet, reported the second flaw on 24 August 2026, using models including Google’s Gemini 4 Argon, and Wiz also independently reported both flaws using a combination of its Wiz Atlas tool, Gemini 4 Argon, and GPT-5.6 Sol.

Wiz has said that frontier models were critical to making the process practical, enabling researchers to develop and adapt working exploits across multiple applications in hours. Its timeline shows a first flaw found on 19 August, remote code execution confirmed against Drupal and WordPress within two days, and a report to PHP on 24 August. That speed is the point. AI did not invent a new class of vulnerability here. It shortened the path from a known theoretical weakness to a working, demonstrable exploit, and it did so across different applications quickly.

Why the release was rushed

The PHP security team had planned an orderly release, but the timeline changed when basic details of PHP2Shell leaked on social media on 20 October 2026, one day ahead of the planned embargo date. According to the PHP Foundation, researchers at Calif then mistakenly published a video showing how the flaws could be exploited, which spread on hacking forums. The release was therefore brought forward to 21 October, with patched versions shipped at approximately 13:30 to 14:00 UTC.

The global response

Governments took websites offline as a precaution while applying the fixes, including France’s prefecture websites, Germany’s digital ministry, the Dutch parliament, Finland’s central government, and, in the UK, the Office for Budget Responsibility and NHS Scotland. The Netherlands’ National Cyber Security Centre took its own site offline as a precaution, and Wordfence confirmed that WordPress content management system updates do not address the underlying PHP exposure, a point that confused some site owners who assumed a WordPress update would be enough.

CISA advised all organisations running PHP-based websites to apply the patches immediately. The US National Security Agency issued a rare public warning advising that websites be taken offline if they could not be updated immediately, and the UK’s National Cyber Security Centre gave similar advice. That advice, to take a site offline rather than leave it exposed, is striking because it prioritises security over availability in a way that agencies rarely recommend publicly. It reflects the severity rating, the ease of exploitation suggested by early reports, and the sheer number of sites potentially affected.

What site owners should do

The patching steps are straightforward, even if the scale of the work is not. First, identify every PHP installation you run, including servers you may have forgotten, staging sites, and sites managed by a hosting provider. Second, check the PHP version. If you run PHP 8.2, 8.3, 8.4, or 8.5, update to 8.2.35, 8.3.36, 8.4.27, or 8.5.12 respectively, or to a later patched release if one is available. Third, if you run PHP 8.1 or earlier, understand that you will receive no official fix. Your options are to upgrade to a supported release, apply a vendor-provided backport where available, or manage an explicitly documented compensating path, such as taking the site offline or placing it behind additional controls until an upgrade is possible. A web application firewall can reduce certain attack paths, but because the flaws live inside the PHP engine, a firewall alone does not fix them, according to analysis cited in coverage of the incident.

Site owners should also check with their hosting provider, because many providers patch PHP centrally. Do not assume a WordPress, Drupal, or Joomla update has fixed PHP2Shell. Those are application updates, and they do not replace a PHP engine update. After patching, review logs for unusual activity around the disclosure period, especially from 20 October onward, and treat any unexplained code execution, new admin accounts, or unexpected file changes as a potential compromise to investigate, not as a routine anomaly.

What PHP2Shell means for AI and security

PHP2Shell is likely to be remembered as a turning point, not because it is the largest vulnerability ever found, but because of how it was found. Wiz has drawn a direct comparison to Heartbleed in 2014 and Log4Shell in 2021, arguing that PHP2Shell shows how deeply a single piece of shared infrastructure can sit beneath software that organisations do not realise depends on it, and that AI, rather than years of manual research, is what finally turned a decade-old weakness into a working exploit. That comparison is Wiz’s framing, and it is useful, but it should not be overstated. Heartbleed and Log4Shell affected different layers of the stack, and their exploitation patterns differed. What PHP2Shell shares with them is the combination of wide deployment, a long-hidden flaw, and a disclosure that forced rapid, global action.

For the wider AI debate, PHP2Shell complicates any simple story. AI helped find a critical flaw before attackers did, through a coordinated programme, and that is a genuine defensive win. At the same time, AI lowered the barrier to exploit development, and public exploit details spread quickly once the embargo broke. Both statements are true, and holding them together is essential. The question is not whether AI in security is good or bad. It is how disclosure, patching, and defensive tooling can keep pace with a world in which both discovery and exploitation are accelerating.

Our earlier coverage of an AI safety warning examined a warning that an AI-driven breach of cyber defences was likely, if not inevitable. PHP2Shell does not prove that warning in full, but it gives it concrete shape: AI did not breach a system here, but it did change the speed and scale at which a critical flaw moved from theory to working exploit to global patching scramble. Readers who want a practical starting point for evaluating AI tools and risks in their own organisation will find our guide to how AI can help your business useful, because it separates genuine capability from hype, a distinction that matters even more in security than in most fields.

The work is not finished. Organisations still running unsupported PHP versions need upgrade plans, not just patches. Researchers and vendors need to review whether similar memory-handling weaknesses exist in other widely used engines. And the security community needs to learn from a disclosure that leaked, so the next critical flaw gets a cleaner path from discovery to patch. Patch first, investigate second, and treat speed as part of security itself. That is the practical message of PHP2Shell, and it is one that will outlast this particular incident.

Sources: PHP2Shell flaws found with AI force emergency PHP updates and CISA advises orgs to patch PHP2Shell bugs immediately