PHP shipped fixes on October 21 for two critical flaws that let attackers take over web servers without logging in, and frontier AI models helped find them. If you run anything on PHP, and statistically you do, update now. CISA says to move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 right away. Still on PHP 8.1 or older? CISA says to take those systems offline until they’re updated.
OK. Now the story, because it’s a big one.
What happened
The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are nicknamed “PHP2Shell.” According to Wiz Research, which reported them, they allow unauthenticated remote code execution (RCE: running your own commands on someone else’s server) and memory disclosure in PHP itself, independent of whatever application runs on top. Severity reaches 9.2 on the 10-point CVSS scale.
PHP is the language behind WordPress, Drupal, Joomla and Wikipedia’s MediaWiki. Wiz says it powers 70% of websites. BleepingComputer, citing VirusTotal, counts more than 5.1 million PHP hosts exposed online.
Wiz says every PHP version released in the last decade is affected by at least one of the issues, going back to PHP 5.4. Its researchers built a single exploit script that achieved pre-authentication code execution against the latest official container images of WordPress, Drupal and Joomla. They stress that even a “Hello World” app on a vulnerable PHP version can be exposed. Your code can be perfect and you’re still in scope.
How the bugs work
The root cause is unglamorous: bugs in how PHP handles fatal errors mid-request, especially out-of-memory errors.
PHP typically runs as a pool of long-lived workers, processes that handle one request after another. When a request crashes hard, PHP throws away that request’s memory. But in several places, it forgot to clear pointers that still referenced the freed memory. The next request on the same worker trips over that stale state. Security people call this a use-after-free, and it’s a classic route to taking over a process.
Wiz describes four exploitable variants under the two CVEs:
- Memory leak via cookie. An attacker sends a crafted file-upload request that runs PHP out of memory. A follow-up request makes PHP copy a chunk of freed memory into the
PHPSESSIDsession cookie it sends back. That memory can hold other users’ passwords, tokens and API keys. It works even if the app never uses sessions. - Upload-progress use-after-free. Similar setup, but the stale state becomes a memory-corruption tool. Combined with the leak, it produced RCE on WordPress, Drupal and Joomla.
- Fatal-error backtrace use-after-free. A leftover error record from a crashed request gets reused. Wiz turned it into RCE on Drupal.
- OPcache type confusion. OPcache, PHP’s shared cache of compiled code, could be left inconsistent across workers. Wiz built a WordPress RCE from it.
Wiz says other variants exist, but PHP’s patch fixes the issue at its core and covers them all.
The AI angle
The flaws were old. What changed was the cost of exploiting them.
Wiz says building a working exploit meant chaining multiple bugs and adapting to each target’s memory layout, work that was “at the edge of what human researchers could practically achieve.” Memory exploits are notoriously fragile: what works on one PHP build or config breaks on the next. AI models, Wiz says, can analyze failures and iterate on adjustments for each target. “A single researcher completed in a week what previously would have taken a world-class team months of work.”
Wiz used its own Wiz Atlas plus Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol, and singles out Argon for “an invaluable contribution.”
Meanwhile, OpenAI says security firm Calif identified a critical flaw using GPT-5.6 Sol as part of OpenAI’s “Patch the Planet” initiative, with Wiz independently discovering and reporting both. Expect both companies to keep telling this story with themselves slightly closer to the center of it.
OpenAI calls PHP2Shell “one of the most impactful security issues in recent memory,” says frontier AI found the bugs before attackers did, and warns that similar findings will “increase sharply in the coming months.” It pledged $1 billion in subsidized access to its Daybreak security tooling for under-resourced defenders of essential services.
The coordination
Wiz’s timeline:
- August 19: first vulnerability found.
- August 20–21: RCE confirmed on Drupal, then WordPress.
- August 24: reported to the PHP security team.
- September 21: PHP acknowledges and begins a coordinated fix.
- October 21: patch and public disclosure.
Cloud, hosting and CDN providers including AWS, Cloudflare, Google, Microsoft, Akamai, Fastly, Imperva, Vercel and Automattic prepared mitigations in advance. OpenAI says it engaged CISA, the Office of the National Cyber Director and international partners. It also published a proposed playbook for coordinating disclosures like this one, and asked the security community to critique it.
CISA’s guidance is blunt: inventory every system running PHP (including where it’s buried inside other software), patch internet-facing systems first, and watch for PHP worker processes launching shells or downloading tools. A web application firewall “may provide some protection,” but patching is the fix. Wiz adds tell-tale signs to hunt for: unusual multipart requests followed by memory-limit errors or bursts of HTTP 500s, oversized or malformed PHPSESSID cookies, and unexplained worker crashes.
Update: now exploited in the wild
Things moved quickly after disclosure.
The coordination wasn’t airtight. Details, including the CVE numbers, leaked before the patch, and some proof-of-concept exploits appeared online, though PHP’s security team said none of the pre-patch ones worked, BleepingComputer reports. Amazon’s threat intelligence team said attackers started probing four days before the fix shipped.
On October 24, Perplexity researcher Adel Karimi’s honeypots (decoy servers) recorded 35 shells launched from two IP addresses, using a four-stage chain that closely matched a public exploit, SecurityWeek reported. Karimi cautioned that his decoys used a deliberately favorable single-worker setup, so it isn’t a measure of how reliably the exploit works elsewhere.
On October 26, CISA added both CVEs to its Known Exploited Vulnerabilities catalog and gave federal civilian agencies until Thursday to patch. Separately, PHP shared mitigation guidance on October 23 for a further RCE flaw, CVE-2026-115560, that has no patch yet and requires “an unusual combination of configuration and application code.”
Who’s affected
Almost everyone running PHP who hasn’t updated. That includes small sites on shared hosting, which often depend on the host to upgrade PHP, and companies with PHP buried in appliances, admin panels and forgotten internal tools.
The biggest risk sits with sites on end-of-life PHP versions. PHP 8.1 and older no longer get regular fixes, which is why CISA’s advice for them is to go offline until upgraded, not to wait for a patch.
The skeptical read
The catch: “70% of the web” describes PHP’s footprint, not the number of sites that are practically exploitable today. Real-world reliability depends on PHP version, worker setup and configuration, which is exactly what Karimi warned about. That’s not a reason to wait. It’s a reason to read scary percentages carefully.
The AI framing deserves some care too. Both Wiz and OpenAI sell security products built on these models, and both benefit from “AI found it first.” The claim may well be true. It’s also marketing.
And “defenders got there first” held for about three days. With details leaking pre-patch and working exploits in the wild within a week, the window AI bought defenders was real but short.
The takeaway
Our read: two lessons, one reassuring and one not.
The reassuring one: defenders appear to have found this first, and the disclosure was coordinated across an impressive chunk of the internet’s plumbing.
The not-reassuring one: the vulnerable code sat there for more than a decade because exploiting it was too hard. AI just deleted “too hard” as a security control. Every gnarly, theoretical, “nobody would ever chain that” bug in your stack is now on the table, for defenders and everyone else.
What to watch:
- Whether attacks move from honeypots to mass compromise of real sites, and how fast shared hosts finish upgrading.
- A fix for CVE-2026-115560.
- The “sharply” increasing stream of similar AI-assisted findings OpenAI is promising, and whether maintainers can keep up.
(And yes, this site runs on WordPress. We read the advisory too.)
Image: Atomic Taco from Seattle, WA, USA / Wikimedia Commons, CC BY-SA 2.0
.jpg){kind=link}