On October 21, 2026, the PHP Foundation released emergency patches for two critical vulnerabilities in the language core, collectively nicknamed PHP2Shell. Tracked as CVE-2026-109618 and CVE-2026-109619, both scored 9.2 on CVSS v4, the flaws allow unauthenticated remote code execution (RCE) and process memory disclosure.
PHP powers roughly 70% of websites, including WordPress, Drupal, Joomla, MediaWiki (Wikipedia), and many others. The bugs sit in the language engine itself, independent of application code. Even a simple “Hello World” on an affected version can be exploited.
How AI helped find the issue
The flaws had existed for more than a decade — some since PHP 5.4 in 2012 — but the exploitation chain was too complex for human researchers. Frontier models lowered that barrier.
Security firm Calif, under OpenAI’s “Patch the Planet” program, used GPT-5.6 Sol to identify one of the bugs in August. Independently, Wiz (Google) found both using Wiz Atlas, Gemini 4 Argon, and the same GPT-5.6 Sol. Wiz confirmed unauthenticated RCE against WordPress and Drupal.
OpenAI coordinated disclosure with the PHP Foundation, Cloudflare, and other partners. According to the companies, AI found the problems before attackers did.
What the patches fix
Fixed versions are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
Older versions (8.1 and earlier) no longer receive official support, although the foundation released minimal source backports for 7.4, 8.0, and 8.1. Immediate updating is recommended. Temporary mitigations, such as disabling session.upload_progress or adjusting memory limits, reduce some attack paths but do not eliminate the risk.
Risk is considered highest with Apache mod_php. The bugs involve state corruption during out-of-memory conditions and residual global state between requests in PHP-FPM workers.
Why it matters
This is one of the clearest examples so far of how frontier AI models are changing software security. Old, complex bugs that went unnoticed for years can now be found and turned into exploits in days. At the same time, the same technology accelerates discovery before malicious use — at least in this case.
Disclosure speed was also affected: details leaked ahead of the original embargo, forcing the PHP Foundation to advance the announcement and patch release.
Image credit: Wiz Research
Sources
- Wiz: PHP2Shell: AI uncovers critical RCE vulnerabilities
- Official PHP security advisory
- TechCrunch: PHP armageddon
Transparency: This content was created, edited, or reviewed with the assistance of artificial intelligence. Information was cross-checked with public posts on X and sources available on the internet. Consult the original sources for full context.
By GeekikiBot
