PHP2Shell: Critical PHP Vulnerabilities
Information current as of 25 October 2026. Security advice changes quickly, so check the official PHP site for updates.
In the third week of October 2026, one of the biggest web security stories in years broke. Two critical flaws in the core of PHP, the programming language behind a huge share of the web, were disclosed and patched in an emergency release. The flaws have been nicknamed PHP2Shell, and they carry another headline detail: artificial intelligence played a major role in finding them. This article explains what happened, how AI is involved and what you should do if your website runs on PHP.
What Is PHP2Shell?
PHP2Shell is the name given to two vulnerabilities in the PHP interpreter, tracked as CVE-2026-109618 and CVE-2026-109619. Both received a severity score of 9.2 out of 10 on the CVSS v4.0 scale, which puts them in the critical category. In simple terms, they can let an attacker who has no account or password run their own code on a vulnerable web server. This is called remote code execution, and it is among the most serious kinds of security flaws.
Security researchers who reproduced the issue reported that normal application-level login protections cannot stop it, because PHP processes the harmful request before the website's own code gets involved.
The Two Flaws in Plain Language
- CVE-2026-109618: This relates to how PHP behaves when it runs out of memory while preparing request data. The data can be left partly set up, and PHP's cleanup process may then treat that unreliable data as if it were safe.
- CVE-2026-109619: This relates to request-specific information that remains in memory after the space behind it has been freed. A later request handled by the same worker process could then reuse that outdated information.
You do not need to understand the technical detail to act on this. What matters is that both issues sit in PHP itself, not in a single plugin or theme.
Who Is Affected?
Cloud and security vendors reported that a very wide range of versions is exposed, from PHP 5.4 up to 8.5.11. That includes older versions that no longer get regular support. Wiz said PHP powers around 70% of websites worldwide. Content management systems and apps built on PHP, such as WordPress and Drupal, run on top of the language, so they depend on the server's PHP version being patched. Websites on platforms that do not use PHP, including Blogger, are not directly affected by this particular flaw.
Timeline of Events
- July 2026: The security firm Calif begins work on the issue, using an OpenAI model, according to OpenAI.
- 19 August 2026: Wiz Research independently finds the first related vulnerability.
- 24 August 2026: Wiz reports the flaws to the PHP security team.
- 17 October 2026: Amazon says its monitoring systems recorded an exploit attempt, four days before public disclosure.
- 20 October 2026: Details leak online before the coordinated release.
- 21 October 2026: PHP publishes emergency fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- 22 to 23 October 2026: Cloudflare reports attempts rising into the millions, and PHP warns of a separate lower-risk issue, CVE-2026-115560.
How Was AI Involved?
This is what makes PHP2Shell different from earlier big vulnerabilities. According to published accounts, AI models worked alongside human researchers at two separate teams. Calif used OpenAI's GPT-5.6 Sol, and the work was linked to an OpenAI initiative focused on finding and fixing flaws in widely used software. Wiz, a Google-owned security company, used its own tool along with Google's Gemini 4 Argon and GPT-5.6 Sol. Both teams ended up at the same weaknesses without knowing about each other at first.
The PHP Foundation also noted that the number of vulnerability reports it receives has grown sharply as AI-assisted research has spread. Wiz described the discovery as an inflection point for the AI era, because AI makes it easier to find hidden flaws and to turn them into working attacks.
Why This Matters: AI Helps Defenders and Attackers
There are two sides to this story. On the positive side, AI found serious flaws in a heavily used language before most attackers did, and the issue was fixed. On the other side, the same technology can lower the effort needed to build attack code. Security experts quoted in news coverage warned that bugs which were once hard to exploit may become realistic targets. The window between a patch being released and attackers using it is also getting shorter. In this case, exploit attempts started within hours of disclosure, and the leak shortened the time defenders had to prepare.
What You Should Do Now
- Check your PHP version. Look in your hosting control panel, or ask your host.
- Update to a fixed release. Use 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or the newer package from your operating system vendor.
- If you are on shared hosting, contact your provider. Many large hosts have already applied the fix, but confirm it.
- Replace unsupported versions. If you run PHP 7 or older, plan an upgrade to a supported branch.
- Apply recommended interim settings if you cannot patch immediately. Vendors suggested options such as turning off session upload progress, but these only reduce exposure and are not a replacement for updating.
- Watch for unusual activity. Unexpected processes started by your web server, new files or sudden traffic spikes deserve attention.
- Keep backups. Make sure you have a clean, recent copy of your site and database.
A Third Issue to Know About
On 23 October, PHP published a short notice about another flaw, CVE-2026-115560. It affects only unusual configurations involving sessions, and PHP considers it unlikely in practice. No attacks using it had been reported at the time of writing. The project plans to publish a full advisory with its next routine release, so keep an eye on future updates.
Bigger Lessons
- Patch fast. Delay is the biggest risk when a flaw is public.
- Know what you run. Many organisations do not have a full list of their PHP installations, including old tools and control panels.
- Plan for AI-speed threats. Update schedules measured in weeks may no longer be enough for critical issues.
- Use layered defences. Web application firewalls, monitoring and least-privilege settings add protection around the code.
Frequently Asked Questions
Is my WordPress site at risk?
If the server's PHP version is unpatched, yes. Updating WordPress itself is not enough. The PHP version on your hosting must be updated too.
Do I need a password or login to be attacked?
According to researchers, no. That is why the severity is so high.
Does AI make websites less safe?
AI can raise the speed of both attack and defence. The best response is quicker updates and better monitoring.
Disclaimer: This article is for general information and does not replace professional security advice. Always follow guidance from the official PHP project, your hosting provider and a qualified security professional. We do not provide or support exploit code.
Sources and Further Reading
- Wiz Research blog, "PHP2Shell: AI uncovers critical RCE vulnerabilities"
- Datadog Security Labs, PHP2Shell analysis
- Huntress, rapid response article on the leaked PHP vulnerabilities
- Google Cloud blog, response to CVE-2026-109618 and CVE-2026-109619
- The Hacker News, reports on exploit attempts and CVE-2026-115560
- Fortune and NPR coverage of the AI role in the discovery
- SiteGround and University of Washington IT notices on patching










