PHP2Shell: What the AI-Found PHP Flaw Means for Your Site

PHP2Shell is the name for two critical flaws in PHP, the programming language behind roughly 70% of websites by common estimates. Both let an attacker run commands on a web server without logging in, and both were fixed on October 21, 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. AI helped find them months earlier. The coordinated disclosure then fell apart, attackers got a head start and governments pulled websites offline as a precaution.

Key takeaways

• If you run your own PHP server or site, update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now. PHP says no configuration change fully mitigates the flaws. Older branches need vendor backports.
• Amazon's honeypot saw the first exploit attempt on October 17, four days before the patches. The leak came before the fix.
• Ordinary visitors don't need to do anything. PHP runs on the server, not your computer.

What is PHP2Shell?

It is a pair of flaws, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 on the CVSS v4.0 scale. They sit in PHP's core engine, not in any single website's code, so every unpatched server running PHP is exposed. The first involves how PHP handles running out of memory while processing a request, leaving internal data corrupted. The second lets stale internal state survive into a later request on the same worker. In practice, an unauthenticated request can end in remote code execution, meaning shell access to the server. That gives an attacker a path to the site's data and to control of the machine.

The vulnerable code had been in PHP for more than a decade, and the leaked exploit tool claims to work back to PHP 5.4. The "PHP2Shell" name comes from that exploit tool, according to security firm Sansec.

How did it unfold?

Who found it, and what did AI do?

Credit is shared. Calif, OpenAI and Wiz are all credited by different sources, and one vendor, SOCRadar, lists Wiz Research as the discoverer, so attributions are not uniform. What is consistent is the role of AI: OpenAI says one flaw was found with GPT-5.6 Sol, and Google says its Gemini 4 Argon model helped Wiz with discovery, exploit development and patch validation.

OpenAI frames the episode as a "defender's window": models found the bugs before attackers did, giving the community time to prepare. It also called the bug one of the most impactful vulnerabilities in recent memory. That is a fair description of the defensive value. The same models can speed up attackers, which is the dual-use problem security researchers have warned about, and which we examined in OpenAI's earlier rogue-agent incidents.

What went offline?

The reaction was unusually visible. Reuters reported precautionary shutdowns of government, school and hospital sites in several European countries, including the Netherlands, Germany, Belgium, France and Finland. More than 30 UK government services went offline, and Australian government sites including cyber.gov.au were taken down as a precaution. The Internet Archive briefly went offline. Officials in the cases reported have not claimed a breach or data access.

At the other end, WordPress.com and WP Cloud said their hosted sites were already protected, while owners of independently hosted WordPress sites were urged to update PHP.

Am I affected?

If you run a website, blog or server, check your hosting panel or ask your host which PHP version you use, and restart PHP workers after updating. Ubuntu and Debian have shipped fixes, and AWS is addressing Elastic Beanstalk, WorkMail, Amazon Linux and Lightsail. Palo Alto Networks says PAN-OS and Panorama are affected through the management interface and that upcoming releases will fix it. If you only browse websites, there is nothing to install.

How widespread is the exposure? Estimates differ by source. Palo Alto Networks reported more than 22 million potentially exposed instances. Censys counted about 1.57 million PHP hosts still unpatched on October 21. Treat both as rough scales, not precise figures.

How bad is the exploitation?

Reports conflict, which is itself informative. Amazon calls PHP2Shell broadly exploited in the wild and found several working proof-of-concept exploits about 12 hours before disclosure, pointing to multiple attackers. Cloudflare, Hadrian and Patchstack also detected attempts. But watchTowr observed mass exploitation after the fixes appeared, while noting that some proof-of-concept exploits in circulation did not achieve code execution, and CyberScoop reported mostly reconnaissance. The honest summary: scanning and attempts are widespread, successful compromises are not yet well documented.

What does it mean beyond PHP?

Two things. First, the speed advantage from AI is real. A decade-old bug in some of the most reviewed code on the web surfaced in weeks. Second, the weak link was the human process around the discovery. The coordinated disclosure gave defenders time on paper, then a leak and an accidental proof-of-concept video erased much of it. Attackers acted four days before the patch. For companies, the lesson is that patch speed and disclosure discipline now matter as much as detection.

This sits in a month of repeated warnings about digital infrastructure. The IMF flagged a major cyberattack as a top risk to financial stability on October 13, and operational incidents such as the Ahold Delhaize cyberattack show how quickly a single failure reaches daily life.

The Bug Was Found Early. The Fix Arrived Late

The story is often told as AI finding a flaw nobody else could. That is true, and it matters. But the practical outcome was decided later: a fix that reached the public on October 21, after leaks and a four-day head start for attackers. AI shortened the discovery. It did nothing to speed up patching on millions of servers, which still depends on administrators, hosting providers and, for old PHP branches, vendors who may take weeks. That gap is where the damage, if any, will happen.

FAQ

What is PHP2Shell? Two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) that can let an attacker run commands on a web server without logging in. PHP fixed them on October 21, 2026.

Which PHP versions fix PHP2Shell? 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1, 8.0 and 7.4 get backports from vendors or minimal source patches, and PHP 7.3 and older get no fix.

Do I need to do anything as a regular internet user? No. PHP runs on web servers. Only people who manage a website, blog or server need to check that PHP is updated.

Sources: PHP security advisories, NSA and CISA advisories, Amazon Threat Intelligence, SecurityWeek, Help Net Security, TechTarget, watchTowr, Datadog Security Labs, SOCRadar, Reuters, Fortune/The Conversation (Doug Jacobson, Iowa State University), as of October 24, 2026. Details are still evolving. This article is for informational purposes only and does not constitute security or investment advice.