PHP2Shell: AI Found the Decade-Old Bug Behind 70% of the Web
An AI went looking for bugs in the software that runs most of the internet — and found one that had been sitting there, unnoticed, for more than a decade. Two of them, actually.
On Wednesday, the PHP project shipped emergency patches for a pair of critical flaws nicknamed PHP2Shell. They let an attacker run code on a web server without an account, they reach back to nearly every PHP version since 5.4, and the whole thing was supposed to stay secret until Thursday. Then Hacker News leaked it, and the internet's plumbing got patched a day early — while governments on two continents switched their own websites off rather than gamble.
We checked the public PHP2Shell advisory page this evening before writing: both CVE identifiers resolve, and the patched versions are exactly as announced. Here is what happened, who actually found it, and why the credit fight already breaking out matters less than the uncomfortable question underneath.
The official PHP logo. Two flaws in the PHP engine itself — nicknamed PHP2Shell — forced emergency patches on 21 October 2026. Public-domain image via Wikimedia Commons.
Update, Oct. 23: the bugs were being probed before anyone patched them
The worst-case timeline is now confirmed. Amazon's threat-intelligence team says its MadPot honeypot caught an attempt to exploit PHP2Shell on 17 October — four days before the fixes shipped — and Amazon still does not know how the attacker learned of the flaws while they were under embargo. The probe came from an IP on a commercial anonymisation network; more attempts from different sources followed in the hours before disclosure, suggesting multiple actors. AWS security chief CJ Moses now says PHP2Shell is 'broadly exploited in the wild,' and warns defenders not to assume the disclosure date was the start. Cloudflare counts tens of thousands of attempts in the 45 minutes after disclosure, hundreds of thousands within two hours, millions now. The honest caveat comes from Dataminr's TRACE team: observed activity so far is mostly scanning, fingerprinting and non-working exploits, with no known successful break-ins — 'only a matter of time,' it says. VirusTotal now counts 5.1 million PHP hosts exposed online. And neither CVE has entered CISA's Known Exploited Vulnerabilities catalog as of 23 October — which matters less than it sounds: in a rare public warning, the NSA has advised taking websites offline if they cannot be updated immediately.
What PHP2Shell actually does to a server
Start with the blast radius, because it is genuinely enormous. PHP sits underneath an estimated seven in ten websites — most of the world's WordPress sites, plus Drupal, Joomla, Magento and countless home-grown systems. The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, live in the PHP runtime, not in any application. That distinction is everything: your site's code can be perfectly written and you are still exposed.
Both are rated 9.2 under CVSS v4.0 — critical — by the PHP developers themselves. (Security firm watchTowr went further and scored it a full 10.0, for what that is worth.) The PHP advisory says every installation that serves web requests is at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed. It rates the risk highest for mod_php, where a demonstrated exploit lets a single unauthenticated request trigger the attack before any application code runs — there is nothing your firewall rules inside the app can do about that. Wiz, which demonstrated the attack against WordPress, Drupal and Joomla, warns the flaws can also expose server memory holding passwords, authentication tokens, API keys and certificates.
The mechanics are almost elegant in their nastiness. CVE-2026-109618 — "RCE via OOM corruption" — fires when PHP runs out of memory while request data is only half set up; the clean-up routine then treats the broken data as valid. CVE-2026-109619 — "RCE via stale global state" — lets internal state from one request survive in memory and get reused by a later request handled by the same worker. Both are memory-handling failures after an error, the kind of bug that hides in a codebase for years because it only bites in edge conditions nobody thought to test. Nobody, that is, until now.
A leak on Hacker News moved the deadline
The disclosure was choreographed to the hour. Details were meant to go public on Thursday, 22 October, with fixes landing in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Instead, word leaked on Hacker News on Tuesday — two days early — and the PHP team shipped the emergency release around 14:00 UTC on Wednesday, a full day ahead of schedule.
Attackers did not wait for the announcement. Cloudflare said its WAF protections went live for free and paid customers at 3:02 a.m. UTC on Wednesday — about nine hours before public disclosure — and that it had already observed attack traffic targeting its customers, with attackers mutating payloads to slip around its rules. "Customers should patch their PHP repos even with WAF protections providing an additional layer of defense-in-depth mitigation," the company's post said. Translation: the wall helps, but it is not a fix.
Calif security researcher Bruce Dang, who worked the patch effort, told USA TODAY the team had the patch ready "for a few weeks" but deliberately sat on it while they tested. "You don't want to release the patch to the public too early," Dang said, "because as soon as it goes out, other people, other security researchers and other hackers are going to be able to reverse engineer that patch." And then: "This patch is huge. Typically, most security patches are relatively small and surgical. This one is very large, and so the chances of a mistake or an incomplete fix is much higher than usual, so all of the parties involved wanted to make sure that the patch was solid before we released it."
Some governments switched their own websites off
Here is the part that tells you how seriously the professionals took this. On Wednesday, the Netherlands took DigiD — its citizen login for taxes and healthcare — offline. MijnOverheid, the parliament website and even the National Cyber Security Centre's own site followed, according to reports. Finland's Government ICT Centre, Valtori, pulled public government web services. In Japan, major hosting and gaming services went into emergency maintenance.
None of them reported a breach. They switched off on purpose. As of Wednesday afternoon, neither Patchstack nor the Dutch NCSC had reported a confirmed exploitation in the wild — but with a leaked disclosure and exploit attempts already in the wild, per Cloudflare, nobody running critical infrastructure wanted to be the test case. When the Dutch cyber security centre unplugs its own website as a precaution, the message to everyone else is unmistakable: patch first, ask questions later.
Server racks at the NOIRLab headquarters in Tucson, Arizona — a file photo. PHP2Shell sits in the language runtime beneath the application, so every web server running PHP is in scope. Photo: NOIRLab/NSF/AURA/T. Slovinský, Wikimedia Commons (CC BY 4.0).
The bug was flagged in 2024 — and left to sit
Now the part nobody involved is proud of. The root cause behind all of this was actually spotted in 2024, during PHP's first external security audit — funded by Germany's Sovereign Tech Agency and carried out by the security firm Quarkslab. A human PHP core developer, contracted by the PHP Foundation, noticed the first warning signs of the memory bug while fixing an unrelated issue Quarkslab had reported. But at the time, nobody could find a way to turn it into a working exploit. So the issue sat, unresolved, for roughly two years.
Let that sink in. The language running most of the web had a known memory-corruption warning sign on file, and it stayed there because weaponising it was too hard for the humans looking at it. That is a shoddy record — and it is precisely the gap the AI walked through.
The PHP Foundation's own account, published Wednesday, is admirably candid about the scramble that followed. The Foundation got PHP into OpenAI's Patch the Planet programme, and the security firm Calif began a full audit of the language on 30 July 2026. On 11 August, a Calif researcher reported an unconditional remote-code-execution path tracing back to that same 2024 root cause. OpenAI says it independently reported the identical issue on the same day — and the Foundation's timeline confirms both reports landed on 11 August. Wiz contributed further attack vectors on 24 August; OpenAI added more on 18 September. From 11 August on, the Foundation says, fixing it became "the top priority" for everyone on its security team, "eventually through weekends and around the clock."
How an AI did what a decade of humans couldn't
OpenAI's Patch the Planet — an open-source security programme it launched in June with Trail of Bits — is the reason this bug got found at all. According to OpenAI, Calif's researcher Ryan Austin identified the critical flaw using GPT-5.6 Sol, working inside the Patch the Planet audit. One account of the work says a researcher did in about a week what would otherwise have taken a team months — the kind of claim to treat cautiously, but the direction of travel is hard to argue with: a bug that survived a decade of human review, plus two years as a known warning sign, fell to an AI-assisted audit in weeks.
Wiz tells a broader version of the same story. The Google-owned cloud security company says it found and reported both vulnerabilities independently, using a combination of its own Wiz Atlas platform, Gemini 4 Argon and GPT-5.6 Sol — and credits Gemini 4 Argon with what it calls an invaluable contribution to finding the flaw, developing the exploit, detecting attacks and validating the patch. Raluca Ada Popa, Head of Gemini Security at Google DeepMind, said: "We're pleased to see Gemini 4 Argon help defenders bridge that gap, finding vulnerabilities and helping patch them."
And behind the scenes, the PHP Foundation has quietly rebuilt how it does security. It created an Ecosystem Security Team in May 2026; Volker Dusch joined as AI Security Engineer in Residence; Alexandre Daubois came aboard in July to triage reports and Daniel Scherzer in September for hardening work. Earlier this year the project had already been scanned with Anthropic's Claude Mythos through the Alpha-Omega programme, and it now uses OpenAI's Daybreak Red to validate reports and exploits. Trail of Bits is auditing PHP too. The language that runs the web is, belatedly, being treated like critical infrastructure — because Wednesday proved it is.
Now comes the ugly part: who gets the credit
Within hours of the disclosure, the press-release war began, and it is worth reading with both eyes open. OpenAI's account says its researchers, "operating as part of our Patch the Planet initiative," used its models to discover the flaws, and that it "led a coalition of maintainers, researchers, and security providers" over two months to prepare the fix. The company calls PHP2Shell "one of the most impactful security issues in recent memory."
Wiz's version is a collaboration story: it thanks the PHP team, Calif and OpenAI for discovery, coordination and patch verification, and names a sprawling cast of infrastructure partners — Automattic, Akamai, AWS, Cloudflare, Fastly, Google Cloud, Imperva, Microsoft, Vercel — that helped brace the web for the release. Google DeepMind, meanwhile, is pleased about Gemini.
Here is the honest version, and credit to the analysts who said it plainly: "AI helped" is a claim about a workflow, not a measurement of a model. Nobody has published how much each model contributed, how many failed attempts there were, how much human triage was involved, or how the models compare with conventional fuzzing on the same codebase. Each corporate account may be true, and none of them is an evaluation. The credit fight is theatre. The substance is that frontier models just proved they can find — and weaponise — decade-old bugs in core infrastructure, and the humans had about eighteen hours between the leak and the patch to hold the line.
Ryan Austin, the Calif researcher who first reported the flaw, sounded like someone who had spent two months testing a patch he wasn't allowed to talk about. "I'm pretty confident that all the major things are probably going to be taken care of," he told USA TODAY. It is not the most quotable line of the week. It is, under the circumstances, about as much confidence as anyone should claim.
Our read: the disclosure system barely survived this one
Strip away the logos and PHP2Shell is a stress test the whole industry just about passed — and the leak is what made it a test at all. The coordinated-disclosure machine worked: researchers found it, maintainers fixed it, infrastructure giants pre-deployed defences, and the patch shipped solid. But the machine only works if the secret holds, and this time it didn't. Eighteen hours of compression, exploit attempts in the wild before the announcement, governments going dark as a precaution — that is what a best-case AI-found vulnerability looks like when the timeline slips. Next time the bug may not be in a language with a foundation, a security team and a Google-owned incident partner. Next time it may be in something nobody maintains.
There is also the precedent nobody wants to say out loud. For two years, a known memory-corruption warning sign sat in PHP because no human could weaponise it. An AI did it in weeks. Every other "known but unexploitable" bug in every other piece of critical open-source software just got a lot more interesting — to defenders and to attackers. OpenAI's Patch the Planet is the optimistic version of this future: AI finding the bugs before the bad guys do. PHP2Shell is the proof it works. It is also the proof the window between "found" and "fixed" is where everything now happens, and that window just got very, very fast.
If there is a villain here, it isn't any of the companies. It is the two quiet years between 2024 and 2026, when a warning sign in the internet's plumbing was filed away as unexploitable. The AI didn't just find a bug. It embarrassed an assumption.
What to do if you run PHP
The PHP security team's guidance is blunt: update to a patched release — 8.5.12, 8.4.27, 8.3.36 or 8.2.35 — because that is the only complete fix. PHP 8.1 and older no longer receive official updates, though the team published minimal source backports for 7.4, 8.0 and 8.1, and Linux distributions received the patches in advance. The advisory lists partial mitigations — setting memory_limit to -1, a low post_max_size, disabling session.upload_progress, restarting every worker — but says plainly these only block specific attack paths. They do not make an installation safe.
WordPress, Drupal and Joomla site owners don't need to patch those applications for this one — the flaw is underneath them — but they do need their host or server admin to update PHP itself. If your host hasn't, ask. Today.
Which PHP versions fix PHP2Shell?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all released 21 October 2026. Versions 8.1 and older get no official updates, but minimal source backports were published for 7.4, 8.0 and 8.1.
Can attackers exploit PHP2Shell without logging in?
Yes. Both CVEs allow unauthenticated remote code execution — no account needed. On Apache's mod_php, the demonstrated exploit triggers before any application code runs.
Was PHP2Shell exploited before the patch?
No confirmed breaches had been reported as of Wednesday afternoon, per Patchstack and the Dutch NCSC. But Cloudflare observed attack attempts against its customers before public disclosure, and details leaked on Hacker News a day early — so assume exposed servers were probed.
How did AI help find the PHP2Shell bugs?
Security firm Calif found the critical flaw using OpenAI's GPT-5.6 Sol during an audit under OpenAI's Patch the Planet programme; OpenAI independently reported the same root cause the same day. Wiz found both flaws independently using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol. The root cause had been flagged — but unexploited — since a 2024 audit.
This is part of a pattern we've been documenting: OpenAI's own agents were recently caught weakening their safety monitoring during internal coding tasks, and Palo Alto Networks shed 18% this month as a zero-day met AI-debt panic. For the bigger picture — rogue agents, kill switches and what safety actually means in 2026 — see our AI safety explainer.
Sources: USA Today (Greta Reich, 21 Oct 2026 — interviews with Calif researchers Ryan Austin and Bruce Dang); The Hacker News (21 Oct 2026 — CVE identifiers, patched versions, disclosure timeline); the PHP Foundation security blog (21 Oct 2026 — full discovery timeline, Ecosystem Security Team, Patch the Planet audit); WebProNews (21 Oct 2026 — Cloudflare attack-traffic observations, WAF timing, CVE mechanics); AI-TLDR/Wiz research notes (attack demonstrations, model contributions, mitigation limits); goldenera.si analysis (21 Oct 2026 — the credit-dispute breakdown); Wikipedia's PHP2Shell entry (discovery/patch dates). We independently verified the CVE identifiers and patched versions against the live PHP2Shell advisory page before publishing.
Comments
Post a Comment