Tech · Explainer
PHP2Shell: the AI-found flaw that put most of the web on emergency patch duty
On October 21, 2026, the PHP project shipped emergency security updates for two critical vulnerabilities — tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed "PHP2Shell" — that let an attacker run code on a web server with a single crafted request and no login. According to The Hacker News, both flaws are rated 9.2 out of 10 on the CVSS v4.0 severity scale, and they affect nearly every PHP version going back to PHP 5.4, released in 2012.
First: what PHP is, and why this is huge
PHP is the server-side programming language behind a huge share of the web — WordPress, Drupal, Magento, Joomla, Laravel, Symfony and millions of custom sites all run on it. The Geneva-based digital-policy observatory dig.watch reports it powers around 70% of websites whose server-side language is known. That is why a flaw in PHP itself, rather than in any one app, is an internet-scale event.
What the two flaws actually do
Both bugs sit in PHP's memory handling, in parts of the language that nearly every web request touches, as the PHP security advisory (reported by WebProNews) describes:
- CVE-2026-109618 — improper exception handling: triggered when an out-of-memory condition interrupts PHP before request data is fully initialized; cleanup routines processing that invalid state open a path to remote code execution.
- CVE-2026-109619 — use after free: internal state from one request survives into a later request handled by the same worker, and a later request touching that stale memory triggers execution.
Crucially, the flaws are in the PHP runtime, not in any application — a site is exposed even when its own code is perfectly secure. The Hacker News notes the risk is highest on servers using Apache's mod_php, where a working exploit triggers the attack before any application code runs.
What got patched — and what didn't
The fixes landed on October 21 at around 2 PM UTC as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, per The Hacker News — a day ahead of the planned disclosure, because basic details leaked on social media on October 20. dig.watch reports that researchers at the security firm Calif then mistakenly published a video showing how the flaws could be exploited, which spread across hacking forums.
PHP 8.1 and earlier get no official fix — they're past end of life — though dig.watch notes some Linux distributions have issued their own patches. Security trackers estimate roughly half of PHP sites still run 8.1 or older, so the "zombie PHP" tail will stay exposed.
The twist: an AI found it
PHP Foundation researchers had identified a theoretical flaw in 2024 but couldn't work out how it might be exploited, dig.watch reports. The breakthrough came after the foundation joined OpenAI's "Patch the Planet" initiative in July 2026: researchers at the security firm Calif reported the first flaw on August 11 using OpenAI's GPT-5.6 "Sol" model, and Wiz, the Alphabet-owned security firm, reported the second on August 24 using models including Google's Gemini 4 "Argon". Wiz called it the most severe vulnerability ever found by AI.
The fallout: governments went dark
Because the details leaked before the patch, attackers had a head start: Cloudflare said it observed attack traffic targeting its customers and put WAF protections live about nine hours ahead of public disclosure. Governments took precautionary action — Reuters reports South Korea raised its private-sector cybersecurity alert level and activated emergency response measures on October 22, with the presidential National Security Office convening an emergency meeting. Per dig.watch, France's prefecture websites, Germany's digital ministry, the Dutch parliament, Finland's central government, and in the UK the Office for Budget Responsibility and NHS Scotland took sites offline while patching. The US National Security Agency issued a rare public warning advising that websites be taken offline if they cannot be updated immediately, and the UK's National Cyber Security Centre gave similar advice.
What to do
If you run a website: update PHP itself to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (whichever line you're on) — the PHP project says only the runtime update fully protects a server. Updating WordPress or its plugins does not fix this; the bug sits below the CMS, so check the PHP version your host actually runs and ask them, in writing, whether the PHP2Shell fix is installed, WebProNews' reading of the advisory urges. If you can't patch immediately, follow the NSA's advice and take the site offline rather than leaving it exposed.
If you just browse the web: there's nothing to install — this one belongs to whoever runs each site's server. You can check php.net for the official release notes as the situation develops.
Sources: dig.watch (emergency-patch timeline, AI discovery via OpenAI's Patch the Planet and Wiz, government responses, the leaked demo video); The Hacker News (CVSS 9.2 ratings, fixed versions, PHP 5.4 exposure, mod_php risk); WebProNews (advisory details, Cloudflare's early WAF rules, patching guidance); Reuters (South Korea's emergency response, October 22); Tenable's FAQ (Security Boulevard) (CVE details, patch versions, end-of-life guidance). Flaw mechanics and severity as reported at publication; the exploit situation is still developing.