On Wednesday, October 21, 2026, the maintainers of PHP — the programming language running under a huge share of the world's websites — shipped an emergency update. Not a routine bug fix: a rushed, one-day-early release for two critical vulnerabilities that had been leaking onto the internet hours before. The story behind them is as striking as the flaws themselves: the bugs hid in PHP's engine for over a decade, and it took artificial intelligence to find them — and turn them into working exploits.
Here is what happened, in plain language.
What is PHP2Shell?
PHP2Shell is the nickname security researchers gave to two vulnerabilities in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a severity rating of 9.2 out of 10 (CVSS v4.0, the industry's standard scoring system) — one step below the maximum.
The dangerous part is what an attacker needs to exploit them: nothing. No account, no password, no login. A specially crafted web request can make an unpatched PHP server run the attacker's code — a technique called unauthenticated remote code execution (RCE). From there, the attacker can read databases, alter or delete files, or take over the whole server.
What makes this different from the usual website vulnerability is where the bugs live. They are in the PHP engine — the software that executes every PHP request — not in a WordPress plugin or an app's own code. That means even a website with perfect code can be exposed if the PHP running underneath it is outdated. As security firm Tenable put it, the PHP security team confirms that "all PHP installations serving web requests" are at risk, including PHP-FPM, Apache's mod_php, php-cgi, FrankenPHP and LiteSpeed.
The two flaws share a root cause but work differently:
| CVE-2026-109618 | CVE-2026-109619 | |
|---|---|---|
| Nickname | RCE via OOM corruption | RCE via stale global state |
| Root cause | An out-of-memory error interrupts PHP while request data is only partly set up; cleanup then treats the broken data as valid | Leftover data from one visitor's request survives in memory, and a later request handled by the same worker can pick it up |
| How it triggers | During multipart form-data parsing (file uploads) while staying within normal limits | Needs two requests in sequence, the second landing on the same server worker |
| Versions affected | Every PHP release back to PHP 5.4 (2012) | Every PHP release back to PHP 5.4 (2012) |
A demonstration exploit that leaked before the patch showed the attack working against WordPress, MediaWiki, phpBB, Magento, Joomla, Laravel, Symfony, Drupal and WHMCS. The risk is highest for servers running Apache's mod_php, where PHP says a demonstrated exploit fires before any application code runs — bypassing login screens and security plugins entirely.
Why this one rattled the whole internet
Most website flaws affect one app or one plugin. This one affects the foundation. According to W3Techs, which surveys over 20 million websites, PHP runs on about 69–72% of websites whose server-side language can be detected — roughly seven in ten sites. WordPress alone, a PHP application, powers about 43% of all websites.
When a flaw sits in the engine itself, patching gets complicated:
- Only supported versions get official fixes. The emergency releases — PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — cover PHP 8.2 and newer. For end-of-life branches (7.4 through 8.1), the PHP team published source backports, but administrators must compile them themselves; no ready-made binaries are coming.
- Millions of sites run old PHP. Security scanner company Censys found that about 1.5 million of 2.6 million hosts it checked were running an unpatched PHP version shortly after disclosure.
- Some people never think of themselves as PHP admins. As one expert quoted in reporting put it, many people responsible for systems that run PHP don't think of PHP as something they administer — it just sits quietly under their website or control panel.
The response was global and immediate. The U.S. CISA, Canada's Cyber Centre, the UK's National Cyber Security Centre and the EU's CERT-EU all issued alerts. Japan's prime minister publicly urged website operators to apply patches the same night. Several European governments and Japanese services took websites offline rather than wait, and Australia's cyber security agency noted some sites were temporarily unavailable.
How AI found a decade-old bug — and weaponized it
This is the part that made headlines beyond the security world. The vulnerabilities were found with the help of AI models, not by a human reading source code line by line.
Two independent efforts converged on the same bugs, weeks apart:
- Calif, a security firm working inside OpenAI's "Patch the Planet" program, identified the flaws using OpenAI's GPT-5.6 Sol model.
- Wiz Research (Sagi Tzadik, Shir Tamari, Nir Ohfeld and Tomer Schwartz) independently discovered and reported both vulnerabilities, with OpenAI's Codex Security team also involved.
- Reports also credit Google's Gemini 4 Argon model in the verification work.
Neither team set out to audit PHP. Both pointed AI at large codebases; both surfaced bugs that had been sitting there for more than a decade.
Crucially, the AI didn't just spot the bugs — it helped turn them into working exploits. One researcher reportedly did in about a week what would otherwise have taken a team months. That is the "good and bad news" of AI-assisted security research: the same capability that finds bugs before attackers do can also arm attackers faster than ever. Cloudflare's CTO reported early attack attempts emerging nearly six hours before the patches were even published, and watchTowr reported exploitation attempts against both vulnerabilities — Cloudflare rolled out emergency firewall rules as a stopgap while the world patched.
What the experts say
Monash University's Faculty of Information Technology published expert commentary on October 22, 2026, and the quotes capture both sides of the story:
Professor Rashina Hoda explained the scale with an analogy: "One way to think of this incident is to consider a hotel with advanced security measures such as security cameras, guards, locks, etc. However, imagine that the software used by the hotel front check-in desk has a glitch whereby strangers or bad actors can access keys. This exposes the hotel to risks even though all other security measures are still in place."
She also flagged a second-order risk worth remembering: "We also need to watch out for a possible surge in scams and phishing attacks at this time that pretend to be securing our information in the wake of this incident." If you want to brush up on the basics of protecting yourself, our guide to cybersecurity basics everyone should know covers the fundamentals.
On the AI angle, Professor Hoda was direct: "The fact that these vulnerabilities were discovered by frontier AI is good and bad news. Good news because it shows how agents can help discover critical vulnerabilities that may have escaped human eyes for decades. Bad news because hackers can use their own AI agents to exploit these vulnerabilities at speeds and at a scale typically not possible without agents."
Professor Yang Xiang added a calmer note about the disruption: "The Australian government has indicated that some websites were temporarily unavailable. This disruption is necessary and does not mean that the systems were breached or that information was stolen. We can see that a race to protect websites is happening worldwide."
This dual role of AI — saviour and threat at once — is exactly what makes the technology so consequential. For a deeper look at why even its creators are sounding alarms, read Bill Gates' AI warning, explained: the most dangerous technology ever.
What to do now
The PHP team is blunt: updating is the only safe choice. There is no complete workaround.
- If you run a website: check your PHP version today. If it is 8.2 or newer, update to the fixed release (8.5.12, 8.4.27, 8.3.36 or 8.2.35). If it is 8.1 or older, you need to upgrade the PHP version itself — those branches receive no official binaries. Many people on shared hosting can check and change their PHP version from their hosting control panel; if you are unsure, ask your host. Note that updating WordPress is not enough — the PHP version on the server must be updated separately.
- A partial bandage exists, but it is not a fix. Turning off the
session.upload_progress.enabledsetting in PHP's configuration blocks the known attack path for one of the two flaws, but PHP says it does nothing for the other. PHP core developers warn that patching is the only real defense. - If you truly cannot patch right now, the UK's NCSC advises considering taking the system offline until it can be fixed — because with unauthenticated RCE, there is no safe middle ground.
- After patching, check for signs of an earlier break-in, such as unexplained server errors, unusual file changes or workers restarting for no clear reason. The exploit details circulated publicly before the patch existed.
Takeaway checklist
- The facts: Two critical PHP engine flaws — CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell — rated 9.2/10, allow attackers to run code on unpatched servers without logging in.
- The scale: PHP powers roughly 70% of detectable websites; the bugs affect every version back to PHP 5.4, and ~1.5 million of 2.6 million scanned hosts were still unpatched at disclosure.
- The discovery: Found independently by Calif (using OpenAI's GPT-5.6 Sol) and Wiz, with AI turning decade-old bugs into working exploits in about a week.
- The fix: Emergency patches released October 21, 2026 — PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35. Older branches get source backports only.
- Your move: If you run a website, update PHP now; if your host manages it, confirm they have. Disabling
session.upload_progressis only a partial stopgap. Expect phishing scams piggybacking on the news. - The bigger picture: AI can now find internet-scale bugs faster than humans — which means defenders must patch faster than attackers can weaponize. That race is the new normal.
