PHP2Shell: AI Found the Bug Behind 70% of the Web

PHP2Shell is two critical remote-code-execution flaws (CVE-2026-109618 and CVE-2026-109619) in PHP itself, rated 9.2 out of 10 on CVSS v4, patched on October 21, 2026. Every PHP release from 5.4 to 8.5 that serves web requests is affected, which means the flaw reaches into the infrastructure behind an estimated seven in ten websites (the researchers' own figure, via SecurityWeek and CNN), and it was found with the help of frontier AI models.

Two CVEs, one emergency patch day, and a flaw that sat in PHP for years before AI turned it into a working exploit. Graphic: ByteHerald.

The two bugs, in plain terms

PHP2Shell is a bug in the language runtime underneath the apps, so a site can be exposed even when its own code is secure. Both flaws come from the same root cause: PHP can leave its memory in a corrupted state when a request ends abnormally, and an attacker can exploit that to run code with the web worker's privileges.

CVE-2026-109618 (RCE via out-of-memory corruption) triggers when PHP runs out of memory mid-request: the half-set-up request data is treated as valid during cleanup, and the attacker shapes that corruption into code execution. CVE-2026-109619 (RCE via stale global state) lets state from one request outlive its memory and be reused by a later one, enabling unauthenticated heap use-after-free, memory disclosure, and code execution. The memory disclosure angle matters on its own: Wiz's technical write-up warns the flaws can expose server memory holding passwords, authentication tokens, API keys, and certificates.

The PHP security team says every installation serving web requests is at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. It rates the risk highest for mod_php, where a demonstrated exploit fires from a single unauthenticated request before any application code runs. No complete exploit has yet been shown against PHP-FPM, according to the disclosure-day reporting.

The ledger: from July research to October 21 patch

The discovery story is the real original contribution here, and the timeline is worth laying out precisely, because it is the first internet-wide emergency where frontier AI did the exploit work.

The find-to-fix timeline of PHP2Shell. Chart: ByteHerald original; dates from OpenAI, Wiz, the PHP security team, and press reporting.

Wiz's summary of the AI role is the number to remember: a single researcher completed in a week what previously would have taken a world-class team months of work. Wiz calls the underlying flaws "among the most severe vulnerabilities discovered in PHP, and arguably in software history," with the exploit chain sitting, in their words, at the edge of what human researchers could practically achieve. OpenAI called the flaws one of the most impactful security issues in recent memory.

Why it sat unpatched for years

The 2020 and 2024 misses are the uncomfortable part. This type of bug had been identified as an area of concern for years, a PHP core developer found the out-of-memory weakness during a 2024 audit, and the development team could not reach consensus on how to fix it. Since no specific exploit had been demonstrated, the work stalled.

That is exactly the dynamic frontier AI broke. The OOM weakness could be analyzed and turned into RCE because the models could hold the exceptionally complex chain of memory-corruption steps together. The fix only became the top priority of the PHP Foundation's security team from August 11 onward, once the full impact was clear. The lesson for defenders is blunt: "we could not demonstrate an exploit" is no longer a comfort, because the exploitability analysis itself is now automatable.

What to do now: the patch math

Patching is the only complete fix. Cloudflare, which has been working with the PHP Foundation, Calif, OpenAI, and Wiz, says it has already observed exploit attempts including spikes of thousands of attempts, with attackers modifying tactics to try to bypass protections. Its WAF rules are a stopgap, not a substitute. The NSA's Cybersecurity Collaboration Center advised organizations that cannot patch immediately to take affected systems offline, and some European government websites did go offline while patching, according to Reuters.

The patch versions and branch guidance are from the PHP security team's October 21 advisory, as reported by BleepingComputer. If you run Apache with mod_php, you are first in line: the demonstrated exploit triggers there before application code runs. WAF coverage from Cloudflare and others buys time for the patching window; it does not close the underlying memory corruption.

The evergreen part: how a language-level flaw becomes an internet emergency

PHP2Shell is a textbook case of why language-level flaws are the worst kind of internet emergency, and the pattern will repeat. The mechanism has three properties. First, the blast radius is the whole installed base of the runtime, not the users of one app: PHP powers an estimated seven in ten websites through WordPress, Drupal, MediaWiki, and countless home-grown sites, so one flaw is everybody's flaw. Second, the patch math is slow because the web is full of forgotten servers: PHP 7.x branches no longer receive updates from the project, and every one of them is vulnerable to at least one of the two flaws, which means a large tail of the internet cannot be patched through normal channels at all. Third, disclosure is now a race against AI-accelerated offense: the PHP Foundation notes that AI has surfaced more PHP vulnerabilities than before, with 15 new CVEs published since July 1.

That third property is the one that changes strategy. When finding complex exploit chains costs a week of AI-assisted research instead of months of world-class team time, "no known exploit" stops being a severity input. Our standing reading of the year in security is assume breach: the 2026 catalog of incidents, and PHP2Shell slots straight into its thesis. The defenders who win from here patch the runtime first and argue about the application later.

By ByteHerald Staff. CVE identifiers, patch versions, and SAPI risk ranking from the PHP security team's October 21 advisory via BleepingComputer and The Hacker News; discovery details from Wiz's technical write-up, OpenAI's statements via USA Today and CNN; Cloudflare observations via USA Today; watchTowr's 10.0 rating and the 2020/2024 history via background reporting. The chart is ByteHerald's original compilation.