PHP2Shell: The AI-Hunted PHP Bugs That Put the Web on Emergency Patch Alert

In a week that will be remembered as one of the most chaotic in recent open-source security history, the PHP project rushed out emergency security releases on October 21 to fix two critical vulnerabilities lurking in the very engine that powers a huge share of the web. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively nicknamed PHP2Shell, both carry a CVSS severity score of 9.2 and allow unauthenticated remote code execution — meaning an attacker can run malicious code on a vulnerable server without ever logging in.

What makes the story remarkable is not just the severity of the bugs, but how they were found: through coordinated, AI-assisted security research involving Wiz Research, OpenAI, and independent researchers, with AI models helping demonstrate practical exploitation and supporting a coordinated disclosure with PHP's maintainers.

Bugs in the Engine, Not the Apps

Unlike most web vulnerabilities, PHP2Shell does not live in a specific application, framework, or plugin. The flaws sit in PHP's core memory management and error handling. That means WordPress, Joomla, Drupal, Magento, Laravel, WooCommerce — any stack running an unpatched PHP runtime — could be exposed, even if the application code itself is spotless.

The first flaw (CVE-2026-109618) exploits corruption tied to out-of-memory handling, while the second (CVE-2026-109619) abuses stale global state to achieve code execution. Depending on deployment and configuration, successful exploitation can hand attackers the permissions of the PHP service, potentially exposing passwords, authentication tokens, and API keys held in process memory. Affected versions reportedly reach back as far as PHP 5.4.

A Leak That Compressed the Clock

The disclosure timeline was anything but smooth. Researchers first reported the underlying issues in August, and PHP's security team began developing a coordinated fix in September. The plan was to publish patches on October 22. But on October 20, the CVE identifiers leaked on Hacker News and social media, accompanied by incorrect claims of a perfect 10.0 CVSS score. PHP moved its emergency release up a day, shipping fixes on October 21 at 14:00 UTC.

That leak had real consequences. AWS reported identifying exploitation attempts in its MadPot honeypot telemetry before public disclosure — evidence that attackers were probing four days early. Once the patches landed, proof-of-concept exploits began circulating quickly, and attack attempts ballooned into the millions on major networks like Cloudflare within a day. Security vendors caution that attempted exploitation is not the same as confirmed breaches, but the sheer volume has rattled hosting providers and government agencies alike, with some European public-sector sites reportedly taken offline as a precaution while patches were applied.

Patch Now — And Restart

The remediation path is clear but demands urgency. The first fixed releases are:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Administrators running earlier releases within those branches should update immediately. Crucially, applying the patch is not enough on its own: PHP-FPM or Apache must be restarted afterward, or the old, vulnerable code keeps running in memory. Organizations still on PHP 8.1 or older have no official fix available — those branches no longer receive standard security releases — so upgrading to a supported, patched version should be the top priority, or owners must confirm with their distribution or hosting vendor that a backported update covers both vulnerabilities.

Security teams are also advised to hunt for signs of follow-on compromise: since the bugs can expose credentials in process memory, any affected deployment should rotate API keys, database passwords, and tokens after patching.

The Bigger Story: AI on Both Sides

Beyond the immediate patching scramble, PHP2Shell is a landmark moment for AI in cybersecurity — and a double-edged one. On the defensive side, AI-assisted research accelerated the discovery and demonstration of the flaws, enabling a coordinated fix rather than a zero-day free-for-all. On the offensive side, the same class of tooling lowers the barrier to finding and weaponizing memory-corruption bugs, and the pre-disclosure probing observed by AWS suggests sophisticated attackers are not waiting for CVEs to hit the news.

For years, security professionals have debated whether AI would fundamentally change vulnerability research. This week offered the clearest evidence yet that it has — and that the patch-and-pray era is over. Organizations that treat runtime dependencies like PHP as critical attack surface, with automated patch pipelines and rapid restart procedures, weathered the storm. Everyone else spent the week scrambling.

The lesson for the wider tech community is straightforward: the infrastructure under the web is aging, the tooling to break it is improving fast, and the window between disclosure and mass exploitation is now measured in hours, not weeks. Patch early, restart everything, and expect the next PHP2Shell to arrive with even less warning.