PHP2Shell: AI-Found Flaws Force an Urgent PHP Update

The PHP project has shipped emergency releases for two critical flaws in the language that runs most of the web’s server-side code, and the bugs were found with heavy help from AI. Wiz, the cloud security firm Google bought, named the pair PHP2Shell on 21 October and showed unauthenticated remote code execution against the latest container images of WordPress, Drupal and Joomla. The same day the NSA’s cybersecurity directorate warned that any site which cannot be patched immediately should be taken offline until it can be. PHP is used by about seven in ten websites whose server language is known.

The two bugs are CVE-2026-109618 and CVE-2026-109619, rated up to 9.2 on the CVSS scale. Both are memory-safety errors in what PHP does after a fatal error, especially running out of memory mid-request. The PHP Foundation’s write-up explains the first: if a request hits its memory limit at the wrong moment, PHP can treat half-built data as valid. In the second, a fatal error leaves internal state pointing at memory from an earlier request, a use-after-free that the next request can trip. Wiz says even a bare “Hello World” script on an affected version can be exposed, and that a separate memory-disclosure path works without code execution at all. Nearly every version back to PHP 5.4 is affected, and Wiz says every release of the past decade carries at least one of the bugs. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; versions 8.1 and older are out of support and need an upgrade, not a patch.

Three teams, three sets of models

The bugs were found more than once. Calif, a security testing firm auditing PHP under OpenAI’s Patch the Planet programme, reported the out-of-memory flaw on 11 August using GPT-5.6 Sol, and OpenAI reported the same root cause that day, adding further attack paths on 18 September. Wiz found its first bug on 19 August using its Wiz Atlas agent with Google’s Gemini 4 Argon and GPT-5.6 Sol, and had working takeovers of Drupal and WordPress within two days. Wiz credits the models with more than the hunting: Argon also helped write the exploit, build detection and check the patch, and Wiz says a single researcher did in a week what once took a top team months. Raluca Ada Popa, who leads Gemini security at Google DeepMind, said the company was pleased to see Argon help defenders “bridge that gap”.

The defenders use AI too. The PHP Foundation says Alpha-Omega had PHP scanned with Anthropic’s Claude Mythos earlier in the year, and the security team now checks incoming reports and exploits with OpenAI’s Daybreak Red, while a person makes every decision and writes every patch. The volume is the problem: since 1 July the team has published 15 CVEs and turned away more than 100 reports that were invalid, duplicates or could not be reproduced. The Foundation is unusually blunt about the two months between Wiz’s report on 24 August and its acknowledgement on 21 September, calling the delay “a structural failure” of its decision process and resources, and is changing how its security team votes and asking companies and governments for funding.

OpenAI says the researchers got there before attackers did and, according to TechCrunch, there are no reports of exploitation in the wild. That window is closing. Wiz warns that the hard part of these bugs, adapting an exploit to each PHP version, configuration and memory layout, is exactly the work language models now do well. Cloudflare, Fastly, Google and Vercel have published stopgap mitigations, but Wiz and the Foundation agree the update is the only complete fix, and WordPress has told site owners the flaw sits in their servers, not in WordPress, so the patch is their host’s job. The signs to watch for in logs are odd multipart uploads followed by memory-limit errors, bursts of HTTP 500s, oversized PHPSESSID cookies and PHP workers dying for no clear reason. The uncomfortable part is the symmetry: the models that found PHP2Shell are available to anyone with a target list.