AI found a 14-year-old PHP bug. Now attackers are using AI to exploit it

A bug that sat in PHP’s core for 14 years was found this summer by AI models. It leaked a day before its patch was ready. Within days, attackers were exploiting it, and in at least one break-in they used AI agents of their own.

The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, let an attacker run code on a web server without logging in. PHP rates both 9.2 out of 10 under CVSS v4.0.

That puts a big slice of the web in scope. PHP runs WordPress, Drupal and Joomla, and Wiz Research, one of the teams that found the bugs, puts PHP behind about 70% of websites.

PHP shipped emergency releases on October 21: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Its advisory is blunt that updating is the only complete fix and that its workarounds do not make a server safe.

What PHP2Shell does

Both bugs come from the same weak spot. When a request dies halfway through, PHP can leave half-finished data behind and later treat it as valid.

• CVE-2026-109618 triggers when PHP runs out of memory while storing incoming form data. It has already counted a new entry it never filled in, then reads that garbage during cleanup. Datadog’s researchers showed that an attacker who controls the leftover bytes can steer the cleanup into running a shell command.
• CVE-2026-109619 is a use-after-free. A PHP worker handles many requests in a row, and after a fatal error some state from one request can be freed without being cleared. The next request on that worker then uses it, which can leak memory and lead to code execution.

The dangerous part is timing. The malicious request is processed before any website code runs, so a login wall or a WordPress security plugin never gets a say.

PHP says every installation that serves web pages is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It ranks mod_php as the highest risk.

Found by AI, fixed eight weeks later

Wiz says it found the first bug on August 19 using Google’s Gemini 4 Argon, OpenAI’s GPT-5.6 Sol and its own Wiz Atlas system. It had working remote code execution against Drupal the next day and against WordPress the day after.

Wiz reported the flaws to PHP on August 24. PHP acknowledged them on September 21 and shipped fixes on October 21.

Wiz wasn’t alone. According to Decrypt, security firm Calif used GPT-5.6 Sol to find a limited version of the bug in August, and OpenAI’s own team found a fuller version in September. PHP credits Calif, OpenAI and Wiz.

The code path dates back to PHP 5.4, released in 2012. Wiz says frontier AI models sharply lowered the effort needed to turn that old flaw into a working exploit.

The leak that moved the patch up a day

On October 20, PHP warned admins that critical fixes would land on October 21 at 14:00 UTC. The same day, the CVE numbers were already circulating online.

watchTowr told BleepingComputer the flaws had been under embargo until October 22 and that details had leaked. A now-deleted Hacker News post claimed both bugs scored a perfect 10.0. The PHP Foundation later called that score incorrect and said it brought the release forward a day because of the leak.

Attackers may have been ahead of everyone. Amazon Threat Intelligence says it logged a PHP2Shell exploitation attempt against its MadPot honeypot on October 17, four days before disclosure, and it recommends starting any investigation from that date.

Attacks started almost at once

Cloudflare said on October 21 that it was already seeing early attacks. It pushed temporary firewall rules to every customer, free plans included, while stressing that they don’t replace the patch.

Palo Alto Networks’ Unit 42 described one of the first serious break-ins. After exploiting a European government entity, the attacker used an agentic AI attack platform. Within two hours it had password hashes and multi-factor authentication secrets, had tunnelled into Active Directory and was trying for Domain Admin rights.

Governments reacted fast. Decrypt reported that Finland, the Netherlands and France took government websites offline on October 21. The UK’s National Cyber Security Centre told organizations to update immediately or take affected systems offline, and CISA gave the same advice for anyone still on PHP 8.1 or older.

Nobody agrees on how many servers are exposed, because each count measures something different:

• 2.24 million internet-facing hosts advertise PHP, per Shodan counts cited by CybelAngel. Of those that show a version, 59% run a branch with no official fix.
• 5.1 million exposed PHP hosts, by VirusTotal’s estimate.
• 22.6 million potentially vulnerable instances, according to Palo Alto Networks’ Cortex Xpanse.

Which PHP versions are affected

Every PHP release from 5.4 to 8.5.11 is vulnerable. Only four branches got an official fix.

PHP branch	Status (October 2026)	What to do
8.5	Fixed in 8.5.12	Update now
8.4	Fixed in 8.4.27	Update now
8.3	Fixed in 8.3.36	Update now
8.2	Fixed in 8.2.35	Update now; 8.2 reaches end of life on December 31, 2026
7.4, 8.0, 8.1	No official release; PHP published source backports	Use your distribution’s patched package, or move to 8.2 or newer
5.4 to 7.3	End of life; no fix from PHP	Upgrade, or take the site offline until you can

How to check your site is patched

The version number alone can mislead you. Linux distributions got the fixes in advance and often backport them without changing the version, so an “old” number may already be safe and a new-looking one may not be.

On shared or managed hosting, including most WordPress sites:

1. In WordPress, go to Tools > Site Health > Info and open the Server section to see your PHP version.
2. If it’s below the fixed version for its branch, or on 8.1 or older, check your host’s status page or ask support directly whether the PHP2Shell patches are applied.
3. If your host can’t confirm a fix and you’re on PHP 8.1 or older, switch to PHP 8.2 or newer in your hosting control panel. Test the site afterwards, since older themes and plugins can break.

On your own server or VPS:

1. Check the PHP that serves web pages, not just the command-line one. php -v shows the CLI version, which can differ from PHP-FPM or mod_php.
2. Confirm the fix in your package changelog. Google’s example for RPM systems is rpm -q --changelog php-fpm | grep -E "CVE-2026-109618|CVE-2026-109619". On Debian or Ubuntu, apt changelog on your PHP-FPM package does the same job.
3. Restart every PHP worker after updating. New files on disk do nothing while old workers keep running, so restart PHP-FPM, Apache or your web server, and rebuild any container images.
4. If you can’t patch today, apply PHP’s interim settings in php.ini or your FPM pool, then restart: session.upload_progress.enabled=0, memory_limit=-1 set so applications can’t override it, and post_max_size of 8M (32M if you need uploads). On PHP 8.5, also set fatal_error_backtraces=0. PHP says these reduce the risk but don’t remove it.
5. Look for signs you were hit. Datadog suggests watching for “Allowed memory size exhausted” errors that point to “Unknown on line 0”, Apache segfaults, and above all a web worker starting a shell. Go back to at least October 17.

A third bug, but a much smaller one

On October 23, PHP disclosed CVE-2026-115560, a possible code execution bug that the October 21 releases don’t fix. It only affects sites that switch PHP’s session serializer at runtime in a specific way, which PHP calls unusual.

The fix will come in the next routine release. Until then, the same session.upload_progress.enabled=0 setting covers it, so anyone who already applied that mitigation needs to do nothing more.

The bigger picture

The bug survived 14 years of human review. AI models found it in a summer, and the patch took eight weeks to ship. Attackers, some with AI tools of their own, needed only hours once the details were out.

If you run a PHP site, the fix is boring and quick: confirm your PHP version is patched, restart the workers and check your logs back to October 17.

Sources

• PHP: Security advisory, critical remote code execution vulnerabilities (October 21, 2026)
• PHP: Informational advisory on session upload progress (CVE-2026-115560) (October 23, 2026)
• Wiz Research: PHP2Shell write-up and disclosure timeline
• BleepingComputer: PHP warns admins of two critical flaws (October 20, 2026)
• BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws (October 21, 2026)
• Tenable: PHP2Shell FAQ
• Unit 42: Threat brief on CVE-2026-109618 and CVE-2026-109619 (updated October 23, 2026)
• Datadog Security Labs: PHP2Shell detection and analysis
• Google Cloud: Responding to the core PHP vulnerabilities
• Decrypt: Who found the PHP bug
• CybelAngel: 2.24M internet-facing PHP hosts
• The Hacker News: PHP warns of another RCE risk