PHP2Shell: AI-Discovered PHP Flaws Open the Door to Unauthenticated Remote Code Execution

Emergency PHP Security Release

PHP released security updates on Wednesday, October 21, 2026, scheduled for 14:00 UTC. The updates fix multiple memory-safety vulnerabilities in the core PHP engine, the software at the heart of a huge share of the web.

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Each is rated 9.2 on the CVSS v4.0 scale.

The people closest to the project are treating this as a major event. Volker Dusch, a security engineer at the nonprofit that oversees PHP, reportedly called it the worst security problem the project has faced in more than 10 years. He also compared it to Heartbleed.

What the Vulnerabilities Allow

The flaws give attackers two serious capabilities:

• Unauthenticated remote code execution: an attacker can run code on a vulnerable server without logging in.
• Disclosure of process memory: leaked memory may contain passwords, authentication tokens, API keys and certificates.

The vulnerabilities sit in PHP itself, independent of the application running on top of it. A well-written application does not protect a server if the PHP runtime underneath is vulnerable.

According to Wiz, the flaws stem from how PHP handles fatal errors, particularly out-of-memory errors.

Scope and Affected Versions

Every PHP version released in the last decade, going back to PHP 5.4, is affected by at least one of the vulnerabilities. PHP is said to power about 70% of websites, so the potential exposure is very broad.

Wiz showed that the risk is not just theoretical. It demonstrated unauthenticated RCE on the latest container images of WordPress, Drupal and Joomla, three of the best-known PHP-based platforms.

PHP said the highest risk is for installations using Apache's mod_php.

Patches and Backports

The fixes are available in these releases:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

PHP 8.1 and older no longer receive project updates. Because of the severity of these flaws, the PHP security team provided minimal source backports for versions 7.4, 8.0 and 8.1.

How AI Helped Find and Exploit the Flaws

Frontier AI models helped researchers both find and exploit the vulnerabilities.

Wiz said it used three models:

• Wiz Atlas
• Google's Gemini 4 Argon
• OpenAI's GPT-5.6 Sol

Security firm Calif separately found the flaws using GPT-5.6 Sol, according to The Wall Street Journal. Calif's work was part of an OpenAI-funded audit.

Two independent teams reached the same bugs with AI help. That suggests these tools are becoming a real force in vulnerability research.

Global Response: Website Shutdowns and Government Guidance

Organisations moved quickly once the flaws became public.

Governments in Belgium, the Netherlands, Finland, France and Germany temporarily took websites down as a precaution. The Wikimedia Foundation also took several systems down until they could be patched.

Security agencies issued strong guidance:

• US NSA: told organisations using PHP to take systems offline if they could not patch immediately.
• UK NCSC: gave similar advice and told organisations to check for attacker-installed backdoors.

What Administrators Should Do Now

Based on guidance from the PHP project and government agencies, administrators should take these steps:

• Patch now. Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If you run 7.4, 8.0 or 8.1, apply the security team's minimal source backports.
• Start with mod_php. Patch installations using Apache's mod_php first, since PHP identified them as the highest risk.
• Follow NSA and NCSC advice. If you cannot patch a system immediately, take it offline. Check patched systems for backdoors an attacker may have installed.
• Rotate secrets. Process memory may have been exposed, so consider rotating passwords, authentication tokens, API keys and certificates.