Two critical security vulnerabilities in PHP have put website operators, hosting providers, and cybersecurity teams on high alert. The flaws, known collectively as PHP2Shell, affect PHP’s core runtime and could allow attackers to execute malicious code remotely without authentication under vulnerable configurations. Researchers used artificial intelligence tools to help identify and investigate the vulnerabilities, demonstrating how AI is changing the way security weaknesses are discovered and addressed.
The PHP development team released emergency security updates on October 21, 2026, after the vulnerabilities were disclosed. The flaws carry a severity score of 9.2 out of 10 and affect a technology used by a substantial share of websites worldwide. Government cybersecurity agencies have urged organizations to inventory their PHP deployments, install the relevant fixes, and isolate vulnerable internet-facing systems when immediate patching is not possible. The incident also raises concerns that attackers could use AI to accelerate the discovery and exploitation of similar flaws in widely deployed software.
Key Takeaways
- Two critical vulnerabilities: PHP2Shell comprises CVE-2026-109618 and CVE-2026-109619.
- Severity score: Both vulnerabilities carry a CVSS v4.0 score of 9.2 out of 10.
- AI-assisted discovery: Security researchers used AI models to help identify, investigate, and validate the flaws.
- Potential remote code execution: Under vulnerable conditions, attackers may execute code on affected servers without logging in.
- Emergency patches released: Fixed PHP versions include 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
- Older versions need special attention: PHP 8.1 and earlier are no longer supported upstream, so administrators must check vendor-specific fixes or upgrade.
- Urgent action required: Organizations should prioritize internet-facing systems and isolate vulnerable services if they cannot mitigate the risk promptly.
What Happened in the PHP2Shell Security Incident?
PHP is a server-side programming language used to build dynamic websites, process requests, connect to databases, and run application logic. It supports a large portion of the web, including sites built with WordPress, Drupal, Joomla, and other content management systems.
The PHP2Shell incident involves two flaws in the language’s core runtime rather than a vulnerability limited to one website or plugin. That distinction makes the issue particularly significant: a weakness in a widely deployed runtime can affect many different applications and hosting environments at once.
According to reporting by Analytics India Magazine, Calif, a security research firm working with OpenAI, reported an initial vulnerability to PHP maintainers in August 2026. Later that month, cybersecurity company Wiz independently discovered additional vulnerabilities using AI models from Google and OpenAI.
The PHP team subsequently released fixes on October 21, following a disclosure process that was brought forward after the vulnerability identifiers became public.
The vulnerabilities can affect multiple PHP execution environments, including PHP-FPM, Apache’s mod_php, php-cgi, FrankenPHP, and LiteSpeed. Exposure depends on the specific vulnerability, PHP version, configuration, and deployment environment.
What Are the Two Critical PHP Vulnerabilities?
The vulnerabilities affect how PHP manages memory and internal state while processing requests. Both can create unsafe conditions that researchers demonstrated could lead to serious security consequences.
| Vulnerability | Core issue | Potential consequence |
|---|---|---|
| CVE-2026-109618 | Unsafe handling of out-of-memory errors and partially initialized request data | Memory corruption and potential remote code execution |
| CVE-2026-109619 | Request-specific internal state can retain references to memory that has already been freed | Memory corruption, potential information disclosure, and remote code execution |
CVE-2026-109618: Out-of-memory handling
Software must manage memory carefully when processing requests. If a program runs out of memory, it needs to stop the affected operation and clean up safely.
The first vulnerability involves an error-handling path in which PHP can be interrupted while internal request data is only partially initialized. Subsequent cleanup operations may then treat invalid or incomplete data as if it were valid.
Under certain conditions, this unsafe handling can lead to memory corruption and remote code execution.
CVE-2026-109619: Stale internal state
The second vulnerability involves references to request-specific memory that may remain in PHP’s internal state after the underlying memory has been released.
If a later request encounters these stale references before the state is properly reset, the runtime may access memory that should no longer be used.
This type of weakness is commonly associated with use-after-free errors. Depending on the conditions, it can expose sensitive information or create a path to remote code execution.
The two vulnerabilities are separate flaws, even though both involve unsafe memory handling. Fixing one should not be treated as a substitute for installing the full security updates.
How AI Helped Researchers Find the Flaws
The incident illustrates how AI models are increasingly being used in vulnerability research. Rather than relying exclusively on manual code review, researchers can use AI to examine complicated code paths, identify suspicious behavior, reason about memory-management errors, and help investigate whether a potential weakness is exploitable.
According to the published reporting, Calif used an OpenAI model to identify an initial PHP flaw, while Wiz subsequently found additional vulnerabilities using models from Google and OpenAI. Google Cloud also reported that Gemini 4 Argon contributed to finding the vulnerabilities, exploit development, attack detection, and validation of the patch.
AI assistance does not mean a model independently completed every stage of the research. Human researchers still need to verify findings, determine their real-world impact, coordinate disclosure, and ensure that proposed fixes address the underlying problems.
The importance of the incident lies in the speed and reach of AI-assisted security research. A widely used programming language can contain defects that have survived years of development and testing. AI tools may help researchers examine these systems more deeply and identify weaknesses that conventional reviews missed.
Why PHP’s Popularity Makes the Incident Significant
PHP’s widespread use increases the potential impact of vulnerabilities in its core runtime. A flaw affecting one plugin may be limited to sites that install that particular component. A flaw in PHP itself can affect applications across many industries and hosting providers.
PHP is used in content management systems, online stores, business portals, forums, publishing platforms, and custom web applications. Some installations are maintained by professional engineering teams, while others run on shared hosting or older infrastructure that receives less frequent maintenance.
This creates a complex remediation challenge. Administrators must identify not only the websites they manage directly but also the services, containers, appliances, and third-party products that bundle PHP behind the scenes.
A company might not realize that an internal tool or hosting component depends on a vulnerable PHP runtime. Consequently, patching a main website does not necessarily mean every affected system has been secured.
The UK’s National Cyber Security Centre has advised organizations to identify PHP installations across their infrastructure, prioritize internet-facing services, and apply the appropriate updates.
Government Agencies Issue Urgent Warnings
Cybersecurity authorities in several countries have responded with urgent guidance.
The US National Security Agency issued an advisory on October 21 recommending immediate updates for organizations using PHP. It also advised taking affected systems offline if an immediate update was not feasible.
The European Union Agency for Cybersecurity, the European Commission, and other European cybersecurity authorities issued a joint statement urging organizations to identify PHP-based applications, apply the security updates, and isolate exposed applications if remediation could not be completed promptly.
The UK’s National Cyber Security Centre similarly warned that the flaws could permit remote code execution and urged administrators to patch vulnerable systems.
These warnings do not mean that every PHP-powered website has been compromised. They indicate that the vulnerabilities are serious enough to require urgent action, especially where affected services are exposed to the public internet.
Some organizations have temporarily taken websites offline while assessing their exposure and applying fixes. Such shutdowns are precautionary measures and should not automatically be interpreted as evidence of a successful attack.
Which PHP Versions Need to Be Updated?
The PHP team released fixed versions on October 21, 2026. Administrators should confirm that their systems are running an appropriate fixed release or a vendor-supported package containing the security fixes.
| PHP branch | Fixed release |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
PHP 8.1 and earlier versions are no longer supported by the upstream PHP project. Some operating-system distributors and commercial vendors may provide backported security fixes, but administrators should verify this with their specific provider rather than assume an older installation is protected.
Organizations should also check containers, managed hosting services, and third-party applications that include PHP. A product’s own version number may not reveal which PHP runtime it uses internally.
For authoritative instructions, consult the official PHP security archive and the relevant vendor’s advisory.
What Should Website Owners Do Now?
Website owners and system administrators should treat PHP2Shell as a priority security issue.
Recommended actions:
- Inventory PHP installations. Identify all servers, containers, applications, hosting accounts, and third-party products that use PHP.
- Prioritize internet-facing systems. Public web servers and applications processing untrusted requests should receive immediate attention.
- Apply the correct security update. Upgrade to a fixed supported release or verify that the vendor has backported the fix.
- Isolate systems that cannot be patched. If a vulnerable public-facing service cannot be secured promptly, assess whether it should be taken offline or restricted from public access.
- Review security logs. Look for suspicious PHP or web-server activity, unexpected processes, unusual outbound connections, and other potential indicators of compromise.
- Check for persistence. If an attack may have occurred, investigate before assuming that installing a patch has removed any malicious changes.
- Coordinate with hosting providers. Ask providers to confirm whether the PHP runtime and bundled components have been updated.
Organizations should avoid relying solely on web application firewalls or application-level safeguards. Because the flaws affect the PHP runtime itself, these controls may not prevent every exploitation path.
The Bigger Picture
PHP2Shell highlights both the defensive potential and the risks of AI-assisted cybersecurity. AI models can help researchers identify hidden flaws and accelerate the development and validation of patches. But once a vulnerability becomes public, the same ability to analyze code and reason about exploitation may help malicious actors develop attacks more quickly.
The incident also demonstrates why vulnerability management is an ongoing operational responsibility. Finding a flaw is only the beginning: developers must fix it, vendors must distribute updates, and organizations must locate every affected system and install the correction. In widely deployed software, that final step can be harder than the technical repair itself.
FAQs
1. What is PHP2Shell?
PHP2Shell is the collective name used for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They involve unsafe memory handling and can lead to remote code execution under vulnerable conditions.
2. Can attackers exploit the vulnerabilities without a password?
Yes. Security agencies warn that successful exploitation may be possible without authentication. The precise exposure depends on the PHP version, configuration, and execution environment.
3. Does the incident affect WordPress websites?
Potentially, yes. WordPress uses PHP, so websites running it may be exposed if their underlying PHP runtime is vulnerable. Updating WordPress alone is not necessarily sufficient; administrators must also check the PHP version and hosting environment.
4. Which PHP versions are fixed?
The PHP project released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 with fixes. Operators of older or unsupported branches should check vendor guidance and migrate to a supported release where possible.
5. Does AI make software development less secure?
Not necessarily. AI can help defenders find vulnerabilities and validate patches, but it can also help attackers analyze weaknesses. The outcome depends on how these capabilities are used and how quickly organizations respond to newly disclosed flaws.
Looking Ahead
The immediate priority is to ensure that vulnerable PHP installations are patched, isolated, or otherwise mitigated. Organizations with complex infrastructure must account for legacy systems, third-party products, and hosted services that may not be obvious during a routine inventory. Continued monitoring is also important because public disclosure can prompt attackers to search for systems that remain unpatched.
Over the longer term, PHP2Shell is likely to strengthen the case for using AI in secure software development, automated code review, and vulnerability detection. It also reinforces the need for faster coordination between researchers, maintainers, vendors, and organizations that rely on open-source software. AI may shorten the time needed to discover serious vulnerabilities, but keeping the internet secure will still depend on how quickly those findings are translated into effective fixes.
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
