PHP2Shell: the PHP RCE that puts 70% of the web at risk
Two memory-safety bugs sat in the PHP runtime for more than a decade. Frontier models found them in a week, and the fix published yesterday arrived with governments pulling websites offline.
Two critical vulnerabilities in PHP's core engine, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, let an unauthenticated attacker execute code on any server running a vulnerable version — no plugin, no application bug, no login required. PHP shipped fixes on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the US National Security Agency told operators who cannot patch immediately to take systems offline instead.
PHP runs about 70 percent of the world's websites, per W3Techs, including WordPress, Drupal, Joomla and the MediaWiki install behind Wikipedia. Wiz Research, which independently discovered and reported both flaws, says every PHP release going back to 5.4 carries at least one of them, and that a plain "Hello World" application on an unpatched runtime is as exposed as a fully built content management system. Both bugs are rated 9.2 under CVSS v4.
The mechanics explain why this is not a WordPress problem. Both flaws live in how PHP handles a request that dies mid-flight, usually on an out-of-memory error. When the request heap is destroyed, PHP leaves stale pointers in global state: an unserializer's bookkeeping in the session upload-progress handler, the backtrace of the last fatal error, an OPcache index another worker will later reuse. The next request handled by that same worker follows the stale pointer into memory an attacker has since reclaimed. Depending on the chain, the result is remote code execution or a memory disclosure that leaks other requests' passwords, session tokens, API keys and certificates straight into a response cookie.
Wiz demonstrated pre-authentication remote code execution against the then-latest container images of WordPress, Drupal and Joomla, and published the chains in enough detail to be checkable without being a copy-paste weapon.
The discovery process is the part that changes the baseline. Wiz says the flaws had been present for a decade and that turning them into working exploits required chaining multiple bugs while adapting to each target's memory layout — work at the edge of what a human research team could practically do. Its researchers used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, and credit Argon with an "invaluable contribution" to finding the vulnerability, developing the exploit, building detections and validating the patch, per Wiz's technical writeup. Calif.io identified a critical flaw independently using GPT-5.6 Sol as part of OpenAI's Patch the Planet program, and Quarkslab is credited in the disclosure. Wiz's own summary: with frontier models in the loop, "a single researcher completed in a week what previously would have taken a world-class team months of work."
The timeline backs that claim. Wiz found the first bug on August 19, confirmed unauthenticated code execution against Drupal a day later and against WordPress the day after that, reported to the PHP security team on August 24, and got an acknowledgement on September 21. The patches landed October 21, one month after the maintainers started work.
Attackers moved before most administrators had anything to install. Amazon's threat intelligence team says its MadPot sensor network detected exploitation attempts before public disclosure and that it remains unclear how attackers learned of the flaws. Cloudflare switched on web application firewall rules at 03:02 UTC on October 21, about nine hours ahead of the announcement, and turned them on by default for free and paid plans alike. Matthew Prince, Cloudflare's chief executive, said the network saw thousands of exploit attempts in the ten hours before disclosure, tens of thousands within 45 minutes of it, hundreds of thousands within two hours and millions by the end of the day, according to Cloudflare's incident writeup.
The embargo did not hold. CVE identifiers began circulating before the scheduled release, and the PHP Foundation pushed the patches out a day early rather than let researchers reconstruct the bugs from leaks. The Register reported that the foundation blamed supply-chain firm Chainguard, which it said had published images containing the fixes before the coordinated date.
Governments treated it as an emergency. The NSA, the FBI and CISA issued alerts, with CISA listing both CVEs in its known-exploited catalog, and the UK's NCSC, Singapore's CSA, Australia's ASD, Canada's Cyber Centre and ENISA published matching guidance. Government, school and hospital websites in Europe went offline as a precaution, Reuters reported — the kind of mass takedown normally reserved for a worm in active circulation.
The uncomfortable part is that AI is being credited for finding a bug people had been failing to fix for years. The Record reports that the PHP Foundation traced the first signals of this bug class to 2024, and that its security team, working by consensus, struggled to choose between candidate fixes and feared shipping the wrong one. The Wall Street Journal's reporting notes that a human researcher flagged the same code as a problem area more than a decade ago. Detection was never the only bottleneck; maintenance capacity was, and PHP is a volunteer project most of the web depends on for free.
The patching arithmetic is ugly. Security support stops at 8.2, so PHP 8.1 and earlier get nothing at all, and the security researcher Florian Roth estimates roughly a third of PHP sites still run PHP 5 or 7. Most WordPress installs sit on shared hosting where the site owner cannot change the PHP version — they can only ask the host, and hosts are patching millions of accounts this week. WAF rules and tighter upload limits reduce exposure, but neither touches the underlying bug.
The practical instruction for anyone running a site: the fix is the runtime, not the CMS and not its plugins. Check the PHP version, move to 8.2.35, 8.3.36, 8.4.27 or 8.5.12, and leave WAF protection on while that rollout completes. OpenAI published a version checker as a Codex skill to speed up the inventory step, and says these bugs are "among several significant vulnerabilities" it has already found, with similar findings expected to "increase sharply" in the coming months.
That asymmetry — discovery concentrated in a handful of frontier labs, remediation spread across millions of small operators — is the real story. We covered the offensive side of the same shift this week: One hacker used AI agents to break into 100+ companies for $5,000. The cost of finding a way in has collapsed on both sides of the line. The cost of closing one has not.
What to watch: variant disclosures over the next month, since the PHP Foundation says more instances of the same bug class exist in the codebase; whether a public exploit lands against shared hosting before small operators finish patching; and whether OpenAI's $1 billion in subsidised Daybreak access for frontline defenders, announced alongside the disclosure, moves anybody's patch timeline.
If a frontier model can find a decade-old flaw in a week, should the lab that found it be obliged to help patch the long tail — or is that the hosting provider's job? Write to us via our contact page.
