PHP2Shell Explained: The PHP Flaw That Put Roughly 70% of the Web in the Crosshairs, and Why AI Is…

If you work anywhere near websites, e-commerce, media, SaaS or WordPress, October 2026 will be remembered as the week the internet was told to patch right now.

On 21 October 2026, the PHP team pushed out emergency security updates for two critical vulnerabilities that the security community has nicknamed PHP2Shell. Researchers have called them some of the most severe flaws ever found in PHP. Within hours, attackers were already knocking on doors.

Here is everything you need to know, using the classic 5 W's.

WHAT is PHP2Shell?

PHP2Shell is a pair of vulnerabilities tracked as CVE-2026–109618 and CVE-2026–109619. Both are rated 9.2 on the CVSS v4.0 scale, and one security firm, watchTowr, rated the issue a full 10.0.

They affect PHP versions from 5.4 all the way to 8.5. The impact:

• Unauthenticated remote code execution (RCE): an attacker can run commands on your server without logging in.
• Memory disclosure: secrets such as passwords, tokens and API keys sitting in a PHP worker's memory can leak, which some analysts compared to Heartbleed in certain paths.
• Crashes and denial of service as side effects.

Why the name? "PHP2Shell" is the name researchers gave the exploit script that turns a PHP flaw into a shell, meaning full command-line control of the web server.

The two bugs in plain English

1. CVE-2026–109618, out-of-memory corruption. When PHP runs out of memory halfway through setting up a request, it stops, but it leaves data half-built. PHP's cleanup code then trusts that broken data, and that opens a path to code execution.
2. CVE-2026–109619, stale global state. PHP keeps pointing at request data even after the memory behind it has been freed. The next request handled by the same worker can touch that leftover data before PHP resets it, which causes a use-after-free.

Think of it as a hotel cleaner who gets interrupted mid-shift and leaves the room half-reset. The next guest walks into someone else's leftovers, and an attacker engineers exactly that situation.

WHO found it, and who is affected?

• The discoverers. Two parties found the flaws independently: Ryan Austin of the security firm Calif , working under OpenAI 's "Patch the Planet" project, and the cloud security company Wiz , part of Google Cloud Security . Austin used an OpenAI model to assist the discovery.
• The affected. Every PHP setup that serves web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Setups using mod_php face the greatest danger. Researchers showed a single unauthenticated request can trigger the attack before any application code even runs.

That matters because PHP powers about 70% of websites whose server-side language is known, including WordPress , Drupal , Joomla! and Mediawiki. Wiz demonstrated pre-authentication code execution against WordPress, Drupal and Joomla in controlled test environments.

WHEN did it happen?

Date Event

1 Aug 2026 Vulnerabilities discovered

21 Sep 2026 PHP security team acknowledges the reports and starts on fixes

17 Oct 2026 Amazon Web Services (AWS) on's honeypot network records an exploitation attempt, four days before public disclosure

20 Oct 2026 Details leak online; PHP announces an emergency release for the next day

21 Oct 2026 PHP ships fixes slightly ahead of schedule; watchTowr observes exploitation in the wild; Cloudflare reports early exploitation and deploys temporary WAF rules

22 Oct 2026 Open-source scanners appear; security firms report active scanning and attacks

The planned, orderly disclosure was overtaken by a leak. That is why this went from "upcoming patch" to "drop everything" in about 24 hours.

WHERE is the vulnerability?

This is the part that surprises people: not in your application code.

The bugs live in PHP's own runtime, in how it handles sessions, OPcache class caching and fatal-error backtraces. Even a bare "Hello World" page on a vulnerable PHP version can be exposed. You can write flawless code, use the best framework and pass every audit, and still be vulnerable if your PHP version is unpatched.

So the fix is at the platform level: your hosting, containers, base images and CI/CD pipelines.

WHY is it trending, and what made it possible?

1. Massive scale

The web runs on PHP. Qualys analysed data from more than 10,000 customers to measure exposure and found it widespread. When the flaw sits in the runtime itself, "a few servers" becomes "most of the internet."

2. The leak

The embargo broke. A proof-of-concept tool appeared, and at least one security firm reproduced a vulnerability before the patch was out. Defenders lost their head start.

3. Exploitation before patching

Early exploitation signs were reported before and immediately after the fix. Broad, untargeted scanning began quickly. Arctic Wolf also reported PHP2Shell-themed attack traffic, including activity linked to a botnet, though some of that traffic looked like older session-poisoning techniques rather than the new memory bugs. Not every "PHP2Shell attack" you see is the real thing, but the risk is real. CISA had not added the CVEs to its Known Exploited Vulnerabilities catalog as of 22 October.

4. The AI factor, the real story

Wiz said the underlying flaws had existed for decades, but exploiting them required an unusually complex chain of steps, at the edge of what human researchers could practically do. Frontier AI models lowered that barrier and helped turn a long-standing flaw into a working exploit.

If AI helps defenders find these bugs first, great. But the same capability is available to attackers, so the time between "bug exists" and "bug is exploited" is shrinking.

What should you do right now?

1. Patch immediately. Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If you're on an older branch, upgrade to a supported one.

2. Don't rely on workarounds. Settings like disabling session upload progress circulated online, but analysts stress that only patching fully fixes the issue.

3. Find your exposure. Inventory PHP everywhere: servers, containers, shared hosting, legacy apps, third-party plugins and vendor-managed sites. Free checkers and scanners have been released by firms like Aikido Security and Searchlight Cyber .

4. Hunt for compromise. Alert when a PHP process or web server spawns shells (sh, bash, cmd) or other utilities it normally wouldn't. Flag outbound connections from web servers to unfamiliar addresses, which can indicate a reverse shell. Review unusual egress traffic, large data transfers and odd-hour connections.

5. Rotate secrets. Because memory disclosure can leak credentials, rotate API keys, tokens, database passwords and session secrets on any server that may have been exposed while unpatched.

6. Ask your vendors. Hosting providers, agencies and SaaS platforms built on PHP need to confirm in writing that they've patched.

The bigger picture: security at AI speed

PHP2Shell is a preview of the next few years:

• Discovery is accelerating. AI-assisted research can surface and weaponize old bugs faster than ever.
• Patch windows are collapsing. When leaks, exploit scripts and scanners show up within hours, "we'll patch next sprint" is no longer a strategy.
• Foundational software is the target. Attackers go after runtimes, libraries and frameworks that sit under millions of sites.
• Security teams need new playbooks for asset visibility, automated patching and AI-driven detection and response.

These are the questions we want to dig into together at the AI Security Global Virtual Summit 2027, on 12 February, bringing security leaders, researchers and practitioners together to talk about defending in an era where AI changes both the attack and the defence.

👉 Save your spot: AI Security Global Virtual Summit 2027 | 12 Feb (www.buildtek.in/aisecsummit.html)

Quick FAQ

Is my WordPress site affected? If it runs on an unpatched PHP version, yes. Wiz demonstrated unauthenticated RCE against WordPress in a test setup. Ask your host for the PHP version and update it.

Does a WAF protect me? A WAF can reduce risk, and Cloudflare deployed temporary rules, but it is a stopgap. Patch the runtime.

Is it being exploited? Yes. Multiple security vendors report exploitation in the wild and broad scanning.

Was it only found by AI? No. Humans drove the research, but AI assistance was credited in the discovery and exploit development.

Final takeaway: PHP2Shell is a patch-now moment and a wake-up call. Update your PHP, check for compromise, rotate secrets, and start planning for a world where exploits arrive at AI speed.

What's your team doing about PHP2Shell? Drop it in the comments. 👇

Sources: Wikipedia: PHP2Shell, php2shell.com, Help Net Security, Recorded Future, watchTowr, Qualys, Datadog Security Labs, Arctic Wolf, Imperva, Armis, Aikido Security