PHP2Shell: AI will find the Bugs, but who will secure the Infra?

Over the past couple of days, PHP2Shell (CVE-2026–109618 & CVE-2026–109619) has made headlines. These are two critical vulnerabilities in core PHP that can enable Remote Code Execution and memory leaks, potentially allowing unauthenticated attackers to compromise vulnerable servers.

The headline narrative was simple: "Frontier AI models found a 12-year-old flaw affecting 70% of the web!" It sounds like a sci-fi thriller. But, the real takeaway is much simpler, and far more concerning.

How the vulnerabilities actually work

Imagine a busy restaurant kitchen where a single chef(a PHP worker process) handles all incoming orders(HTTP web requests) one by one.

When a customer makes an order, the chef sets up a work tray in memory to prepare the meal.

1. CVE-2026–109618(RCE through Out-of-Memory/OOM corruption):

An attacker sends a massive, chaotic order (like uploading a huge file). The kitchen suddenly runs completely out of counter space(memory). Instead of neatly clearing the counter, the chef panics and uses an emergency hatch (longjmp()) to abort. In the rush, the chef leaves a dirty, partially prepared tray on the counter with old notes attached. During cleanup(php_request_shutdown), another worker encounters the unfinished tray and assumes everything on it is in a valid state.

That assumption is the problem.

The cleaner reads those leftover, uninitialized notes. And, under exploitable conditions, if an attacker hides malicious instructions in that tray, the cleaner executes them(Remote Code Execution). PHP's request-cleanup process may access invalid or uninitialized internal state.

The issue isn't as simple as PHP running out of memory. It is that the failure-handling and cleanup paths can interact unsafely and be exploited.

2. CVE-2026–109619(RCE through Stale Global Memory/Use-after-free):

PHP tracks file upload progress in real-time by keeping memory notes pointing to where data is stored. Under certain conditions, PHP throws away the old memory structure but forgets to delete its internal pointers pointing to it.

Imagine, in the next order, the chef reusing notes from an earlier order, thinking those notes are still valid, even though the original tray has already been discarded. The notes now point to something that is no longer valid. An attacker can fill that freed memory slot with fake instructions or read what was left behind, allowing command execution or reading private session memory data(like API keys and passwords from previous requests).

The exact impact depends on the execution path and memory state.

Why does this matter? Because both of these vulnerabilities exist in core PHP(request-processing mechanisms) itself rather than in application code, applications built on WordPress, Drupal, Joomla, Magento and custom PHP sites may therefore be exposed even when their own code is well written.

The AI Paradox

Frontier AI models helped security researchers chain complex memory steps in hours instead of months. AI accelerated both vulnerability discovery and exploit development.

The Uncomfortable Open-Source Reality

While multi-billion dollar AI and cloud giants scramble to analyze these zero-days, the core PHP Foundation which maintains the software(PHP) powering approximately 69% of websites with a known server-side language, operates with a core team of roughly 13 developers!!!

My two cents

We rely on underfunded open-source maintainers to protect critical global infrastructure, while enterprises spend billions on AI scanners.

AI isn't going to break the internet. Our reliance on underfunded, (invisible) open-source infrastructure without giving back will.

If an organization relies on open-source software to generate revenue, supporting maintainers isn't charity anymore. It is core risk management.