PHP2Shell: AI Uncovers Critical RCE Vulnerabilities Affecting 70% of the Internet -

Stock photo via Pexels.

One of the biggest security stories of the year just landed, and it has a very on-the-nose name: PHP2Shell. Two critical flaws in the PHP engine itself, found with the help of frontier AI models, let an attacker run code on a server with a single unauthenticated web request. PHP powers roughly 70% of websites worldwide, so the blast radius is enormous.

What is PHP2Shell?

PHP2Shell is the nickname for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 (critical) on the CVSS v4.0 scale. They are memory-safety bugs in core PHP, not in a plugin, theme or badly written app. That means a site can be perfectly coded and still be exposed if it runs a vulnerable PHP build.

CVE-2026-109618 (“RCE via OOM corruption”): when PHP runs out of memory, it can be interrupted while internal request data is only partly initialized, leaving memory an attacker can abuse.
CVE-2026-109619 (“RCE via stale global state”): request-owned internal state can outlive the memory behind it, so PHP later follows pointers into memory an attacker may control.

In both cases the end goal is the same: remote code execution (RCE), meaning an attacker can run their own commands on your server, before any application code even gets a chance to protect you.

How AI found bugs that humans missed for a decade

Wiz Research says it used frontier AI models to find and exploit flaws that had sat in the PHP codebase for more than ten years. The team describes the exploit chains as extremely complex, at the edge of what human researchers could practically build, and says AI lowered that barrier. According to Wikipedia’s write-up, the bugs were also found independently by Ryan Austin of the security firm Calif, working under OpenAI’s “Patch the Planet” project in August 2026.

Wiz reported the findings to the PHP security team on August 24, after confirming working unauthenticated RCE against Drupal (August 20) and WordPress (August 21). It also demonstrated attacks against Joomla. Other researchers, via Sansec, reported RCE demonstrations against apps such as Magento, MediaWiki, Roundcube, phpMyAdmin, Nextcloud, Laravel and Symfony.

Timeline

August 19, 2026: Wiz Research finds the first PHP vulnerability with AI-assisted tools.
August 20–21: Unauthenticated RCE confirmed against Drupal, then WordPress.
August 24: Findings reported to the PHP security team.
October 20: PHP announces a coming emergency patch. Details leak early, ahead of the planned October 22 disclosure.
October 21: PHP ships fixes. Cloudflare reports exploitation attempts even before the patch landed.

Who is affected?

Every PHP version since 5.4 is affected by at least one of the flaws, according to Wiz. PHP officially supports only 8.2 and later, so anyone on older branches should ask their distribution or LTS vendor about backported fixes, or upgrade.

One important reality check: PHP running 70% of the web does not mean 70% of websites are vulnerable right now. It means a very large share of the internet depends on a technology that had a serious flaw. Sites that are patched, or isolated from the public internet, are in a much better position.

How to fix it

Update PHP now. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Prioritize internet-facing servers and restart PHP workers after updating so the new build is actually running.
Use your distro’s packages or build from source if the official fix has not reached your repository yet. Managed hosts and WordPress hosting providers may patch for you, so check their status pages.
Don’t rely on workarounds. PHP and Cisco Talos both say partial mitigations only close some attack paths. If you cannot patch immediately, isolate the site from the public network.
Plan your upgrade path. PHP 8.2 reaches end of life on December 31, 2026.

Patching is urgent because attackers can compare the fixed code with the old code to understand the bugs. Exploit tools and proof-of-concept repositories are already appearing on GitHub, and you should be careful with them: some “PoC” repos are not trustworthy.

The real-world fallout

The response has been dramatic. Government agencies in the Netherlands and Finland reportedly took websites offline as a precaution, and the EU’s CERT-EU advised organizations to isolate internet-facing PHP applications until patched. At the time of writing, no major breach has been publicly and definitively attributed to PHP2Shell, but the window between disclosure and exploitation keeps shrinking.

Why this matters beyond PHP

PHP2Shell is a preview of a new normal. AI is making it faster to find deep, old bugs in widely used software, and the same tools can help attackers study patches and build exploits quickly. Defenders will need faster patch cycles, better visibility into which runtimes they actually run, and less tolerance for unsupported software.

Quick takeaways

Two critical (CVSS 9.2) unauthenticated RCE flaws in core PHP, tracked as CVE-2026-109618 and CVE-2026-109619.
Affects PHP 5.4 through 8.5; fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
WordPress, Drupal and Joomla were all shown to be exploitable on vulnerable PHP builds.
Update immediately; there is no complete workaround.

PHP2Shell: AI Uncovers Critical RCE Vulnerabilities Affecting 70% of the Internet