PHP2Shell: AI Helped Uncover a Critical PHP RCE as Emergency Patches Land Overnight

If your website runs on PHP, you have probably received an "urgent" email from your ops team in the last 24 hours. On October 21, 2026, PHP shipped emergency security updates for four branches at once — PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 — fixing two unauthenticated remote code execution vulnerabilities collectively dubbed PHP2Shell: CVE-2026-109618 and CVE-2026-109619, both scoring 9.2 on CVSS 4.0, one notch below maximum severity.

What makes this unsettling is where the bugs came from: they were not found by a traditional researcher reading code line by line, but by Calif-based security researcher Ryan Austin, working under OpenAI's Patch the Planet program, who used GPT-5.6 Sol to audit the PHP source tree and found them between July and August 2026. The Wiz research team (part of Google) then independently reproduced similar flaws with its own AI tooling. The Wall Street Journal's October 21 exclusive put it bluntly — "AI Just Found a Bug That Puts up to 70% of the World's Websites at Risk."

How dangerous are these two bugs, really

The short version: this is one of the most severe PHP vulnerabilities in nearly a decade. Both flaws affect practically every PHP version from 5.4 to today, and every major SAPI is in range — classic mod_php, mainstream PHP-FPM, and the newer FrankenPHP.

• CVE-2026-109618: a memory-corruption bug on the out-of-memory (OOM) path. With no authentication at all, an attacker sends crafted requests that push the process toward memory exhaustion, then precisely triggers the error-handling path where a use-after-free occurs, hijacking execution. GitHub Security Advisory GHSA-w8hw-w9fx-j79w.
• CVE-2026-109619: cross-request global state residue. PHP's request-isolation model is torn open: pieces of global state survive request teardown and leak into the next request, letting an attacker "park" malicious data in one request and detonate it in the next. GitHub Security Advisory GHSA-6wmf-4rv5-p3rp.

Each bug alone is critical; together they are worse. One tears open the memory defenses, the other keeps the malicious payload alive across requests. And "unauthenticated" is the word that should keep you up at night — no account, no login needed. Any internet-facing PHP endpoint is a potential entry point. For ops teams, the patch window is not "sometime this week." It is now.

Under the hood: why memory corruption plus state residue is the worst combo

Public technical analyses (Sansec's php2shell research page is the most detailed) lay out the exploit chain clearly, and it is worth unpacking because it explains why "just patch it" undersells the problem.

CVE-2026-109618 lives in the OOM error-handling path. When PHP runs out of memory, it is supposed to walk a "graceful degradation" path — freeing resources, throwing an exception, keeping the process from crashing outright. The bug is in that very lifeboat: a chunk of memory gets freed twice (or referenced after being freed) during error handling, creating a use-after-free. The attacker's playbook: flood the target with requests to push it toward the OOM boundary, then trigger the faulty path with a precisely crafted request, shaping the heap layout at the moment of corruption to seize control of execution. UAF exploitation is heavy artillery in the binary-exploitation world — and it is exactly the kind of systematic, tireless enumeration ("which error path, which input sequence reproduces reliably?") that AI auditing excels at.

CVE-2026-109619 breaks request isolation. PHP's classic execution model promises per-request isolation: a clean global state is initialized for each request and torn down afterward. This bug leaves fragments of global state behind after teardown, so they bleed into the next request. The attacker works in two steps: request one "parks" malicious data in global space (poisoning a config entry or cache slot a later request will read), request two triggers the code that consumes the residue. The insidious part: each request looks normal in isolation, WAF logs show nothing obviously malicious, and traditional per-request detection is nearly blind to it.

Put together, the attacker gets a complete toolkit: 109618 opens the hole at the memory layer, 109619 keeps the payload alive at the logic layer. The PHP2Shell name (a nod to Shellshock) is earned — interpreter-level, unauthenticated, spanning more than a decade of versions.

Why PHP: the tech-debt bill for a 30-year-old codebase comes due

The PHP interpreter (Zend Engine) is a C codebase that took shape around 1999, with decades of "historical reasons" piled on top. The two spots that broke — the OOM error-handling path and request-level global state management — are precisely the oldest, least-touched corners. The reasons are depressingly practical:

• Error-handling paths are test-coverage black holes. The happy path has full unit tests; "are these 200 lines correct when memory runs out" has almost none. OOM is hard to reproduce deterministically in a test environment, so the code survived on faith.
• Global state is PHP's architectural original sin. Every SAPI (mod_php, FPM, FrankenPHP each implement their own) has to dance with Zend's global state machine, and the init/teardown contracts are scattered across dozens of files. Fix one spot, miss another — the standard script for this bug class.
• "Nobody has time to read it" was the old security assumption. Auditing a C codebase the size of Zend used to cost a fortune in human hours, affordable only to elite bounty hunters. AI has now driven the cost of the first screening pass close to zero. The "nobody looks" assumption is officially dead.

This is a warning shot for the whole open-source world: OpenSSL, Nginx, Redis, Squid — every "old, critical, and rarely inspected" C codebase is now in AI-auditing range. Expect more "dormant for a decade, detonated overnight" bugs in the next year or two. The rational defense is only one thing: automate your base-component updates instead of patching when something explodes.

Patch the Planet: OpenAI institutionalizes "AI finds the bugs"

An easily overlooked thread in this disclosure is OpenAI's Patch the Planet program. In short, it is OpenAI funding and equipping security researchers to audit critical open-source projects with its models — a sort of "AI-powered bug bounty." Ryan Austin got compute and model access through it to chew through the PHP source. After discovery came the standard coordinated-disclosure playbook: private notification to the PHP security team, an agreed patch-and-disclosure timeline, and a dedicated coordinated-disclosure page from OpenAI documenting the process.

The model is worth thinking about: instead of big tech hiring its own hunters, it is "model vendor supplies models, researchers supply time, open-source projects supply code." Good PR for the model vendor ("AI for good"), a free tireless audit team for the open-source project, and a flattened compute barrier for researchers. If Patch the Planet works, more model vendors will follow — "AI audits open infrastructure" could become standard big-tech CSR, with a side of showing off each vendor's coding chops.

The flip side: Wiz's independent reproduction proves "bug collision" is getting easier. As hunting tools commoditize, the familiar 90-day coordinated-disclosure window will compress to weeks or days. The PHP team took roughly three months from the July–August discovery to the October 21 patch for fixing and regression testing — in the AI era, that response speed may soon read as "too slow." Vendors need to re-plan their security response processes for AI-grade tempo.

Where does "70% of websites" come from

The WSJ's "up to 70% of the world's websites at risk" is not a made-up number. W3Techs' long-running surveys show PHP still powers roughly seven in ten websites (WordPress alone holds well over 60% of the CMS market). PHP2Shell affects nearly every version from PHP 5.4 onward — "nearly every version" means not just the latest branch, but the entire long tail of legacy deployments.

The WordPress ecosystem deserves its own callout: tens of millions of WordPress sites, most on shared hosting or panels (cPanel, BT Panel/aaPanel), where the PHP version is managed by the host and the site owner may not even know which version they run. The patch chain there is "PHP official → hosting provider → site owner," with latency at every hop. Every past PHP critical has left a long tail of unpatched sites lingering for months. This time Cloudflare's 07:43 UTC attack traffic proves weaponization moves in hours — the risk exposure of the long tail will be far larger than it looks.

If you build sites for clients, send them an upgrade notice today. If you are on shared hosting, open a ticket and ask when the emergency PHP patch lands. Do not wait.

AI hunts bugs: from "humans find bugs" to "models scan source"

The most thought-provoking part of PHP2Shell is not the bug but how it was found. Ryan Austin's workflow was roughly: feed the PHP interpreter's C source to GPT-5.6 Sol, have the model do targeted auditing on the two high-risk surfaces (memory management and request lifecycle), flag the suspicious spots, then verify each one by hand and write a working PoC. The AI did the tireless carpet-screening; the human did the precision demolition.

Three signals every developer should take away:

• First, the "dark debt" of foundational software is being liquidated at AI speed. The PHP interpreter is a 30-year-old codebase full of corners nobody dared touch — protected until now by "nobody has time to look." One researcher plus one model scanned it in two months. Once "AI auditing" becomes standard, expect more long-dormant foundational components to detonate high-severity bugs in the coming years. The world is not getting more dangerous; the floodlight is finally pointed at the basement.
• Second, "independent double discovery" is becoming the AI-era norm. The Wiz team found similar flaws with its own AI toolchain. As tools commoditize, bug collisions get much more likely — a stress test for disclosure processes, with ever-shrinking vendor response windows.
• Third, both offense and defense are going AI, but asymmetrically. Just this month, Reuters reported AI agents being used to breach over a hundred corporate websites (AI on the attack). PHP2Shell is the mirror image: AI helping the defense dig holes first. The catch: the AI that finds bugs and the AI that writes exploits may be the same capability. The race between patch release and weaponization will only accelerate.

The most nerve-wracking 48 hours: a leak scrambled everything

The original plan was a coordinated disclosure on October 22, giving global ops teams a safe window: "patch ready, details not yet public." On October 20, the details leaked early on Hacker News and the plan fell apart. The Hacker News coverage on October 21 put it drily: "a day after details leaked ahead of a planned October 22 disclosure."

The PHP security team's response was textbook: skip the 22nd, ship the patches early at 14:00 UTC on October 21, all four branches at once. Even so, the window cracked — Cloudflare observed attack traffic targeting the flaw at 07:43 UTC on October 21, hours before the patch shipped. In other words, attackers went from leak to live exploitation in under two days.

PHP2Shell disclosure timeline. The striking data point is 07:43 UTC on October 21 — attack traffic arrived before the patch did.

The same day, the UK's National Cyber Security Centre and the Netherlands' NCSC-NL issued security alerts, USA Today ran a live updates feed (still updating at 12:38 PM ET on October 21), and vendors like Sansec published technical analysis. When two national CERTs issue same-day alerts, the severity rating is "infrastructure-grade."

There is a real disclosure-ethics debate here: is an early leak good or bad? The pro-leak camp says details leak sooner or later, and early leaks raise awareness sooner. The other camp points at Cloudflare's 07:43 traffic and says publishing details before patches are ready is a starting gun for attackers. PHP2Shell's reality: the leak happened, the debate is moot, and the only correct response is to patch at maximum speed. The next time a "planned disclosure date" meets an "early leak," vendors will likely do what PHP did: don't wait, just ship.

History rhymes: three lessons from Heartbleed and Log4Shell

Every "codenamed" vulnerability gets compared to Heartbleed (2014) and Log4Shell (2021). PHP2Shell's similarities and differences are worth recording:

• Same: infrastructure-grade single points of failure. Heartbleed was OpenSSL, Log4Shell was Log4j, PHP2Shell is the PHP interpreter — the kind of component you never notice until the whole internet pays for it. Many users, almost no one who truly understands the source.
• Same: the long-tail patching nightmare. Three years after Log4Shell, unpatched instances were still scannable on the internet. PHP's version fragmentation is worse than Java's (5.4 to 8.5 spans 12 years), so this long tail will be longer. Expect months of bulk scanning and exploitation; keep WAF rules on long after patching, don't switch them off.
• Different: the discovery method changed. Heartbleed was human-audited, Log4Shell human-dug, PHP2Shell AI-led. This is the first time "AI finds the bug → big-tech coordinated disclosure → global synchronized patching" ran end to end. From here on, the discovery cadence for foundational-software criticals goes from "yearly" to "quarterly," maybe "monthly." Security teams need to rewrite their patch SLAs.

One more data point: in the Log4Shell era, attackers took about a week to weaponize it to copy-paste level; PHP2Shell went from the HN leak (Oct 20) to observed attack traffic (Oct 21, 07:43 UTC) in under 36 hours. The weaponization acceleration curve is more alarming than the bug itself.

Action checklist for vibe coders: check three things right now

If you run your own sites, don't assume "nobody targets my little site." Automated scanners don't discriminate — they hunt unpatched versions. Do these three things in order:

• 1. Check your PHP version. Run php -v and compare: 8.5.x → 8.5.12+, 8.4.x → 8.4.27+, 8.3.x → 8.3.36+, 8.2.x → 8.2.35+. Still on 8.1 or older? The official patch lines no longer cover you — plan a migration to a supported branch soon. Remember, this flaw reaches all the way back to PHP 5.4.
• 2. Don't just upgrade PHP — mind the SAPI. mod_php, PHP-FPM, and FrankenPHP are all affected. Restart the corresponding service processes after upgrading, or the old processes keep running in memory and the upgrade never took effect. Panel users (aaPanel/BT, 1Panel): hit "update" in the panel and restart the service. Docker users: re-pull the base image.
• 3. Review composer dependencies and WAF rules. The bug is at the interpreter level — composer updates won't stop it — but it's a good excuse to update dependencies anyway. If you can't upgrade immediately (change-control processes, production freezes), deploy WAF virtual-patching rules first: Cloudflare, Chaitin and others shipped rules the same day. Don't run naked.

One more warning: after this incident, phishing pages and malicious scripts marketed as "PHP2Shell scanners" will flood in. Get scanners only from php.net, GitHub Security Advisories, or your trusted cloud vendor's console. Never click a stranger's link.

Verdict: the patch is only the first half

PHP2Shell will join Heartbleed and Log4Shell as a watershed codename — but its watershed moment is methodological, not technical: this is the first critical foundational-software vulnerability discovered under AI leadership and run through a full institutional coordinated-disclosure process (OpenAI even opened a dedicated coordinated-disclosure page). "AI finds bugs" has graduated from researchers' personal toy to formal, process-backed productivity.

The predictable consequence: over the next 12 months, OpenSSL, Nginx, Redis — every aging C codebase — will be queued up for AI auditing. Ops teams' patch cadence will only get faster, never slower. For vibe coders the takeaway is concrete: put "keep the runtime current" on your deploy checklist, next to writing the README, until it's muscle memory. This time you were lucky enough to read the news first. Next time, the attack traffic might arrive first.

The patches are out, linked from PHP's homepage. Go upgrade.