PHP2Shell: AI Found a 14-Year-Old PHP Flaw. What Builders Should Do Now

The most useful sentence in the whole PHP2Shell story comes from the PHP Foundation, not from an AI lab. A core developer saw signs of one of these flaws during PHP’s 2024 external audit. Nobody could show a route to code execution, a fix stalled for months, and the Foundation now calls that delay “a structural failure”. Two years later, researchers using frontier models turned the same weakness into a working, unauthenticated exploit in about a week. OpenAI president Greg Brockman says the underlying bug had been in PHP for 14 years.

That’s the change. AI didn’t invent a new class of bug. It made an old, known-but-unproven bug cheap to weaponize. This article is for developers and platform teams who run PHP somewhere, often more places than they think, or who build AI agents that sit on web infrastructure and hold API keys. It sorts what is confirmed as of October 25, 2026, from what is still moving, and ends with the steps worth doing this week.

Key takeaway

• PHP2Shell is two PHP engine flaws, CVE-2026-109618 and CVE-2026-109619, rated CVSS v4.0 9.2. PHP fixed them on Oct 21, 2026 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Code from PHP 5.4 onward is affected.
• The flaws were found by Wiz, Calif and OpenAI’s Codex Security team (Cloudflare also credits Quarkslab). Calif used GPT-5.6 Sol. Wiz used its own tooling with Gemini 4 Argon and GPT-5.6 Sol.
• A leak pulled disclosure forward a day. Cloudflare saw attack traffic before the patch shipped, and watchTowr reported active exploitation attempts the same afternoon.
• On Oct 23, PHP disclosed a related flaw, CVE-2026-115560, that also affects patched releases, including 8.5.12. It will be fixed in the next regular release.
• Patch the runtime, not the app. Restart workers. If an unpatched server handled API keys, rotate them.

What happened, in order

The disclosure was planned for October 22. It landed on October 21, and the reasons matter for anyone who coordinates fixes.

Date (2026, UTC)	Event	Source
2024	PHP’s external audit finds early signs of the out-of-memory flaw. No exploit path is found, and the fix stalls	PHP Foundation, via The Hacker News
Aug 19–24	Wiz finds the first flaw, demonstrates unauthenticated RCE on Drupal and WordPress, and reports to PHP	The New Stack, citing Wiz
August	Calif finds one flaw using GPT-5.6 Sol under OpenAI’s Patch the Planet program	OpenAI; date per Brockman on X, via Mashable/Yahoo
September	OpenAI’s own team independently finds a more complete version	Greg Brockman on X, via Mashable
Oct 20, ~15:00	CVE IDs leak with a wrong 10.0 score	The Next Web, The Hacker News
Oct 20, ~20:00	Calif mistakenly posts a video of its working proof of concept	PHP Foundation, via The Hacker News
Oct 21, 03:02	Cloudflare WAF rules go on by default for all plans	Cloudflare
Oct 21, 07:41	Chainguard publishes patched images about six hours before the official fix	PHP Foundation, via The Hacker News
Oct 21, ~14:00	PHP releases 8.5.12, 8.4.27, 8.3.36, 8.2.35. CISA tells organizations to update immediately	The Hacker News, CISA
Oct 21, 14:19	watchTowr reports active exploitation attempts against both CVEs	The Hacker News
Oct 23	PHP publishes CVE-2026-115560 in session upload progress, which affects fully patched releases	Cloudflare (update note)

Amazon’s threat-intelligence team separately said it saw an exploitation attempt against its honeypots dated October 17, four days before disclosure. That’s reported by The Hacker News, and I haven’t seen Amazon’s underlying data.

The Hacker News, captured 2026-10-25: the four fixed versions and PHP’s position that updating is the only complete fix. Headline and opening paragraph stitched together; the exploit demo image and ads between them were removed.

Confirmed vs still unclear

Confirmed (with source)	Still unclear or disputed
Two CVEs, CVSS v4.0 9.2, unauthenticated RCE in the PHP engine	How many servers were actually compromised. As of Oct 21 no source had confirmed a specific break-in
Fixed in 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. Source backports exist for 7.4, 8.0 and 8.1	Whether every distro backport covers both CVEs. Check each package changelog
mod_php is highest risk. FPM, php-cgi, FrankenPHP and LiteSpeed are also affected	Whether a full FPM exploit exists for CVE-2026-109618. PHP says FPM is susceptible but none has been shown
Worker memory, including other requests’ tokens and keys, can be read without code execution	The full scope of CVE-2026-115560 and its fix date
GPT-5.6 Sol and Gemini 4 Argon were used in discovery	How much of the work the model did versus the researcher. Calif says target history still mattered

That last row deserves care. Wiz says a single researcher using frontier models did in about a week what might otherwise take a team months. Calif adds that current models don’t reliably start from obscure, 20-year-old exploitation primitives on their own. Both can be true. The model compressed the expensive middle of the work, chaining weaknesses into a working exploit, while a human still pointed it at the right history.

Why it matters if you build with AI

The patch window got shorter, and it won’t grow back

The old disclosure model assumed attackers needed weeks to turn a patch diff into an exploit. On October 21 there was a patched container image on the internet six hours before the official release, a PoC video the night before, and payloads mutating against Cloudflare’s rules within hours. OpenAI’s own post says the capabilities that found these bugs “can also help attackers rapidly develop offensive tools and exploits”.

For builders, “we patch on the next maintenance window” is no longer a plan for runtime-level critical bugs. You need a path that gets a runtime update into production within a day, along with a way to know where every runtime lives.

Your agent stack probably runs PHP somewhere

Plenty of AI products don’t run PHP in the main app. They do run it in the marketing site, a WordPress blog, a legacy admin panel, a vendor’s billing portal or a container base image someone pulled years ago. The Hacker News notes that updating WordPress or Laravel does not update the PHP runtime underneath. That comes from the OS package, the host or the image.

The memory-read path is the part that should worry agent builders. PHP says an attacker can read worker memory that may hold passwords, tokens, API keys and certificates belonging to other requests. If a PHP service proxied calls to a model API, sent webhooks with signed secrets, or stored OAuth tokens in sessions, and it was unpatched after October 20, assume those secrets may have been exposed.

AI bug-finding is now a vendor feature, and a fixed cost for defenders

OpenAI followed up with a five-stage disclosure framework and $1 billion in subsidized access through Daybreak for Frontline Defenders. It also released a PHP version checker with two Codex skills. The New Stack notes that the checker can flag vulnerable versions but can’t confirm whether a vendor’s backport was applied. Brockman pointed to a separate Node.js RCE disclosed the same day, and OpenAI says it expects similar finds to rise sharply.

The New Stack, captured 2026-10-25. Its reporting is the source for the Wiz timeline (Aug 19–24) and for OpenAI’s five-stage framework summarized here.

The same week, Moonshot shipped Kimi K3.1 Pro with cyber-related training data deliberately removed before its open-weight release. Its own unpublished exploit test still scores 81%. We cover that in the Kimi K3.1 Pro launch analysis. Together, the two stories show where things stand. The labs agree these capabilities are real, and they disagree about who should get them. For a builder, the practical conclusion is that defenders who don’t use these models are now the slow side.

What builders can do now

Work through this in order. The first three items are about PHP2Shell itself. The rest are about the next one.

1. Inventory runtimes, not apps. List every host, container image and managed service that serves PHP, including marketing sites and vendor-hosted tools. For managed hosting, ask the provider directly.
2. Update and restart. Install 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, or a distro package whose changelog names both CVEs, then restart Apache, PHP-FPM and any long-running workers. The version string alone can mislead on backported packages.
3. Treat config changes as stopgaps. PHP’s interim settings differ per CVE: memory and request-size limits for CVE-2026-109618, and session.upload_progress.enabled=0 (plus fatal_error_backtraces=0 on 8.5) for CVE-2026-109619. Disabling upload progress does nothing for 109618, and PHP warns against using RLIMIT_AS or RLIMIT_DATA as a substitute. None of these make a server safe. CVE-2026-115560 sits in the same upload-progress feature, so keeping it disabled looks like a reasonable interim step, though that’s our inference. Check PHP’s advisory and watch for its next regular release.
4. Keep the WAF rule on, and don’t rely on it. Cloudflare calls its rules defense in depth and tells customers to patch. For CVE-2026-115560, Cloudflare says its rule doesn’t cover sites that changed session.upload_progress.name.
5. Rotate secrets that touched unpatched PHP. Model API keys, webhook signing secrets and OAuth client secrets come first. Rotation is cheap compared with explaining a leaked key.
6. Look for signs of an earlier break-in. The researchers suggest unusual multipart requests followed by memory-limit errors or bursts of HTTP 500s, oversized PHPSESSID cookies, and unexplained worker restarts.
7. Put a frontier model on your own code before someone else does. Point it at code you own: request parsing, error and cleanup paths, anything written in C or using unsafe memory. Run that review in a sandbox with human triage. The model that found this bug class is callable through the GPT-5.6 Sol page on SandBase. Treat its findings as leads to verify, not verdicts.

SandBase catalog, 2026-10-25: GPT-5.6 Sol is listed at $3.60 / $18.00, with $4 / $20 list prices struck through for a 10% discount that day. SandBase routes calls to OpenAI’s model. It had no role in the PHP2Shell research.

For a broader look at which models are positioned for security work and how their access rules differ, see our AI cybersecurity models comparison.

FAQ

What is PHP2Shell? It’s the name for CVE-2026-109618 and CVE-2026-109619. Both are memory-safety flaws in how the PHP engine cleans up after a failed request, and both allow unauthenticated remote code execution. PHP rates them 9.2 on CVSS v4.0.

Which PHP versions fix PHP2Shell? PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all released October 21, 2026. PHP 8.1 and older are end of life. PHP published source backports for 7.4, 8.0 and 8.1, and distributions may ship fixes under older-looking version numbers.

Did AI really find PHP2Shell? AI helped. OpenAI says Calif found one flaw with GPT-5.6 Sol. The New Stack reports that Wiz found both flaws using its tooling with Gemini 4 Argon and GPT-5.6 Sol. The researchers say the models mostly sped up turning old weaknesses into working exploits.

Is updating WordPress enough? No. The flaws are in the PHP runtime. You need to update PHP itself through your OS packages, container image or hosting provider, then restart PHP workers.

Is PHP 8.5.12 fully safe now? Not entirely. On October 23 PHP disclosed CVE-2026-115560 in session upload progress, which affects patched releases and will be fixed in the next regular release. Follow PHP’s advisory and keep compensating controls in place.

Bottom line

PHP2Shell isn’t the first AI-assisted vulnerability. It was serious enough that Wikipedia, DigiD and other Dutch government services, and payroll provider BambooHR all went offline in the same week, as a precaution while they patched (The Hacker News, Mashable). The bug was old. What changed was the time from a “theoretical” weakness to a working exploit. Patch the runtime, rotate what was exposed, and start using the same class of model on your own code. The next disclosure will probably come with less warning.

Cloudflare’s post, captured 2026-10-25, with its October 23 update on CVE-2026-115560. Title block and update paragraph stitched; the decorative header image was removed.

Sources checked 2026-10-25: The Hacker News, Cloudflare, The New Stack, Mashable via Yahoo, CISA alert, The Next Web, OpenAI Patch the Planet. OpenAI’s, CISA’s and The Next Web’s pages blocked some automated fetches, so their content here was confirmed through the other reports cited.