PHP2Shell: AI-Found PHP RCE Flaws and How to Patch

PHP2Shell is the name for two critical PHP bugs, CVE-2026-109618 and CVE-2026-109619, that can let an attacker run code on a web server without logging in. The PHP project fixed them on October 21, 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Researchers at Calif, Wiz and OpenAI found the exploitable paths with help from AI models, partly under OpenAI's "Patch the Planet" program, and Amazon now says the flaws are "being broadly exploited in the wild." If you run PHP behind a web server, update today.

The bugs sit in PHP's memory management and error handling, not in any framework, so WordPress, Drupal, Laravel and custom apps are exposed alike. W3Techs data cited by Tenable puts PHP on about 69% of websites whose server-side language is known.

Key takeaways

• Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. The advisory says updating is the only complete fix; PHP 8.1 and older get only minimal source backports.
• Every PHP setup that serves web requests is in scope: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest on mod_php, where an unauthenticated request can trigger the attack before any application code runs.
• Calif traces the oldest affected code path to PHP 5.4.0, released in 2012.
• AI did the heavy lifting on exploitation. Wiz used its Wiz Atlas agent with Gemini 4 Argon and GPT-5.6 Sol; OpenAI and news reports say Calif used GPT-5.6 Sol.
• The embargo leaked. Amazon saw an exploitation attempt on October 17, four days before disclosure, and Cloudflare saw attack traffic before the patch shipped.

What are CVE-2026-109618 and CVE-2026-109619?

Both bugs let a crafted request corrupt state that PHP keeps while it handles requests, which an attacker can turn into code execution.

"RCE" means remote code execution: the attacker's code runs with the web server's permissions, which usually reaches the site's files, its database credentials and anything else that account can touch. The GitHub advisories add that the stale-state bug can also leak memory contents such as passwords and tokens.

Severity scores differ by scorer. PHP rates both 9.2 on CVSS v4.0; a 10.0 that circulated before release was, per the PHP Foundation, simply wrong. Red Hat rates them "Important" in its bulletin, because RHEL ships PHP-FPM by default and exploitation there is "difficult in practice."

How AI found the PHP2Shell flaws

The root cause was not new. According to the PHP Foundation, a core developer first saw signs of the out-of-memory problem in 2024 while fixing an issue from a Quarkslab audit, organized by OSTIF and funded by Germany's Sovereign Tech Agency. Nobody found a concrete attack, competing fixes each broke something, and the work stalled. The Foundation calls the delay "a structural failure, caused by both the security team's decision process and its lack of resources."

AI made the bug exploitable on a schedule of weeks. The combined timeline from the PHP Foundation, Calif, Wiz and AWS:

Wiz says its team used Wiz Atlas, its own security agent, with Google's Gemini 4 Argon and GPT-5.6 Sol, and that "Gemini 4 made a particularly significant contribution to exploit development and patch validation." Its blog explains why that matters: "Pre-AI, this manual work would be difficult to implement and even harder to scale. With AI this is no longer a barrier. LLMs can help adapt an exploit to different PHP versions, configurations and memory layouts." Our Gemini 4 Argon benchmarks breakdown covers that model.

Calif's write-up names no model and says it used publicly available ones with an "audit buddy" agent; OpenAI and TechCrunch say it was GPT-5.6 Sol. Calif demonstrated pre-auth attacks against WordPress, Drupal, Joomla, MediaWiki, Magento, Nextcloud, Laravel and other apps, and adds a caution: "No model is simply capable of unearthing 'all bugs' with simple prompts."

The flood of AI-assisted reports is the other side. Since July 1 the PHP security team has published 15 CVEs and handled more than 100 reports that were invalid, duplicates or not reproducible. The Foundation uses OpenAI's Daybreak Red to validate reports and exploits, and says a person makes every decision and writes every patch.

What is OpenAI's Patch the Planet?

Patch the Planet is an OpenAI program, launched on June 22, 2026 with Trail of Bits under OpenAI's Daybreak security effort, that uses AI models to find and fix vulnerabilities in widely used open-source projects. SiliconANGLE reported at launch that more than 30 projects, including cURL, Go and Python, were taking part, and that human security engineers review every finding before it reaches maintainers.

OpenAI's October 21 post, "Patch the Planet: global response coordination as agents uncover vulnerabilities," says OpenAI led a two-month coalition of maintainers, researchers and security providers to prepare fixes, and calls the PHP case an example of the "Defender's Window," the time defenders have to patch before attackers can exploit. According to PPC Land and Gizmodo, OpenAI also committed $1 billion in subsidized access to its Daybreak tooling for under-resourced organizations that protect essential services. That is tool access, not cash.

OpenAI's claim that AI found the flaw before attackers did does not fit the AWS and Cloudflare reports above. The PHP Foundation said only that it knew of no functional exploits at release time.

OpenAI also released openai/php2shell-checker, a pair of Codex skills. They check the PHP version from HTTP headers or php -v and return OK, VULNERABLE or UNKNOWN. They do not look for signs of compromise, and the README warns that "UNKNOWN does not mean the target is patched!"

Which PHP versions are affected and fixed?

Sources: php.net, Tenable.

Distribution packages keep their own version numbers, so do not judge them by the upstream number. Ubuntu 24.04's fixed package is 8.3.6-0ubuntu0.24.04.13, for example, per Ubuntu's CVE page, and Debian shipped fixes for bookworm and trixie per its security tracker. The advisory also warns that the volunteer-run rpms.remirepo.net repository would not have updates on release day.

What to do now

1. Find every PHP runtime that serves web traffic. php -v shows the CLI, but FPM or Apache may use a different binary, so check phpinfo() or your package manager. Include containers, CI images and managed hosting.
2. Update to a fixed release or distribution package, then restart PHP-FPM pools, Apache and long-running workers.
3. On managed hosting, ask the provider to confirm the PHP runtime is patched. Cloudflare's advisory notes that "updating website code or a plugin(s) alone does not fix these vulnerabilities."
4. Look back to October 17, not to the disclosure date. AWS suggests searching logs for POST requests containing PHP_SESSION_UPLOAD_PROGRESS and checking servers for unexpected processes or file changes. Wiz lists oversized or malformed PHPSESSID cookies and repeated memory-limit errors or HTTP 500s after multipart requests as warning signs.
5. If you cannot patch, the UK's NCSC says "you should consider taking the system offline until it can be fully mitigated." TechCrunch reports similar advice from the NSA.

Mitigations if you cannot patch yet

PHP's advisory lists settings that "reduce exposure to specific attack paths but do not make an installation safe":

• For CVE-2026-109618, set memory_limit=-1 in a way apps cannot override (such as php_admin_value in the FPM pool or Apache config), keep post_max_size low (8M, or 32M if you need uploads) with upload_max_filesize below it, and cap memory with a container or cgroup limit. Do not use RLIMIT_AS or RLIMIT_DATA, which can trigger the vulnerable allocation failure.
• For CVE-2026-109619, set session.upload_progress.enabled=0 in php.ini, the FPM pool or server config, never through ini_set() or .user.ini, and restart every worker. On PHP 8.5, also set fatal_error_backtraces=0.
• Hiding errors with error_reporting, display_errors or the @ operator does not help.

Cloudflare enabled WAF rules for every plan with a WAF, including Free, on October 21 and says attackers were already varying payloads to get around them. Paid customers should confirm the Managed Ruleset runs in block mode. A WAF buys time; it does not replace the update.

How serious is PHP2Shell?

Opinions split. Calif and Wiz demonstrated unauthenticated code execution against popular apps, AWS and Cloudflare saw attacks, and governments in the UK and EU told operators to consider taking unpatched systems offline. Developer Elias Taylor argued that it is not a Log4Shell-scale event, because for roughly ten hours after release no public exploit worked against a plain PHP install and many early proofs of concept assumed another bug already existed on the server.

Both can be true. Public exploit code was weak at first, while skilled teams with AI help had working exploits for months. That gap is why the PHP Foundation is changing how it works: an AI Security Engineer in Residence (Volker Dusch), two new staff for report handling and hardening, majority voting instead of consensus on security fixes, and sanitizer builds that match CI on every platform. It is asking companies, hosts, cloud platforms and governments to fund that work.

FAQ

Is WordPress affected by PHP2Shell?

Yes, if the PHP running it is unpatched. The flaws are in PHP itself, so updating WordPress or its plugins does not fix them. Calif and Wiz both demonstrated attacks against WordPress. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or ask your host to confirm the runtime is patched.

Is PHP-FPM safe from CVE-2026-109618 and CVE-2026-109619?

No. PHP lists PHP-FPM as affected. The confirmed out-of-memory exploit targets mod_php, but the GitHub advisory for CVE-2026-109619 says its session upload progress path was verified on PHP-FPM too. Red Hat considers exploitation on its default FPM setup harder, not impossible.

Is PHP2Shell being exploited?

Yes. AWS recorded an exploitation attempt on October 17, 2026, four days before disclosure, and says the bug is now broadly exploited. Cloudflare also reported attack traffic against its customers. Review logs from October 17 onward.

Who discovered PHP2Shell?

A PHP core developer saw the first signs in 2024 during a Quarkslab audit. In 2026, Calif (working under OpenAI's Patch the Planet), OpenAI's Codex Security team and Wiz Research reported exploitable paths with AI help, according to the PHP Foundation, Calif and Wiz.

What if I cannot upgrade from PHP 8.1 or 7.4?

PHP no longer ships releases for those branches. The security team published minimal source backports for 7.4, 8.0 and 8.1, and distributions such as Debian and Ubuntu backport fixes into their own packages. Apply the advisory's mitigations meanwhile and plan a move to a supported branch.

Sources

• PHP: Security release and pre-announcement, October 2026 (php.net news archive)
• PHP Foundation: Today's PHP security release, and how we're strengthening PHP security
• GitHub advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618)
• GitHub advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
• Calif: PHP2Shell
• Wiz Research: PHP2Shell
• AWS Security Blog: PHP2Shell exploitation prior to public disclosure
• Cloudflare: WAF protection for the PHP vulnerabilities
• UK NCSC: Critical security issue affecting PHP
• Red Hat: RHSB-2026-013
• Ubuntu: CVE-2026-109618
• Debian security tracker: CVE-2026-109618
• GitHub: openai/php2shell-checker
• OpenAI: Patch the Planet: global response coordination as agents uncover vulnerabilities
• SiliconANGLE: OpenAI expands Daybreak with Patch the Planet
• TechCrunch: OpenAI, Google's Wiz find ancient PHP holes
• Tenable: PHP2Shell FAQ
• PPC Land: OpenAI says GPT-5.6 Sol found a PHP flaw before attackers did
• Gizmodo: OpenAI wants to Patch the Planet
• Elias Taylor: There isn't an easy exploit for this PHP vulnerability