PHP2Shell: AI-Discovered Critical PHP RCE Vulnerabilities

PHP2Shell is not one bug but two: CVE-2026-109618, a use-after-free in the upload-progress unserializer, and CVE-2026-109619, a use-after-free tied to OPcache type confusion during fatal-error backtrace generation. Both trace to code written in PHP 5.4.0, meaning the memory-safety flaw sat in one of the internet's most-used language runtimes for roughly a decade before anyone - human or machine - found it ^[1]. Both carry a CVSS v4.0 score of 9.2, reflecting that a single unauthenticated HTTP request can trigger them before any application code runs, hitting PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed deployments alike ^[4].

What makes the bug class especially dangerous is what happens after PHP's engine is left in a corrupted state by an abnormal request termination - say, an out-of-memory fatal error. Stale pointers and cache entries that should have been cleared can instead be reused, and researchers have compared the resulting memory-disclosure potential, which can leak session cookies out of freed worker memory, to Heartbleed ^[3]. That comparison matters less for its name-recognition shock value than for what it implies operationally: like Heartbleed, this isn't a bug you can fully neutralize with a web application firewall, because the vulnerable code path executes inside PHP itself, ahead of any filtering logic.

The headline framing of PHP2Shell is that frontier AI discovered a historically severe vulnerability before attackers did. Wiz Research used its Atlas platform paired with Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol to find and confirm both CVEs on August 19, 2026 ^[1]. Separately, AI red-teaming firm Calif had already surfaced a related flaw around August 1 using GPT-5.6 Sol as part of OpenAI's 'Patch the Planet' coalition ^[6]. The speed claim behind this framing is striking: according to reporting on the episode, a single researcher using these AI tools reportedly accomplished in about a week what would otherwise have taken a world-class security team months ^[7].

But the discovery story has rough edges that complicate a clean 'AI saves the day' narrative. Cloudflare's own account credited a fourth organization, Quarkslab, as part of the discovery and disclosure effort - a credit that was notably absent from OpenAI's own version of events ^[6]. And OpenAI's own public statement on the episode is itself an admission of dual-use risk: the same capability that let Calif and Wiz find a buried, decade-old bug could just as easily help attackers assemble offensive exploit tooling faster than before ^[5]. TJ Sayers of the Center for Internet Security put it plainly: the episode shows AI can uncover buried flaws and turn complex exploit chains into practical attacks in the same breath ^[5].

PHP2Shell was supposed to be a textbook coordinated disclosure: Wiz reported the bugs on August 24, the PHP security team acknowledged them on September 21, and a release was being quietly prepared. That plan broke on October 20, 2026, when details leaked online before the embargo lifted, forcing the PHP project to rush out a pre-announcement and compress its originally planned release timeline ^[2]. Cloudflare didn't wait for the leak to resolve itself - it pushed WAF protections for the known exploit vectors to customers at 03:02 UTC on October 21, hours before PHP's official patch landed at 13:30 UTC ^[6].

That gap between leak and patch was not purely theoretical. Cloudflare reported observing early attack attempts around 07:43 UTC, meaning exploitation activity began roughly six hours before a fix was even available ^[3]. Not every security vendor saw the same urgency, however: Huntress reported that, as of October 20, it had not observed confirmed exploitation in its monitored partner environments and had not built or reproduced a working proof of concept ^[2]. That split between 'attacks are already happening' and 'we haven't confirmed it yet' is a familiar pattern in fast-moving disclosures, and it's part of why multiple governments chose to take sites offline pre-emptively rather than wait for certainty.

The numbers behind PHP2Shell are what pushed it from a technical advisory into government-shutdown territory: PHP powers an estimated 70% of websites worldwide, Palo Alto Networks identified roughly 22.6 million vulnerable instances, and 40% of all websites run WordPress, which sits on top of PHP ^[5]. Confirmed or claimed affected software spans Magento, WordPress, Drupal, Joomla, MediaWiki, Roundcube, phpMyAdmin, Nextcloud, Laravel, Symfony, and WHMCS - in other words, most of the CMS and self-hosted application ecosystem ^[3]. Public bodies in the Netherlands, Finland, France, and Denmark took government portals, health services, and school communication platforms offline rather than risk exposure while patches rolled out ^[1].

The less glamorous part of the story is that having a patch does not mean the patch reaches every vulnerable server quickly. PHP 8.1 and earlier versions are end-of-life and received no official fix at all, leaving operators of older installations with no upgrade path except migrating to a supported branch. That gap between a patch existing and a patch actually being applied everywhere, more than the CVSS score itself, is what determines how long the 70% of the web running PHP stays exposed.