PHP2Shell AI-Discovered PHP Vulnerability

PHP2Shell is not one bug but two: CVE-2026-109618 and CVE-2026-109619, both classified CWE-824 (access of an uninitialized pointer) and both scoring 9.2 'Critical' on CVSS v4.0, enough to let an unauthenticated attacker run their own code on any reachable PHP server^[1]. The first flaw fires when PHP runs out of memory midway through setting up a request, leaving half-built internal data for cleanup code to blindly trust; the second is a use-after-free hiding inside PHP core's own upload-progress feature^[2]. Neither is a brand-new coding mistake - the underlying defects had existed in PHP for more than a decade, but turning 'theoretically bad' into 'practically exploitable' required a multi-step chain that researchers describe as sitting right at the edge of human-only discovery^[3].

The discovery timeline became its own flashpoint. Security firm Calif, led by researcher Ryan Austin, says it found one of the two flaws in August 2026 using OpenAI's GPT-5.6 Sol model as part of OpenAI's 'Patch the Planet' initiative^[3]. Weeks later, Google-owned Wiz says it found both flaws independently, using its own Wiz Atlas research tool alongside Gemini 4 Argon and GPT-5.6 Sol^[3]. OpenAI's Codex Security team filed its own root-cause report on August 11 and flagged additional attack vectors on September 18^[4], and the company later called the bug 'one of the most impactful security issues in recent memory' given PHP's reach^[3]. Calif pushed back on the cleaner 'AI found it alone' narrative that circulated afterward, saying 'No model is simply capable of unearthing "all bugs" with simple prompts. At least for now.'^[3]

Long before the public panic, this bug class was already a known weakness, not a secret one - the underlying memory-safety defects had existed in PHP for more than a decade, and researchers describe the real barrier to exploitation as a complex, multi-step chain sitting at the edge of human-only discovery capability^[3]. AI-assisted analysis is what closed that gap, and it reframes what 'theoretical' means in software security: a widely shared read among developers watching the disclosure was that it no longer takes a human expert's full, sustained attention to turn a known weakness into a working exploit - pointing a sufficiently capable model at the system and asking it to find the path can now be enough on its own. That shift showed up in how the finding itself was described: the original disclosure thread read less like a warning and more like a technical trophy, checking off pre-authentication remote-code-execution wins against WordPress, Drupal, and Joomla in quick succession, before security press reframed the same information into a 'patch now' emergency within hours.

The scramble had real victims. In Europe, Germany, France, Belgium, the Netherlands, Finland, and Czechia all took government websites offline as a precaution^[5], and in the UK alone, 32 government services went fully dark and four more were partially unavailable, with the technology minister stressing that 'we are not currently aware of any confirmed compromise of central government systems'^[6]. Attackers did not wait for the public clock to start, either: Amazon's own honeypot telemetry recorded an exploitation attempt on October 17, four days before the public disclosure on October 21^[2]. The exposure numbers explain the panic: Censys counted roughly 1.57 million unpatched PHP hosts out of about 1.58 million detectable PHP installations on the day of disclosure^[7], while Cloudflare watched attack attempts climb from a pre-disclosure trickle of thousands to tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours, and millions by the next morning^[7].

The loudest reactions came from the top of the security industry, and they converged on the same unsettling point - this will happen again, soon, and often. Cloudflare CEO Matthew Prince framed PHP2Shell as the opening act of a multi-year pattern: 'I think we're going to have a couple years where every single week it's going to feel like the sky is falling.'^[8]CrowdStrike CEO George Kurtz pushed back on any instinct to slow AI development in response, arguing instead that defenders have to match its pace: 'The frontier will move at whatever speed it moves. The rest of the world will not slow down. Our job in the cybersecurity community is to make sure it moves securely and safely.'^[7]That urgency is backed by CrowdStrike's own telemetry, which showed likely AI-agent-driven attacks roughly doubling month over month through August and September 2026^[7]- a trend PHP2Shell's rapid leak-to-exploitation timeline did nothing to slow.