PHP2Shell: The AI-Found PHP Flaws and What Your Website Needs to Do

On October 21, 2026, PHP, the language behind roughly 70 percent of websites, shipped emergency patches for two critical vulnerabilities. Within a day, government websites in the Netherlands, France, Belgium, Germany and several other countries went offline on purpose so they could patch. If your site runs WordPress, WooCommerce, Laravel or any other PHP platform, this affects you directly.

The two flaws are known together as PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619, and both are rated CVSS 9.2 out of 10 in PHP's official advisory. They let an attacker run code on the server without logging in, and both were found with the help of AI.

This post explains what PHP2Shell is, which PHP versions are affected, which AI found it, why so many governments took their sites down, and a concrete checklist for website owners to check and patch today.

What Is PHP2Shell?

PHP2Shell is the shared name for two memory safety vulnerabilities in the PHP core itself, not in a plugin or theme. Both happen when PHP fails to clean up properly after a request is cut off midway, mostly because it ran out of memory.

• CVE-2026-109618 (RCE via OOM corruption): an attacker sends a crafted upload request that makes PHP run out of memory while request data is only half set up. The cleanup step then reads garbage data, which opens the door to code execution.
• CVE-2026-109619 (RCE via stale global state): long-running PHP workers can keep pointers to memory that a previous request already freed, and the next request reuses that same memory.

According to Wiz, chaining the two flaws allows a full takeover of stock WordPress, Drupal and Joomla installs with no bug in the application at all. Attackers can also read leaked data from other users' requests, such as passwords, tokens or API keys, through the PHPSESSID session cookie, even on sites that never use sessions.

Which PHP Versions Are Affected?

Every release from PHP 5.4 (shipped in 2012) through 8.5.11 contains at least one of the two flaws, which means the bug sat unnoticed for about 14 years. Every common way of running PHP is affected: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, with PHP rating mod_php as the highest risk.

• Official fixes: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released on October 21, 2026.
• PHP 7.4, 8.0 and 8.1: source-level patches only, with no official releases. Get the fix through your operating system, hosting panel or a long-term support vendor.
• PHP 7.3 and older: no patch. Upgrading is the only option.

The 8.2 branch also reaches end of life on December 31, 2026, so if you have to upgrade anyway, go straight to 8.4 or 8.5.

Which AI Discovered PHP2Shell?

Saying a single AI model found these bugs is not quite accurate. Two teams found them independently, and both used AI:

• Calif, a California security firm working in OpenAI's Patch the Planet program. Researcher Ryan Austin found the first bug on August 1, 2026 and reported it to PHP on August 11. Fortune reports that Calif used GPT-5.6 Sol, although Calif's own write-up does not name a model.
• Wiz, the Google-owned security company, found the flaws using its Wiz Atlas tool together with Gemini 4 Argon and GPT-5.6 Sol, and reported them to PHP on August 24.

OpenAI led the coordinated disclosure group, which included PHP, Wiz, Calif, Cloudflare and several US government agencies. Notably, the root cause had been flagged in a 2024 audit but was set aside because nobody could show it was exploitable. With AI assistance, both teams built complete attack chains within weeks. Even so, Calif stresses that human expertise was still what steered the AI.

Why Did Government Websites Go Offline?

The disclosure plan broke down. On October 17, Amazon's honeypots logged an exploitation attempt, four days before the flaws went public. On October 20, details leaked on social media. When PHP shipped the patches on October 21, Cloudflare's CEO said there were tens of thousands of exploit attempts in the first 45 minutes and millions by that evening.

The NSA and the UK NCSC advised taking any system that could not be patched offline. Many governments did exactly that:

• Netherlands: DigiD, the House of Representatives, the national cyber security centre NCSC, the Overheid.nl portal and the public health institute RIVM.
• France: sites of the Interior Ministry and regional prefectures.
• Belgium: the Foreign Affairs ministry website.
• Germany, Finland, the Czech Republic and Denmark: some sites and online public services paused to patch.
• United Kingdom: the City of Edinburgh Council website.

Reuters confirmed these were precautionary shutdowns and that no government site was actually breached. Still, Sophos recorded at least one server that was successfully exploited and infected with Mirai malware, so the risk is real. The exposure is huge too: Palo Alto Networks counted about 22.6 million potentially affected servers.

What Should Website Owners Do Today?

The bug lives in PHP, not in WordPress, so updating WordPress or your plugins will not protect you. What you need to update is PHP itself on the server. Here is a checklist in order of priority:

• Inventory: list every website, server, staging environment and container running PHP, including old sites nobody remembers.
• Update PHP: move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. On shared hosting, ask your provider to confirm they have patched.
• Verify properly: many operating systems and panels such as Ubuntu, RHEL, cPanel and Plesk patched while keeping the old version number, so php -v can mislead you. Check the package changelog or build date instead.
• Restart: after patching, restart PHP-FPM, Apache and any workers so the fix takes effect.
• Turn on a WAF: Cloudflare has deployed blocking rules on every plan, including the free one. A WAF only helps if your origin server cannot be reached directly by IP.
• Temporary mitigation if you cannot patch yet: disable session.upload_progress.enabled, set memory_limit=-1 at the server level, and on PHP 8.5 turn off fatal_error_backtraces. These are partial measures only.
• Isolate what you cannot patch: take it offline or put it behind network-level authentication, as CERT-EU, the NSA and the UK NCSC advise.
• Hunt for compromise back to October 17: look for repeated out-of-memory errors, bursts of HTTP 500 responses, unusually long PHPSESSID cookies, unknown files in /tmp and PHP workers restarting unexpectedly.

PHP is clear that no configuration change fully mitigates the flaws, so updating remains the only real fix. Patching after October 17 does not guarantee the server is still clean, so do not skip the compromise check.

What PHP2Shell Says About Website Security in the AI Era

The biggest lesson is not the two CVE numbers. A bug once shelved as “not exploitable” became exploitable within weeks of AI being brought in. Attackers have similar tools, so the gap between disclosure and attack is now measured in hours, not weeks. The PHP Foundation itself said tools now find bugs faster than ever, for defenders and attackers alike.

For businesses, that means a website needs a clear update process: know what you are running, know who is responsible for patching, and be able to patch within a day. A forgotten site on PHP 7.x is now a real risk, not a technical chore for later.

If you are not sure which PHP version your site runs or whether it has been patched, Growthtrait's website development team can help you check and plan the update. Contact us to get started.