TLDR
On October 21, 2026, the PHP team released emergency patches for two critical bugs, together called PHP2Shell. They are tracked as CVE-2026-109618 and CVE-2026-109619. Both allow remote code execution, which means a stranger on the internet can run commands on your server without a password. Every PHP version going back to 5.4 is affected. The bugs sat in the code for roughly 14 years, and it took AI models to turn them from a theoretical worry into a working attack. If your site runs on WordPress, Drupal, Joomla, Magento, or any custom PHP, update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 today. If you cannot patch today, apply the temporary configuration changes in the way forward section below.
Table of Contents
What Is PHP2Shell, in Plain English
Think of a web server as a restaurant kitchen. PHP is the head chef who takes orders from customers (web requests) and prepares the dish (your web page). A normal customer can only order from the menu. PHP2Shell is a flaw that lets a stranger walk through the kitchen door, take over the chef’s station and start cooking whatever they like, while also reading the notes the chef keeps in his pocket, such as passwords and keys.
Technically, security people call this remote code execution, or RCE. It is the most serious category of PHP security vulnerability because the attacker needs no account, no login, and no help from a victim. The “shell” in the name refers to a command shell, the control panel attackers want on your machine.
The bugs live inside the core PHP engine itself, not in a plugin or a theme. That is why the story is bigger than one product. When the engine has a flaw, every website built on top of it inherits the risk.
The 5 Ws: What, When, Where, Who, and Why
What happened?
Two critical memory safety bugs were found in PHP’s core. Both are rated 9.2 out of 10 on the CVSS v4.0 severity scale. Security firm Wiz described them as among the most severe vulnerabilities ever found in PHP, and arguably in software history. Wiz demonstrated unauthenticated code execution on the latest container images of WordPress, Drupal, and Joomla. Sansec reported confirming the same against Magento 2.4.9 and ten other PHP applications. Beyond taking over a server, one of the bugs can leak the contents of a PHP worker’s memory, which can include passwords, tokens, and API keys. Researchers compared that second effect to Heartbleed.
When it happened
The timeline matters because it shows how close this came to going badly.
August 1, 2026: Calif, an AI red teaming firm, finds the first remote code execution paths.
August 11, 2026: Calif reports the first bug to the PHP team and starts coordinated disclosure.
August 19, 2026: Wiz Research independently finds its first PHP vulnerability.
August 24, 2026: Wiz reports its findings to the PHP security team.
September 21, 2026: PHP acknowledges the reports and begins building a coordinated fix.
October 20, 2026: Details leak ahead of the planned disclosure, and WatchTowr confirms code execution is possible.
October 21, 2026: Cloudflare reports early attacks in the morning UTC, and PHP publishes the fixed releases at 14:00 UTC. Soon after, WatchTowr reports active exploitation attempts against both bugs.
So defenders had roughly two months of quiet preparation, and then the leak compressed the final stretch into a single day.
Where it hits
Everywhere PHP serves web requests. PHP is commonly cited as running around 70 percent of websites, and the affected range stretches across every release of the last decade, back to PHP 5.4. That includes shared hosting accounts, VPS servers, Docker containers, and managed platforms. Governments felt it too. Authorities in Belgium, the Netherlands, Finland, and the Czech Republic took sites offline briefly to patch, the US National Security Agency urged organizations to update or take PHP systems offline; and Japan’s prime minister posted a public warning.
A useful note for our eCommerce clients: Shopify stores do not run on PHP, so they are not exposed by this bug. WooCommerce on WordPress, Magento, and custom PHP storefronts are.
Who found it, and who is affected?
Three groups found different pieces of the problem, and all of them used AI. Ryan Austin of Calif found the first issue using OpenAI’s GPT-5.6 Sol. OpenAI’s Codex Security team then dug in and found more. Wiz Research, which is owned by Google, independently found the bugs using Wiz Atlas, Google’s Gemini 4 Argon and GPT-5.6 Sol. The PHP security team and the nonprofit PHP Foundation coordinated the fix, with Cloudflare helping on defenses.
Who is affected is simpler to answer: anyone running unpatched PHP on a server that accepts web requests. That is hosting companies, agencies, publishers, shops, hospitals, schools, and governments.
Why it stayed hidden for 14 years
OpenAI’s Greg Brockman noted that the bug had been present in PHP for 14 years. A limited version was spotted during PHP’s 2024 external audit, but nobody found a concrete route from that bug to code execution, so it was not treated as urgent. PHP is one of the most scrutinized codebases in the world, and the finders themselves said they did not expect to uncover anything critical. The flaw was not obvious. It required chaining several small behaviors together, which is exactly the kind of patient, tedious work AI does well.
How the Attack Works, Without the Jargon
Let me explain the mechanics with a library analogy.
PHP constantly borrows and returns pieces of computer memory while it handles each visitor, like a librarian lending books. A use-after-free bug is what happens when the librarian returns a book to the shelf but keeps a sticky note that still points to it. Later, someone else borrows that book and writes something new inside. If the librarian then follows the old sticky note, he trusts whatever is now written there. If an attacker controls what was written, the attacker controls what the librarian does next.
CVE-2026-109618 works around the upload progress feature. PHP handles file uploads very early in a request, before its normal setup is finished. If the server runs low on memory at that moment, PHP can be interrupted while its internal data is only half prepared, and its cleanup routine then treats that broken data as if it were valid. An attacker can steer that mistake into reading memory they should never see, or into running their code.
CVE-2026-109619 involves how PHP remembers the details of its most recent fatal error. That record can outlive the memory it points to. A later request handled by the same worker can pick up that stale record before PHP resets it, and the attacker’s data fills the gap.
Both bugs start from fatal errors and out-of-memory conditions, which attackers can often provoke on purpose with oversized or malformed requests. That is part of why the exploitation attempts began so quickly after the leak.
Why AI Changed the Game for Defenders and Attackers
Wiz said in its write-up that frontier AI models substantially lowered the barrier to turning this longstanding flaw into a working exploit and that the work could have taken a world-class team months. OpenAI called the discovery proof that AI can find security bugs with internet-scale impact before attackers do.
I agree with the first half of that, and I want to be careful about the second half. Yes, defenders won this round. The fix was ready before the public learned of the bug. But the leak on October 20 and the exploitation attempts within hours show how thin that lead was. The same AI that helped three separate teams find these bugs within weeks of each other is available to people who will not report them.
The PHP Foundation itself warned that AI will make weaknesses like this easier to find. That sentence should change how every business thinks about patching.
SWOT Analysis of the PHP2Shell Moment
I am applying the SWOT framework to the combined situation: AI assisted vulnerability discovery, as it plays out for PHP and the businesses that depend on it.
Strengths
Coordinated disclosure worked. Calif, Wiz, OpenAI, PHP, Google, and Cloudflare cooperated across roughly two months, and a fix shipped for four supported branches at once. Cloudflare deployed protective WAF rules for known exploit routes ahead of many customers’ patching. The open-source community proved it can respond at speed when the stakes are clear. AI gave defenders reach that human auditors could not match, finding a 14-year-old bug that a 2024 audit had only glimpsed.
Weaknesses
Patching is slow and uneven. Millions of sites sit on shared hosting or old PHP versions that nobody owns. Unsupported branches, such as PHP 5.x and 7.x, may never receive an official fix, and a large share of the web still runs them. PHP is maintained largely by volunteers and a nonprofit, which makes sustained deep audits of a codebase this large hard to fund. The leak also showed that embargoes are fragile.
Opportunities
AI assisted auditing can now be pointed at every critical open source project, and PHP2Shell is the strongest argument yet for funding that work. Businesses can use AI tools to scan their own custom code and plugins. Agencies like ours can turn patch management into a visible, valued service instead of invisible maintenance. Hosting providers have a reason to retire old PHP versions faster, and organizations have a reason to finally build asset inventories that say which servers run which PHP version.
Threats
The window between discovery and attack is shrinking. Attackers can feed a public patch to an AI model and have it work backward to a working exploit, so the safe delay between a fix and your update is closer to hours than weeks. Stolen API keys and tokens from memory disclosure can cause damage long after a server is patched, since those secrets remain valid until rotated. There is also a trust risk: if site owners panic and patch carelessly, or ignore the warning as hype, both outcomes cost money. Finally, this is unlikely to be the last bug of this kind, since the PHP team itself said the issue is rooted deeply in the codebase and needs a comprehensive fix over time.
My Personal Opinion After 16 Years in This Industry
I have spent more than sixteen years building and protecting websites for clients in the US and UK, and I have watched many alarms come and go. Most are overstated. This one is not.
What strikes me is not the bug itself. Every large codebase has bugs. What strikes me is the economics. For years, the cost of finding a deep flaw like this was months of skilled human effort, and that cost acted as a quiet shield for old code. AI has removed much of that shield. Code that was “probably fine because nobody has found anything in years” is no longer a safe assumption.
My second reaction is about responsibility. I hear business owners say, “My developer handles that” or “My host handles that.” Often nobody does. I would rather you ask two blunt questions today: which PHP version is my site running, and who exactly is responsible for updating it?
My third reaction is optimism, and I mean it. Three independent teams used AI to find these bugs and the defenders shipped a fix first. If we fund and organize this properly, AI can make the web safer than it has ever been. But that depends on what we do in the next few weeks, not on the technology alone.
The Way Forward: What You Should Do This Week
For site owners and small businesses
Ask your developer or host to confirm your PHP version today. Updates should move you to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on your branch. If your host controls PHP, ask for their patch confirmation in writing. If you use Cloudflare, confirm the protective rules are on, but treat them as a bridge and not a substitute for updating.
For developers and system administrators
Update PHP on every server, container image and deployment pipeline, and rebuild images rather than only patching running hosts. If you cannot patch immediately, vendors have suggested disabling upload progress tracking by setting session.upload_progress.enabled to 0 and restarting every worker, and on PHP 8.5 also setting fatal_error_backtraces to 0 to reduce exposure to the second bug. Check logs for odd upload requests and sudden worker crashes or out of memory errors since mid October. Then rotate secrets: API keys, database passwords, session secrets and tokens on any server that was exposed before patching, because memory disclosure leaves no obvious trace.
For old PHP versions
If you run a version that no longer receives security updates, upgrading is the real fix. Workarounds only reduce risk. Plan a migration to a supported branch this quarter and treat it as a security project, not a nice to have.
For leaders and agencies
Build an inventory of every PHP application you own or manage, with owner names and versions. Set a patch service level, for example critical fixes within 24 to 72 hours. Run a short tabletop exercise: if a critical engine bug appears on a Friday evening, who acts, and how fast? Add AI assisted code review to your security routine, because attackers already have it.
Conclusion
PHP2Shell is a milestone for two reasons. It is one of the most serious flaws ever found in a language that carries a huge share of the web, and it is the clearest public proof so far that AI can find buried, internet scale bugs before attackers do. The patch exists, the instructions are clear and the cost of acting is low. The cost of waiting is rising by the hour. Update your PHP, rotate your secrets, and start treating patching as a core business function.
If you want help auditing your PHP stack, patching safely or hardening a WordPress, Magento or custom PHP site, reach the TechWrath team at enquiry@techwrath.com, on WhatsApp at +18198013434, or at techwrath.com.
