PHP2Shell: How AI turned a decade-old PHP bug into a live internet crisis
Two critical memory-safety flaws in the PHP engine were patched on October 21. The bugs sat unnoticed for years — until AI made exploitation trivial.
Two memory-safety flaws in the PHP engine itself were patched on October 21. The bugs sat unnoticed for years — until AI made them practical to exploit.
The headline is urgent: two critical vulnerabilities in PHP allow an unauthenticated attacker to execute code remotely on almost any PHP website. That alone warrants a “patch now” priority. But PHP2Shell (CVE-2026-109618 and CVE-2026-109619) introduces a broader risk factor: these flaws sat in the core PHP codebase for more than a decade without being weaponized — until AI-assisted research made exploitation trivial.
What the Bugs Actually Are
Both flaws live in the PHP core engine, not in application layers like WordPress, Laravel, or Magento.
| CVE | Mechanism | CWEs |
|---|---|---|
| CVE-2026-109618 | Out-of-memory (OOM) during request initialization leaves memory half-initialized; abort cleanup via longjmp() reads invalid pointers. |
CWE-416, 755, 824, 1325, 1419 |
| CVE-2026-109619 | Request state survives after memory is freed; a subsequent request on the same worker reuses the dangling pointer. | CWE-416 |
Both carry a CVSS v4.0 9.2 (Critical) rating and allow unauthenticated remote code execution.
-
CVE-2026-109618 (OOM Memory Corruption): Attackers force an OOM condition within standard
post_max_sizelimits by sending crafted multipart requests (e.g., missing content lengths, header stuffing). The confirmed exploit targets Apachemod_phpand executes before any application code runs. -
CVE-2026-109619 (Stale Global State UAF): PHP retains internal state across worker requests. When an OOM or fatal error aborts a request before state reset, the dangling state points to freed memory. Subsequent requests reuse this state. Confirmed triggers include fatal error backtraces (PHP 8.5) and session upload-progress tracking.
Why AI Changed the Threat Model
The underlying bugs have a long history. Stefan Esser reported the first PHP memory-limit RCE in 2004. Bug #78876 (an OOM parsing flaw) was filed in 2020 but left unfixed because researchers couldn’t prove exploitability. An OSTIF/Quarkslab audit highlighted related areas in 2024 with the same outcome.
What changed wasn’t the code — it was the cost of building the exploit chain.
Security researchers utilized models like Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol to navigate the PHP codebase, map state interactions, and automate the trial-and-error chain required for reliable exploitation. What previously required weeks of manual memory-layout research was condensed into hours, yielding working RCE against default WordPress and Drupal containers.
Using Gemini 4 Argon, the team at Wiz has shown why frontier AI is a game-changer for cyber defense. For over a decade, these critical vulnerabilities remained unaddressed because vulnerability discovery and exploitation were incredibly complex. We’re pleased to see Gemini 4 Argon help defenders bridge that gap, finding vulnerabilities and helping to patch them. — Raluca Ada Popa, Head of Gemini Security, Google DeepMind
The Discovery Timeline
The vulnerabilities were found and responsibly disclosed over a two-month window:
| Date | Milestone |
|---|---|
| Aug 19, 2026 | Wiz Research discovers the first PHP vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol. |
| Aug 20, 2026 | Unauthenticated RCE confirmed against Drupal. |
| Aug 21, 2026 | Unauthenticated RCE confirmed against WordPress. |
| Aug 24, 2026 | Wiz Research reports the vulnerabilities to the PHP security team. |
| Sep 21, 2026 | PHP acknowledges the reports and begins developing a coordinated fix. |
| Oct 21, 2026 | Patched PHP releases become available (8.5.12, 8.4.27, 8.3.36, 8.2.35). Public disclosure. |
Industry Collaboration
A vulnerability in core PHP reaches far beyond a single application — it runs across clouds, hosting providers, CDNs, and millions of independently managed servers. Prior to public disclosure, Wiz Research worked with PHP, Calif, OpenAI, Google Cloud, Cloudflare, AWS, Microsoft, Fastly, Akamai, Imperva, Vercel, and Automattic to prepare customer guidance, detections, and out-of-the-box mitigations. Wiz also hosted an Emergency Threat Briefing to walk security teams through the mechanics of each unauthenticated RCE path.
Government Response
Following the Oct 21 patch release, US agencies (NSA, FBI, CISA) issued emergency advisories urging organizations to take affected systems offline immediately if they could not patch. European government websites reportedly went dark on Oct 21 as organizations scrambled to apply patches.
Complexity that previously served as accidental defense is no longer a reliable safeguard.
Who Is Affected
All PHP versions from 5.4.0 onward are vulnerable.
-
Patched Releases: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
-
End-of-Life Versions (PHP ≤ 8.1): No official releases are available. The PHP security team published minimal source patches for custom builds.
-
Target Architectures: Apache
mod_phpholds the highest risk because parsing triggers before application code. PHP-FPM, FrankenPHP, and LSAPI are conditionally vulnerable based on worker reuse patterns.
Immediate Action Plan
1. Primary Remediation (Patch Immediately)
-
Inventory all hosts: Audit staging, Docker containers, subdomains, and third-party appliances running embedded PHP.
-
Update runtime: Upgrade to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35.
-
Verify repositories: Ensure package managers are pulling patched builds (e.g.,
packages.sury.orgrather than unupdated third-party PPAs). -
Restart long-running processes: Restart PHP-FPM pools and background queue workers (Laravel Horizon, etc.) to clear stale global state.
-
EOL Mitigations: If stuck on PHP ≤ 8.1, apply source backports or leverage vendor LTS packages (Ubuntu Pro, Red Hat).
2. Temporary Mitigations (If Patching Is Delayed)
-
Disable session progress tracking:
session.upload_progress.enabled = 0inphp.ini(worker-level). -
Enforce memory limits at pool configuration level (
php_admin_value) to prevent runtime overrides. -
On PHP 8.5, set
fatal_error_backtraces = 0. -
Set
pm.max_requests = 1in FPM to destroy workers after every request, neutralizing worker-reuse state bugs.
The Bigger Picture
PHP2Shell is not an isolated incident. It is a preview of a new vulnerability lifecycle — one where AI models collapse the gap between theoretically exploitable and exploited in the wild from months or years down to hours. Complexity is no longer a reliable shield, and “patch later” is no longer a safe default. In the months ahead, defenders will face a flood of AI-discovered, AI-accelerated vulnerabilities across every legacy runtime, not just PHP.
PHP2Shell marks an AI inflection point. The vulnerable code had been there for more than a decade — what AI changed was the ability to understand the weaknesses and turn them into a working exploit. With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work. Organizations that treated “too complex to exploit” as a risk tiering signal should re-evaluate: AI has made that assumption a liability.
About Illuminate Risk
Illuminate Risk LLC helps mid-market organizations identify AI-exposed assets, govern agent capabilities, and monitor for threats targeting legacy runtimes. Schedule a 25-minute discovery call to assess your attack surface.