AI Turned a Decade-Old PHP Flaw Into an Internet-Scale Crisis
Two 9.2-Rated Flaws Force an Emergency Release
PHP shipped four emergency security releases on October 21, patching two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a CVSS v4.0 score of 9.2. The Next Web and SecurityWeek report that an attacker needs no credentials at all to execute code on a PHP server, and the research community has collectively nicknamed the pair PHP2Shell.
The Bugs Live Inside the Engine
AI Lowered the Exploitation Barrier
Wiz researchers wrote that the underlying flaws had been present for decades, but demonstrating exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Forbes quotes OpenAI calling this one of the most impactful security issues in recent memory, and framing it as a Defender's Window. The Wall Street Journal quotes Wiz co-founder Ami Luttwak calling PHP2Shell the most severe AI vulnerability ever found.
Four Fixed Versions, One Choice
The patched releases went live at roughly 14:00 UTC on October 21: versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. SecurityWeek and BleepingComputer both report the PHP Foundation's advisories stating there are no complete mitigations and updating is the only safe choice. QZ and SecurityWeek note that the 8.1 branch and older are end of life and receive no official fix, though some Linux distributions and long-term-support vendors ship backports.
A Leak Forced the Patch Out Early
Attackers Can Also Read Credentials
Wiz's technical write-up shows attackers can read PHP process memory without first achieving code execution, pulling passwords, tokens and API keys. SecurityWeek reports that the two CVE identifiers group four memory-safety issues but do not cover every variant, and that both tracked and likely untracked variants exist.
Websites Went Dark on Every Continent
Agencies Sound the Alarm
A Two-Year-Old Warning
August: AI Closed the Loop
Exploitation Has Already Started
SecurityWeek cites Hadrian, which reported php2shell exploited in the wild at scale, with most observed attacks abusing PHP's session upload-progress path and more exploit paths expected before and after the fix. QZ reports Cloudflare rolled out firewall rules to every customer, including free-tier users, and that CTO Dane Knecht said the company is seeing early attacks.
Upgrade or Go Dark
SecurityWeek and BleepingComputer both warn that updating WordPress or Laravel does not update the PHP runtime underneath, which comes from the server package, the host or the container image, and that operators must then restart Apache, PHP-FPM and any long-running PHP workers. Forbes describes website owners scrambling to patch. The Wall Street Journal documents how researchers kept the flaw closely guarded while they worked on fixes, for fear an AI-aided attacker would find and exploit it first.
