PHP2Shell: AI helped find critical RCE vulnerabilities in PHP

On October 21, the PHP team released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which patch two critical vulnerabilities that allow remote code execution without logging in: CVE-2026-109618 and CVE-2026-109619. The same day, Wiz Research described them as PHP2Shell and revealed that the Gemini 4 Argon and GPT-5.6 Sol models helped find them and write the exploit.

What is the PHP2Shell vulnerability?

PHP2Shell is two vulnerabilities in the PHP engine itself, not in any particular application. Both are rated CVSS 9.2. According to the advisory on php.net:

1. CVE-2026-109618 concerns out-of-memory (OOM) handling. The bug can abort PHP while internal request data is only partially initialized, and the end-of-request cleanup then treats that data as valid.
2. CVE-2026-109619 is so-called “stale global state”: internal request state can survive after its memory is freed, and the next request handled by the same process can use it.

Every PHP installation that serves web traffic is at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. mod_php is the worst case, because that is where an exploit was shown in which an unauthenticated request triggers the attack before any application code runs.

According to Wiz, the vulnerable code has been in PHP for more than a decade, and the problem goes all the way back to PHP 5.4. The researchers demonstrated remote code execution on the latest Docker images of WordPress, Drupal and Joomla.

What role did AI play in discovering PHP2Shell?

Wiz says that throughout the research it mainly used its own Wiz Atlas tool along with the Gemini 4 Argon and GPT-5.6 Sol models, and that Gemini 4 Argon helped find the vulnerability, write the exploit, detect the attack and verify the fix. The timeline from the Wiz post looks like this:

1. August 19, 2026: Wiz finds the first vulnerability.
2. August 20: it confirms remote code execution on Drupal.
3. August 21: the same on WordPress.

So it took two days to go from finding the bug to a working attack on WordPress. Wiz explains that the flaws had existed for a long time, and proving they were exploitable required a very complex chain of steps, but the AI models “substantially reduced that barrier, turning a longstanding flaw into an exploit”. Raluca Ada Popa, who leads Gemini security at Google DeepMind, commented that Wiz had shown “why frontier AI is a game-changer for cyber defense”.

It wasn’t only Google. According to heise, the first team to find it was Calif, which was auditing code with the PHP Ecosystem Security Team as part of OpenAI’s “Patch the Planet” initiative. Wiz and OpenAI reproduced the vulnerabilities with the help of LLMs and helped review the fix.

Why is everyone talking about it?

First, the scale. WordPress, Drupal and Joomla all run on PHP, and the vulnerability triggers before any application code. The patch announcement on the php.announce list collected more than 1,300 points on Hacker News before any details were even out.

Second, the leak. According to heise, disclosure was planned for October 22 but was moved up by a day because the information had leaked. SecurityWeek reports that watchTowr reproduced CVE-2026-109618 even before the patches, and Sansec predicts mass attacks will start “within 15 minutes of the patch release”. So far, watchTowr and Huntress have not seen the vulnerabilities exploited in real attacks.

Third, the direction. Just like with Claude Mythos at Bank of America, AI models are finding serious bugs faster than people can patch them. The catch is that attackers have the same tools, as the AI cyberattack on the Cairn platform showed.

What should you do if you run PHP?

1. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. According to php.net and Wiz, this is the only complete protection.
2. According to heise, the older 7.4, 8.0 and 8.1 branches are due to get backports, and Linux distributions are expected to ship packages within hours.
3. With Docker, you need to pull the new image and restart the container.
4. Also check hardware with a PHP web panel: NAS devices, routers, appliances (heise mentions pfSense, QNAP and Synology, among others).
5. Until you update, WAF rules from Cloudflare, Akamai or AWS help, but the PHP team calls configuration workarounds “a temporary crutch”.

(on shared hosting, ask your provider when they will install the patches)

FAQ

Does PHP2Shell affect WordPress?

Yes. Wiz demonstrated remote code execution on the latest wordpress:latest image, as well as on Drupal and Joomla. The vulnerability is in PHP, so what helps is updating PHP, not WordPress itself.

Which PHP versions are safe?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 from October 21, 2026, and anything newer. Treat older versions as vulnerable.

Are the vulnerabilities already being exploited?

According to SecurityWeek, watchTowr and Huntress have not seen attacks in the wild, but the details leaked before disclosure, and Sansec expects mass attacks right after the patches are released.

Who found PHP2Shell?

According to heise, the Calif team got there first, as part of OpenAI’s “Patch the Planet”. Wiz Research described the vulnerabilities under the name PHP2Shell and found them with help from Gemini 4 Argon and GPT-5.6 Sol.