PHP2Shell: The First Flaw Hackers Exploited Before It Was Public

Two critical vulnerabilities were found in the core of PHP, the engine behind WordPress. The twist: AI made an exploit possible before the details were even public.

What Just Happened

On 20 October 2026, security researchers at Wiz, working with Calif and OpenAI, revealed two serious flaws in PHP itself. Not in a plugin. Not in a theme. In the core engine that runs roughly 70 percent of all websites.

The PHP team shipped patches the next day, 21 October, in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If your hosting provider hasn’t updated since then, you’re still exposed.

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, with a severity score reaching 9.2 out of 10. Every PHP version released in the past decade is affected by at least one of them, going back to PHP 5.4.

Why “PHP2Shell” Is the Part That Should Worry You

The vulnerabilities are memory safety bugs. When a PHP request crashes or runs out of memory, the server can be left with corrupted internal state. A later request can then reuse that broken state, which lets an attacker read private memory or run their own code.

Reading server memory is bad enough. That memory can hold passwords, API keys and session tokens belonging to your visitors or your own site.

Running code is worse. The researchers demonstrated complete, unauthenticated remote code execution on WordPress, Drupal and Joomla. No login required. No plugin flaw needed. The vulnerable code sits below the application layer, so even a basic “hello world” PHP site on an unpatched version is exposed.

The Uncomfortable Detail: AI Wrote the Exploit

Here’s the part that makes this a turning point rather than just another patch Tuesday.

The bugs themselves had been sitting in the PHP codebase for over a decade. Human researchers knew the code was fragile but turning it into a working attack required chaining multiple flaws and adapting to each server’s memory layout. That kind of work took specialists weeks, if it was practical at all.

Frontier AI models collapsed that barrier. Wiz reported that models, including Gemini 4 Argon, helped develop and adapt working exploits across different applications in hours instead of weeks. Details of the flaws were private while researchers worked with the PHP team, but AI-assisted exploitation is now part of the record, and it changes what “technically complex” means as a safety margin.

In other words, a flaw that sat unusable for ten years became a demonstrated attack chain, and the thing that closed the gap was AI on both sides. The same tools helped defenders find and patch the issues before they were public. Next time, the timeline may not be so tidy.

Who Is Actually at Risk

If your site runs PHP and serves web requests, you were in scope. That covers WordPress sites on shared hosting, WooCommerce stores, custom PHP applications, and anything running PHP-FPM or Apache with mod_php.

The PHP team notes the risk is highest for Apache’s mod_php setups, where a single unauthenticated request can trigger the attack before any of your own code runs.

There is some genuine good news. Exploitation depends on specific server configurations, and the major platforms moved fast. Cloudflare, Fastly, Akamai and others deployed protective rules before the technical details went public. Linux distributions received patches in advance. But the only complete fix is the PHP update itself.

What to Do Today

1. Check your PHP version. Most hosting dashboards show it under server info or PHP settings. You need 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or newer.
2. If you’re on managed WordPress hosting, ask your host. Send a simple question: “Which PHP version am I running, and has it been patched for CVE-2026-109618 and 109619?” A host that can’t answer within a day is telling you something.
3. If you manage your own server, update now. Distribution packages were patched in advance, so a package update on most LTS systems picks up the fix. If you’re on PHP 8.1 or older, those minimal backports exist, but plan the move to a supported version anyway.
4. If you can’t update immediately, the PHP team published partial mitigations, including disabling session upload progress and tightening request size limits. They reduce exposure but do not make the site safe. Treat them as a bridge, not a fix.
5. Rotate credentials if you can’t confirm your version was patched. Because the flaw can leak process memory, assume database passwords and API keys stored on the server could have been exposed. Rotating them is cheap compared to the alternative.
6. Watch for the warning signs if you run your own logs: unusual multipart upload requests followed by memory limit errors, repeated HTTP 500 responses, oversized session cookies, or unexplained PHP worker restarts.

The Longer Takeaway

This story is really about the new economics of old bugs. Complexity used to be a moat. A flaw too fiddly to exploit stayed theoretical for years. AI has been shrinking that moat, and PHP2Shell is the clearest public demonstration yet.

The practical version for any small business owner: “safe so far because it’s hard” is no longer a patching strategy. Old versions, forgotten servers and “we’ll update next quarter” habits now carry real risk on a much shorter timeline.

Update the engine. Ask your host the awkward question. Then set a reminder to check PHP versions quarterly, because the next PHP2Shell will not come with a decade of warning.

Sources

• Wiz Research: PHP2Shell, AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
• PHP.net security advisory, 21 October 2026: Critical remote code execution vulnerabilities, update now
• Calif Research: PHP2Shell, a tale of two PHP remote vulnerabilities
• JFrog Security Research: PHP2Shell, all you need to know about CVE-2026-109618 and CVE-2026-109619