PHP shipped emergency security updates on October 21, 2026 for two critical flaws, nicknamed PHP2Shell, that let an attacker with no login run code on almost any server running PHP. PHP powers roughly 70% of websites, including everything built on WordPress, Drupal and Joomla. The bugs had sat in the code for more than a decade. They were found with AI models from OpenAI and Google. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If you run a PHP site, update now.
What exactly are the flaws?
Two memory-safety bugs, tracked as CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10 on the CVSS v4 scale. In plain terms, a specially crafted web request can confuse how PHP manages memory and let the attacker run their own commands on the server. Wiz said attackers could also read passwords, tokens and API keys straight out of PHP’s memory.
PHP says every installation that serves web requests is at risk. The highest risk is Apache with mod_php, where the malicious request triggers the flaw before any of the website’s own code even runs. Calif, Wiz and Cloudflare put the reach at PHP 5.4 and later, more than ten years of releases. PHP also published fixes for the old 7.4, 8.0 and 8.1 branches because of the severity, and warned that no configuration change fully replaces updating.
How did AI find it?
Security firm Calif found the first bug in August during an audit of PHP’s source code funded by OpenAI, using OpenAI’s GPT-5.6 Sol. Google-owned Wiz found the flaws independently weeks later using its Wiz Atlas tool, Google’s Gemini 4 Argon and GPT-5.6 Sol. PHP’s advisory credits Calif, Wiz and OpenAI together.
The important part is not that AI found a bug. It is that AI made the bug usable. These are "notoriously complex" memory flaws that need different exploits for different PHP versions and setups, which is why almost nobody could weaponise them for a decade. "With AI, this is no longer a barrier," Wiz wrote. Calif struck a more careful note, saying it used only generally available models and that knowing PHP’s history mattered more than the model.
Why did websites go dark before the patch?
Because the news leaked early. Someone posted about the coming fix on Hacker News on Tuesday, so PHP pulled its release forward. The EU’s cyber agency CERT-EU and Britain’s NCSC advised taking systems offline if they could not be patched immediately, and the US NSA issued its own alert. Government sites in the Netherlands and elsewhere went offline. Pinboard, the GrapheneOS forum and OBS took parts of their sites down, and Laravel paused its cloud deployments.
A proof-of-concept exploit circulated online before the patch existed. Cloudflare switched on firewall rules for all customers, free accounts included, about nine hours before disclosure, and said it watched attackers adjusting their payloads against those rules in real time. Calif’s CEO warned that anyone can now run AI against the published patch and produce a working exploit.
What should site owners do right now?
- Check your PHP version. In WordPress, go to Tools, then Site Health, then Info, then Server.
- Update to a fixed release: 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later. On shared hosting this is usually in cPanel under "Select PHP Version" or "MultiPHP Manager", or your host may update it for you.
- If you are on PHP 8.1 or older, move to a supported version. WordPress notes that versions before 8.2 no longer get regular security fixes.
- Put a firewall in front (Cloudflare or your host’s WAF) to buy time, but treat it as a stopgap, not a fix.
- Rotate secrets such as API keys and database passwords if your server was exposed, since the flaw can leak memory.
What does this mean for the AI security race?
It is the clearest example yet of what Microsoft warned about when it said vulnerabilities now get weaponised in under 24 hours. OpenAI called it "one of the most impactful security issues in recent memory" and said it expects "similar findings to increase sharply in the coming months." This time defenders found it first. The same tools will find the next one for attackers, which is exactly the case labs make for giving vetted defenders early access to their strongest cyber models.
Read PHP’s official advisory and The Next Web’s full report.
Part of our coverage of Black October 2026, every major AI security incident this month.
