PHP2Shell: AI Found Two Critical PHP Bugs — Governments Are Taking Websites Offline

PHP2Shell: AI Found Two Critical PHP Bugs — Governments Are Taking Websites Offline

Two critical vulnerabilities in PHP itself — the language behind roughly 43% of all websites — can let an unauthenticated attacker run code on a server from the internet, and they were found not by a human hacker but by AI. Researchers have dubbed the pair "PHP2Shell." The bugs sat hidden in PHP's code for about 14 years before AI systems from OpenAI and others surfaced them this year. Emergency patches shipped on October 21, 2026, after the disclosure leaked early — and several European governments took official websites offline as a precaution while they scramble to update.

PHP2Shell: two remote-code-execution flaws, rated 9.2 out of 10, sat in PHP for roughly 14 years before AI found them. (Illustration: CloudEmythos)

What Happened

The short version: two new vulnerabilities — CVE-2026-109618 and CVE-2026-109619, each rated CVSS 9.2 — allow remote code execution against PHP servers with no login required, and the PHP project released emergency fixed versions on October 21. According to Ars Technica's reporting, the disclosure had been planned for October 22, but details leaked early on October 20, including a screenshot of an exploit tool. That forced PHP to rush out the patches a day ahead of schedule.

The impact list explains the rush. Governments across Europe took websites offline as a precaution rather than risk leaving them exposed: the Netherlands pulled down DigiD (its national login system), MijnOverheid, the parliament's Tweede Kamer site, and even the website of its own national cyber agency, the NCSC. Finland took state services offline, French prefecture sites went down, and Germany, Austria, and Belgium were also affected — in Belgium, the closures included hospitals, the Vrije Universiteit Brussel, and DPG Media sites. Australia's cyber agency said it was not aware of active exploitation. Cloudflare, meanwhile, reported seeing early attacks and pushed out firewall rules to all customers, including those on free plans, according to the company's Dane Knecht.

An honesty note up front: the scale of real-world exploitation is not yet confirmed. "Early attacks" reported by one major network operator is not the same as a mass-compromise event, and claims about how many sites have actually been breached should be treated as unproven until investigators publish evidence.

The AI Angle: The Bug Hunters Were Machines

The most consequential part of this story is who found the bugs: AI systems did, under a defensive program, before criminals are known to have weaponized them. The vulnerabilities are around 14 years old. They survived years of human code review, security audits, and bug bounties in one of the most scrutinized open-source projects on earth — and then AI found them in a matter of months.

The timeline, as reported by Ars Technica and Decrypt: in August, the security firm Calif used OpenAI's GPT-5.6 Sol to find the flaws under OpenAI's "Patch the Planet" initiative, a defensive program aimed at finding and fixing critical bugs in widely used software before attackers do. In September, OpenAI's own team found a fuller version of the issues. The cloud security firm Wiz found both bugs independently. OpenAI President Greg Brockman has publicly confirmed the AI-assisted discovery, and the PHP project moved to patch once the findings were verified.

This is the defensive-AI race made concrete. The same class of model that can scan millions of lines of legacy code for subtle memory and logic errors can, in other hands, be pointed at the same code to build exploits. What decided the outcome here was sequencing: a coordinated program found the bugs, verified them, and got patches written before the leak on October 20 collapsed the timeline. The lesson for the industry is uncomfortable and clear — legacy code that "everyone has looked at" has not necessarily been looked at the way a modern AI looks at it, and defenders now need AI-speed auditing to match AI-speed offense.

The Flaw, in Plain English

In plain terms: a specially crafted request sent to a vulnerable PHP server can trick it into running the attacker's code as if it were part of the website itself — no password, no account, no user interaction needed. Both vulnerabilities are rated CVSS 9.2, near the top of the severity scale, precisely because they are remotely exploitable and unauthenticated.

A few definitions for non-specialists. PHP is the programming language that runs on the server — the computer that delivers a website — for a huge share of the web, including most WordPress sites. "Remote code execution" (RCE) is the worst class of web vulnerability: instead of merely reading data, the attacker gets to give the server instructions, which can mean installing a backdoor, stealing the site's database, or using the server to attack others. The exposure is worst on servers running PHP through mod_php, the classic Apache setup, according to the reporting. The PHP project estimates more than 22 million PHP installations are exposed to these flaws, and PHP's own guidance is blunt: there are no complete mitigations — updating is the only safe choice.

Why did two bugs hide for 14 years? Because they live in subtle, rarely exercised corners of a very old codebase, the kind of edge cases human reviewers skim past and traditional scanners were not built to reason about. That is exactly the terrain where large language models, reading code for logic rather than patterns, have started to outperform older tooling.

What To Do If You Run a PHP or WordPress Site

Update PHP on your server to a patched version today: 8.5.12, 8.4.27, 8.3.36, or 8.2.35, depending on your branch — and if you are on PHP 8.1 or older, you are in the danger zone, because those versions receive no official fix. Here is the checklist, in order.

The only complete fix is updating PHP itself on the server — a firewall can buy time, but it does not patch the flaw. (Illustration: CloudEmythos)

1. Check the server's PHP version — not just WordPress. Updating WordPress core and plugins does not update PHP itself; PHP is part of your hosting stack. In WordPress, go to Tools → Site Health → Info → Server to see the PHP version. On a server you manage, run php -v. Compare what you find against the patched versions above.

2. Update PHP through your host or server panel. Most managed hosts offer a PHP version switcher in their control panel (cPanel, Plesk, or a custom dashboard). Pick the newest patched version your site supports, test the site afterward, and keep a backup from before the change. If you self-manage, update through your operating system's package manager or the official PHP downloads, then restart your web server or PHP-FPM service.

3. If you are on PHP 8.1 or older, treat this as urgent. PHP is not issuing an official fix for 8.1 and below. Your options are to upgrade to a supported, patched branch (the right long-term move), take the site offline until you can, or obtain backported patches through a commercial extended-support provider. Leaving an unpatched, end-of-life PHP exposed on the internet is the highest-risk configuration in this incident.

4. Use a web application firewall as a seatbelt, not a cure. Cloudflare has already deployed WAF rules covering these vulnerabilities for all customers, including free plans, and other WAF vendors are doing the same. That meaningfully reduces your risk while you patch, but virtual patching can be bypassed and does not fix the underlying flaw. The PHP project's position stands: there are no complete mitigations, and updating is the only safe choice.

5. Look for signs of compromise if you were exposed. If your server ran a vulnerable version with mod_php while details were circulating, review access logs for unusual requests, check for new or changed files and unknown admin accounts, and rotate credentials if anything looks off. Australia's cyber agency said it was not aware of active exploitation, but "not aware" is a reason to check calmly, not a reason to skip checking.

What This Means Beyond One Bad Week

PHP2Shell is a preview of the next decade of security: AI systems are now finding critical, decade-old flaws in the world's most important code faster than the ecosystem can patch them — and the bottleneck is no longer discovery, it is updating. More than 22 million installations need a server-level change that many site owners do not even know is theirs to make, because PHP versions are set by hosts, inherited from old setups, or frozen by compatibility fears.

FAQ

What is PHP2Shell?
PHP2Shell is the name researchers gave to a pair of critical vulnerabilities in PHP itself — CVE-2026-109618 and CVE-2026-109619, each rated CVSS 9.2. Both allow unauthenticated remote code execution, meaning an attacker on the internet can run code on a vulnerable server without any login. The flaws are roughly 14 years old and were found with the help of AI.

How was AI involved in finding the bugs?
According to Ars Technica and Decrypt, the security firm Calif used OpenAI's GPT-5.6 Sol under OpenAI's "Patch the Planet" defensive initiative to surface the flaws in August; OpenAI's own team found a fuller version in September, and Wiz found both bugs independently. OpenAI President Greg Brockman publicly confirmed the AI-assisted discovery. The point of the program was defensive: find and fix critical bugs in widely used software before attackers exploit them.

Which PHP versions are safe, and which are not?
The patched releases issued on October 21, 2026 are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 — if your server runs one of those (or later), you have the official fix. Earlier releases on those branches are vulnerable. PHP 8.1 and older receive no official fix at all, so those installations must upgrade, go offline, or use backported patches from an extended-support provider.

I have a WordPress site. Am I affected, and what do I do?
If your hosting runs a vulnerable PHP version, yes — the flaw is in PHP itself, not in WordPress, so updating WordPress and plugins alone does not fix it. Check your PHP version under Tools → Site Health → Info → Server, then update PHP through your hosting control panel to a patched version (8.5.12, 8.4.27, 8.3.36, or 8.2.35). A firewall such as Cloudflare's, which has already deployed rules for these flaws, reduces risk while you update but does not replace the patch.

Have the vulnerabilities actually been exploited?
The confirmed picture is limited. Cloudflare reported seeing early attacks and deployed protective firewall rules for all customers, while Australia's cyber agency said it was not aware of active exploitation. The disclosure leaked early on October 20, including a screenshot of an exploit tool, which raises the risk that working exploits circulate. Treat your exposure seriously and patch, but treat dramatic claims about mass breaches as unconfirmed until investigators publish evidence.

Sources

Sources: Ars Technica, reporting on the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619), the AI-assisted discovery under OpenAI's "Patch the Planet" initiative, and the government website outages (October 2026) — arstechnica.com; PHP project, security release announcements for PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 — php.net; Decrypt, reporting on the AI discovery and disclosure timeline (October 2026) — decrypt.co; ITDaily, reporting on affected European government and institutional websites (October 2026) — itdaily.be. Exploitation-scale claims are attributed to the named organizations as reported; no independent confirmation of large-scale compromise was available at the time of wr