PHP2Shell: how AI turned an old weakness into an urgent security problem

What happened

PHP is a programming language that runs on web servers. WordPress, Drupal and Joomla are among the systems built on it. Two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, have become known as PHP2Shell. Under the right conditions, they can let attackers run their own code on a server without signing in. The flaws are in PHP itself, so an otherwise carefully maintained website can still be affected. [1, 3]

The PHP team released security updates on October 21, 2026 and urges immediate updating. This is more than a theoretical concern: an attack against Apache with mod_php has been demonstrated that takes effect before the website's own code runs. PHP says operators using other PHP web-server configurations also need to act. This article was checked on October 22, 2026. [1]

Why this is also an AI story

According to OpenAI, security firm Calif identified a critical flaw using GPT-5.6 Sol through the Patch the Planet initiative. Wiz reports independent discoveries and the use of Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol. These tools helped researchers investigate complex bugs and develop working attacks. These are accounts from the organisations involved, not an independent model comparison by Simply Understood. [3, 4]

But the story did not begin with an AI discovery. The PHP Foundation says a developer first noticed signs of the memory problem in 2024. A concrete route to full code execution was not known then; difficult trade-offs and limited resources delayed a fix. A report from Calif in August 2026 made the impact clear. People developed and reviewed the fixes. Saying that AI found something nobody had ever noticed would therefore be misleading. [2]

What makes it dangerous

In simple terms, the problem concerns how PHP handles memory after serious errors. In certain situations, it can keep using incomplete or invalid internal data. Under the right conditions, those memory errors can be turned into attacks. [1, 2]

Wiz demonstrated code execution against test deployments of WordPress, Drupal and Joomla, as well as the extraction of sensitive data from memory. Those demonstrations establish possible consequences, not an attack on every website using these systems. A vulnerable installation is not automatically a compromised one. In its October 21 alert, Canada's Cyber Centre reported no identified active exploitation at that time; that dated observation is not an assurance of safety today. [3, 5]

What website owners should check now

If you run a business website, shop or blog, ask your hosting provider or IT team: does our web server use PHP, and are the fixes for both named CVEs active on every affected instance? Updating WordPress or individual plugins alone does not answer that question, because the flaw is in the PHP runtime beneath them. [1, 3]

The fixed releases published on October 21 are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Linux vendors may also backport the fixes into their own packages, so a bare version number is not sufficient evidence for those packages. PHP 8.1 and older no longer receive regular updates from the PHP project. Vendors may provide their own fixes, but that needs explicit confirmation. [1]

If an immediate update is not possible, Canada's Cyber Centre recommends considering isolation of affected public-facing applications from public networks until a fix can be applied. PHP stresses that interim measures reduce particular attack paths but do not replace the update. Operators should also investigate signs of possible compromise. The responsible operations team should handle the implementation. [1, 5]

What it means for everyday internet users

These updates concern PHP running on web servers. Simply visiting a website does not give you the ability to fix its server. But if you own a website, even without writing any code yourself, you can ask the service provider to confirm that it has applied the updates. [1]

Our view: PHP2Shell illustrates both sides of the same development. AI can help defenders uncover attack possibilities that have remained hidden for years. The same capabilities can speed up attackers' work. What matters is whether a discovery quickly becomes a reviewed fix, and whether that fix actually reaches affected servers. The PHP Foundation also makes clear that this still requires experienced people, clear decisions and sustained funding for maintenance. [2, 4]