On October 21, 2026, the PHP project issued emergency updates for two critical vulnerabilities in the PHP runtime itself. Collectively nicknamed PHP2Shell, the flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Both carry a CVSS 4.0 severity score of 9.2 out of 10 and can enable unauthenticated remote code execution under certain conditions.

The story has another unusual protagonist: artificial intelligence deployed by defensive security researchers. Calif, OpenAI, and Wiz described how frontier models helped turn longstanding, extremely difficult-to-exploit defects into practical demonstrations. PHP maintainers coordinated the fixes with researchers and infrastructure providers.

Headlines describe a threat to “70% of the Internet.” This is an eye-catching way to express the potential blast radius, but it does not mean that 70% of websites have been hacked or are about to go offline. Understanding that distinction matters as much as applying updates.

What was actually discovered?

This is not a weak password or a vulnerability in a particular WordPress plugin. It involves memory management and fatal-error handling in PHP’s core engine. Consequently, applications built on top of PHP can be exposed even when their own business logic is correctly written.

The two identifiers cover related but distinct mechanisms:

VulnerabilityWhat goes wrongDemonstrated risk
CVE-2026-109618An out-of-memory (OOM) error interrupts a request while internal structures are only partially initialized. Subsequent cleanup may interpret them as valid.Memory corruption and remote code execution.
CVE-2026-109619Global state can retain a reference to memory freed after an earlier request. A subsequent request may reuse that stale state.Use-after-free, memory exposure or corruption, and demonstrated remote code execution in certain scenarios.

An important nuance: under Apache with mod_php, an unauthenticated HTTP request can trigger vulnerable behavior before any application code executes. Other server configurations, including PHP-FPM, also warrant review. Switching web servers does not automatically eliminate the exposure.

Wiz researchers demonstrated exploitation against deployments using WordPress, Drupal, and Joomla. Those content management systems did not cause the PHP engine bugs: they are representative applications that depend on the affected runtime.

Does PHP2Shell really threaten 70% of the Internet?

Research teams and infrastructure providers frequently cite an estimate that PHP powers close to seven out of ten websites. But three different quantities are being conflated:

  1. Language adoption: how many websites rely on PHP in some capacity.
  2. Technical exposure: how many installations run unfixed PHP packages in a reachable configuration.
  3. Confirmed compromise: how many systems attackers have actually taken over.

The first figure cannot be used as a measurement of the other two. A managed WordPress installation may already be patched; a little-visited standalone PHP server may remain vulnerable.

What makes this incident exceptional is the ubiquity of the shared dependency. A runtime bug can affect thousands of software products and hosting configurations without requiring a separate application-level coding error in each one.

What did AI contribute—and what did humans already know?

The PHP Foundation acknowledges that signs of the OOM-related defect had emerged in a security audit back in 2024. An exploit was theorized, but no practical attack path had been established, and developers faced difficult compatibility and performance trade-offs in fixing it. Limited resources and internal decision-making also slowed progress.

This history is crucial: AI did not introduce the bug, nor was it the first to suspect that something was wrong. Its major contribution was helping researchers validate impact, connect failure paths, construct reproducible demonstrations, and accelerate coordinated response.

According to the organizations involved:

  • Calif used GPT-5.6 Sol through OpenAI’s Patch the Planet initiative. The PHP Foundation dates key independent reports from Calif and OpenAI to August 11, 2026.
  • Wiz says its team combined Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol. It discovered related vulnerabilities in August and reported its findings to PHP on August 24. Its technical analysis describes demonstrations involving several major CMS platforms.
  • Human PHP maintainers evaluated reports, modified and tested the runtime, coordinated fixes, and released the corrected versions. This was not a case of an AI model autonomously pushing patches into production.

The point is not that any chatbot can compromise a web server. It is that, given sophisticated tools, test environments, specialized expertise, and advanced models, the cost of researching complex vulnerabilities can fall dramatically. That advantage is available to defenders and potentially to attackers.

The defensive window—and the disclosure leak

The coordinated disclosure was originally planned for October 22. On October 20, however, CVE identifiers and incorrect severity information circulated publicly. The PHP Foundation reports that an inadvertently published demonstration video and the premature release of patched images further complicated the embargo.

The release was therefore moved forward to October 21, 2026.

Cloudflare said it had prepared and enabled web application firewall (WAF) rules for its customers, and had observed attack traffic along with mutations of the suspicious requests. Observed attempts are not proof of widespread successful compromise. PHP’s security team separately reported that it had not identified a functional exploit at the time of the coordinated release; the organizations were describing different evidence collected at different moments.

This reveals the industry’s central tension: finding vulnerabilities faster only helps defenders when finding, preparing, and deploying fixes speeds up as well.

What server operators should do now

The official PHP advisory urges immediate updates. The patched releases for supported PHP branches are:

PHP branchPatched release
8.58.5.12
8.48.4.27
8.38.3.36
8.28.2.35

Branches 8.1 and earlier are no longer maintained by the PHP project. Some Linux distributions and long-term support vendors ship security backports, so an Ubuntu or Debian package showing an older upstream version number is not necessarily unpatched. Verify the actual package security status against the distributor’s advisory.

An effective response follows a clear sequence:

  1. Inventory all internet-facing PHP instances, including PHP-FPM, mod_php, containers, images, appliances, and embedded dependencies. The output of php -v applies to that particular executable; it may not match the PHP worker serving a website.
  2. Install the corrected vendor package or upgrade to an official fixed release. For managed hosting, confirm what the provider has actually deployed.
  3. Restart the affected workers or services so they no longer use the previously loaded vulnerable runtime, and verify the active service rather than only the package database.
  4. Investigate suspicious logs and potential indicators of compromise. A patch closes future exposure but cannot retroactively undo an intrusion.
  5. Use WAF rules and configuration mitigations only as temporary defense in depth. PHP explicitly warns that no alternative mitigation is complete.

Canonical has published corrected Ubuntu packages, including backported builds for multiple Ubuntu releases. Availability depends on each system’s support coverage and configured repositories.

Scope note: if a service truly runs only on Python, Node.js, or another runtime, with no PHP in its serving stack or dependencies, these two CVEs do not directly affect that runtime. Indirect dependencies should still be checked.

What changes after PHP2Shell?

The incident illustrates two truths at once: memory-safety defects can survive for years in foundational infrastructure, and AI can make it economically feasible to explore exploit chains that once required exceptional amounts of human time.

It also shows that better models alone are insufficient. Security needs funded maintainers, responsible disclosure channels, distributors prepared to deliver patches, regression testing, and operators who actually deploy updates.

The real story is not that AI “took down 70% of the Internet.” It is that AI is changing the pace at which deeply buried weaknesses in shared infrastructure can be discovered—and potentially exploited. The immediate test for the industry is not the headline; it is the speed and reach of patch adoption.

Sources and further reading