Notes from Việt Nam on law, technology, languages, history, culture and travel.

PHP2Shell: AI Models Found a Decade-Old Hole in PHP, and the Patch Window Lasted Minutes

For two years the claim that frontier models would change vulnerability research has mostly come with benchmarks and selected bug counts attached. This week it came with a real incident. On Tuesday, 21 October 2026, the PHP project released emergency patches for two critical remote-code-execution flaws, CVE-2026-109618 and CVE-2026-109619, now known together as PHP2Shell. The bugs are in the PHP runtime, not in any framework or plugin. Both research teams credited with finding them say AI models did a large part of the work, and attackers were exploiting the bugs before the patches shipped.

What happened

According to the PHP security team’s advisory, as reported by BleepingComputer, the flaws affect every PHP installation that serves web requests: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The team rates the risk highest for mod_php. Fixed builds are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For 7.4, 8.0 and 8.1, which the project no longer supports, there are source-level backports but no official binaries. Wikipedia’s article on the incident gives the affected range as PHP 5.4 through 8.5. The PHP developers scored the issue 9.2 (critical) under CVSS v4.0. watchTowr, the security firm, scored it 10.0.

Two groups found the bugs independently:

  • Calif, a California AI red-teaming firm, was invited into OpenAI’s “Patch the Planet” effort, which Fortune describes as an attempt “to proactively find and patch security vulnerabilities in digital infrastructure.” Calif picked PHP as a high-impact target and found the first issue in August using GPT-5.6 Sol. Fortune dates that to 1 August, while Al Jazeera, citing OpenAI, says 11 August. OpenAI then dug further and found more parts of the chain.
  • Wiz says it found its first PHP bug on 19 August using “Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol.” It confirmed unauthenticated RCE on Drupal on 20 August and on WordPress on 21 August, reported to PHP on 24 August, and says PHP acknowledged the report on 21 September.

The patch was meant to be coordinated, but the details got out early. PHP pre-announced the release on 20 October and reserved the right to ship sooner “should details of either vulnerability become public.” That evening the news reached Hacker News, and Wikipedia’s account says Calif mistakenly published a proof-of-concept video. Amazon Threat Intelligence says its MadPot honeypots recorded an exploitation attempt dating back to 17 October. After publication, Cloudflare CEO Matthew Prince reported, via Fortune, “tens of thousands” of exploit attempts within 45 minutes, “hundreds of thousands” within two hours, and millions by that evening. AWS described the flaw as “now being broadly exploited in the wild.”

Governments reacted unusually hard. The UK’s NCSC told organisations to patch immediately “or take them offline until they can be patched.” According to Al Jazeera and Reuters, agencies in Germany, France, Belgium, the Netherlands, Finland and the Czech Republic took websites down while they patched. The US NSA put out an advisory, and Japan’s prime minister posted a warning.

The technical substance

The bugs are not in application code. Wiz says “even a simple ‘Hello World’ application” can be vulnerable. All of them are memory-safety bugs in how PHP recovers from fatal errors partway through a request, especially out-of-memory errors. PHP’s model is that each request gets a fresh heap and the heap is discarded afterwards. The bugs break that model: a request can force a fatal OOM halfway through, the heap is destroyed, and some process-global pointers survive into the next request handled by the same worker. Wiz describes several such paths:

  • Session upload progress. The Session module decodes upload-progress data early, before normal initialisation. If an allocation fails while it is doing so, the unserializer’s global bookkeeping (BG(unserialize)) can stay published. A later request can then make PHP treat attacker-controlled memory as live unserializer state. A related path leaves PS(id) pointing at freed memory, and PHP then URL-encodes whatever reclaimed heap memory it finds into a PHPSESSID response cookie. That is a remote memory leak, and Wiz says it works “even when the application never calls session_start().”
  • Fatal-error backtraces. EG(last_fatal_error_backtrace) can outlive the heap it points into, which gives a use-after-free on the next request.
  • OPcache. A process-local index in zend_accel_script_persist() moves forward before the shared state is published. An allocation failure between the two steps can leave a shared-memory slot marked free while it is still in use, so another worker can reuse it and cause type confusion.

A memory leak that gets around ASLR, combined with use-after-free bugs that survive across requests on long-lived workers, is enough for pre-authentication RCE. Wiz demonstrated it against WordPress, Drupal and Joomla. Wiz also says exploitation is “notoriously complex” and needs tuning for each target. That fits Prince’s numbers: millions of attempts do not mean millions of compromised servers.

Interim mitigations from the advisory include session.upload_progress.enabled=0 with a restart of every worker, a low post_max_size, fatal_error_backtraces=0 on 8.5, and per-worker memory limits enforced by cgroups. PHP says plainly that these “don’t fully protect against exploitation.” The real fix is to upgrade. If you run PHP in containers, rebuild your images: pulling a new base tag does not replace a long-running FPM process.

Why it matters

The bug class is not new. Wikipedia says a PHP core developer found the OOM problem during an audit in 2024, and it was never fixed because the team could not agree on a remedy. Fortune says a limited version “wasn’t considered significant at the time.” What changed was how cheap it became to turn a known weakness into a working chain. Wiz’s write-up says “a single researcher completed in a week what previously would have taken a world-class team months of work.” That is a vendor’s claim and cannot be checked from outside. Still, two independent teams, both using frontier models, reached the same deep runtime bugs within weeks of each other. That makes “AI-assisted bug hunting at internet scale” look like something that already happens rather than a forecast.

The other lesson is about time. The usual disclosure process assumes a few quiet weeks between a private report and a public fix. In this case details leaked a day early, a downstream distributor’s early patched build reportedly showed attackers what had changed, and mass scanning started within minutes of disclosure. The PHP team’s own conclusion was: “Tools now find bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing.” For developers, how fast you can patch is now a security property, and that includes knowing which runtime version is actually running in every container.

Open questions

  • Scale. Headlines say “70% of the internet.” That figure is PHP’s share of websites, roughly 69–70% by most counts, not a count of exploitable servers. Palo Alto Networks counted about 22.6 million potentially vulnerable instances. How many were actually compromised is not yet known.
  • Credit and framing. OpenAI, Google (which owns Wiz) and their partners all have commercial reasons to present this as an “AI inflection point.” The sources do not show how much of the work was model-driven and how much was human expertise in the process, for example whether the models proposed the exploit chain or a researcher used them to speed up auditing.
  • The offensive side. OpenAI’s own statement acknowledges that “the same capabilities can also help attackers rapidly develop offensive tools and exploits.” There is no public evidence yet on whether the in-the-wild exploits were themselves built with AI.

What is not in dispute is that the first internet-scale vulnerability publicly credited to frontier models has arrived, and that it hit the language running a large share of the web.

Sources