Full Breakdown
AI-Driven Discovery and Patch of the PHP2Shell Vulnerabilities
By Drooid · · How we work
Core Event
On October 21 2026 the PHP development team released emergency updates (PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12) that fixed two remote-code-execution flaws—CVE-2026-109618 and CVE-2026-109619—collectively dubbed PHP2Shell. The flaws let an unauthenticated attacker execute arbitrary code on any server running PHP 5.4 through 8.5. Researchers using a large-language model identified practical exploit chains in August 2024, prompting a coordinated public disclosure and rapid rollout of patches.
Background & Context
The vulnerability’s theoretical existence was first flagged in July 2004 by security researcher Stefan Esser. A partial fix arrived in 2020, but a related flaw remained unaddressed in 2024. In late July 2024, researchers at the AI-security firm Calif, working with OpenAI’s “Patch the Planet” initiative, tasked a large-language model with probing PHP. By August 1 2024 the model produced multiple exploit methods, which were independently confirmed by Google-backed firm Wiz. The episode challenged the long-standing “security by exhaustion” assumption that only labor-intensive attacks could be practical.
Data & Statistics
- PHP powers ? 70 % of the world’s websites.
- Both CVEs carry a CVSS base score of 9.2.
- October 17 2026: Amazon honeypots logged an exploit attempt against CVE-2026-109618, four days before public disclosure.
- Within 45 minutes of the October 21 disclosure, Cloudflare observed attempts rise from tens of thousands to millions by early October 22 2026.
- A separate advisory on October 23 2026 introduced CVE-2026-115560, which remains unfixed and lacks a severity rating.
Official Statements & Responses
- The U.S. National Security Agency issued an urgent advisory on October 21 2026, directing organizations to apply the PHP patches immediately or take vulnerable systems offline.
- OpenAI announced the discovery as part of its “Patch the Planet” program and released the open-source php2shell-checker tool on GitHub.
- Cloudflare deployed firewall rules after collaborating with OpenAI, Wiz, and other researchers, warning that the flaws could expose server data and enable unauthorized code execution.
- The PHP Foundation urged instant installation of the October 21 updates, noting that temporary mitigations cannot fully eliminate the risk and that unsupported PHP releases will not receive emergency fixes.
Conflicting Reports & Gaps
- While exploit activity for CVE-2026-109618/-109619 surged after disclosure, no attacks have been reported against the newly announced CVE-2026-115560. The advisory provides no severity score or affected-version list, leaving the true risk unclear.
- The PHP Foundation does not know whether CVE-2026-115560 shares a root cause with CVE-2026-109619, creating uncertainty for remediation planning.
Verbatim Quotes
- “The security industry has long been warning about the coming security apocalypse, because AI can do these things very, very quickly – better than humans,” — Vyas Sekar, professor of computer engineering at Carnegie Mellon University
- “Taking a theoretical (vulnerability) and proving you can exploit it is quite tedious and mechanical work,” — Nick Rogers, CEO of Fieldwork AI
- “Migrating away from PHP is a pretty expensive process,” — Adam Meyers, vice president of counter adversary at CrowdStrike