PHP2Shell: AI Helped Find a 14-Year-Old Flaw in PHP — and Governments Took Their Websites Offline

On Wednesday morning, government websites across Europe started switching off.

Not because they’d been hacked. Because their owners were scared they might be.

The cause was a pair of security flaws in PHP — the programming language quietly running a huge chunk of the web — now known together as PHP2Shell. Both flaws let an attacker run code on a vulnerable server without any password. And the strangest part of the whole story? The bugs had been sitting in PHP since 2012. What finally exposed them, fourteen years later, was security researchers working side by side with AI.

Here’s what actually happened, what the flaws really are, and what you should do if any of your websites run on PHP — including a WordPress site.

The short version

• Two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, let an attacker execute code on a web server with no login, no password, no trick link to click. The PHP project rates both 9.2 out of 10 for severity (the US National Vulnerability Database scores them 9.8 on its older scale — same flaws, different ruler).
• They affect every PHP version before the patched ones, in every branch, plus old end-of-life versions that will never get an official PHP fix.
• The patches landed on 21 October 2026 (full details in PHP’s official release archive): PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP’s own advice is blunt: “There are no complete mitigations, updating is the only safe choice.”
• Governments in the Netherlands, Finland, Germany, France, Belgium and beyond took websites offline as a precaution. Read that last part again: as of 22 October, no website has been confirmed breached through these flaws. A lot of early headlines blurred that line. We won’t.
• The flaws surfaced through audits where AI models did real discovery work next to human researchers — at the security firms Calif and Wiz, and at OpenAI.

Why one bug in PHP scares everybody

If you’ve never thought about PHP, you’ve still used it today. It’s the code on the server that builds the page before your browser ever sees it — WordPress blogs, Wikipedia, online shops, government portals. According to web tracker W3Techs (via Reuters), PHP runs nearly 70% of all websites whose server-side language can be identified, and WordPress alone powers around 40% of all websites on Earth.

That’s why this isn’t “a bug in some app.” A flaw in a single website endangers that website. A flaw in PHP itself is a skeleton key lying next to millions of doors — including servers whose owners don’t even know PHP is installed, because it came bundled inside something else.

The two flaws, in plain English

CVE-2026-109618 — the “out of memory” flaw. When PHP runs out of memory mid-request, it bails out abruptly using a mechanism called longjmp(). Researchers found that memory for a new request can be reachable before it’s fully set up. So when an allocation fails at exactly the wrong moment, half-formed data survives into the request’s shutdown phase — and the shutdown code trusts it. An attacker can force that failure on purpose, with crafted upload requests that look small but blow up internally. Result: the attacker’s code runs on your server.

CVE-2026-109619 — the “stale memory” flaw. PHP’s long-running workers reuse memory between requests. This bug leaves a piece of global state pointing at memory that belonged to an earlier request — memory that’s already been freed. Line up two cooperating requests on the same worker (a “producer” and a “consumer”) and the second one can be steered into using that stale pointer. It’s a textbook use-after-free, and besides running code it can leak whatever is sitting in the server’s memory.

What does a successful attack actually get? Code running with the web worker’s privileges. That means reading your application’s source code and config files. Stored credentials — database passwords, API keys. And through that memory leak, live passwords, login tokens and certificates passing through the server. No account needed. Nobody has to click anything.

Every way of serving PHP is in scope — PHP-FPM, Apache’s mod_php, php-cgi, FrankenPHP, LiteSpeed. The risk is worst on mod_php, where a working exploit was shown to fire before any application code runs — meaning before WordPress, or any security plugin, even loads. One honest footnote: for the first flaw, a complete exploit was proven on mod_php; PHP-FPM is affected by the same code, though a full FPM exploit for that particular bug wasn’t demonstrated. The second flaw was confirmed on both.

And here’s the part that should make every developer pause. The vulnerable code path dates back to PHP 5.4.0, released in 2012. Related warning signs appeared in 2004, again in a PHP bug report in 2020, and again in a 2024 security audit by OSTIF and Quarkslab — which actually spotted the out-of-memory issue but couldn’t prove it could be exploited. Then the fix work stalled. The PHP Foundation has called that delay, in its own words, “a structural failure.”

Why governments pulled the plug

The official guidance was unusually blunt, and nearly identical everywhere. America’s CISA told organisations to patch immediately — and said anyone who couldn’t, especially anyone still running PHP 8.1 or older, should take their PHP systems offline in the meantime. The EU’s CERT-EU said patch now, or isolate internet-facing applications from public networks. Britain’s NCSC said if your mitigations will take too long, consider switching the system off. The NSA and FBI pushed out the same message — notably, only as posts on X, with no formal web advisory.

Plenty of organisations took the advice literally:

• In the Netherlands, the wave of shutdowns included the National Cyber Security Centre itself, the central government portal Overheid.nl, the Port of Rotterdam, the football association KNVB, the five biggest political parties’ websites and hospital sites. Dutch reporting also listed parliament’s site and the DigiD and MijnOverheid services — though whether the DigiD login itself went down is contested in local reporting.
• Finland’s state IT provider Valtori shut the government’s public web services “as a precautionary measure” — and stressed it had not identified any exploit attempt, and that this was not a data breach.
• Germany’s federal IT provider ITZBund took several sites offline; officials called it “purely preventive,” with no security incidents known.
• France took prefecture websites down as a precaution while waiting for the patch. Belgium’s Foreign Ministry sites went offline too, while its cyber centre noted no attacks recorded in Belgium.
• The Wikimedia Foundation took “a number of other systems” down as a precaution — support systems, not Wikipedia itself.
• In Australia, New South Wales confirmed on 22 October that some sites were temporarily down as a precaution and that no agency had reported a breach.

UK coverage also reported BBC programme pages and Edinburgh Council sites going offline around the same time, though the direct link to PHP2Shell is less firmly documented there.

Now the sentence that matters most in this entire article: nobody — not CISA, not the Australians, not the Canadians, not any European agency — has confirmed a single breach through these flaws. People definitely tried. Amazon’s honeypot network caught the first known exploitation attempt on 17 October, four days before the patches were even public — how that attacker knew remains unexplained. And after disclosure, attack traffic exploded: Cloudflare’s CEO described thousands of attempts before the announcement, tens of thousands within 45 minutes of it, and hundreds of thousands within two hours. But attempts are not breaches. Security firm watchTowr found that the proof-of-concept code circulating after disclosure didn’t actually achieve code execution, and the PHP Foundation said no functional exploits had been identified at disclosure time. The shutdowns were a fire drill. A very justified one — but a drill, not a crime scene.

So did AI really find a 14-year-old bug?

This is where the story gets genuinely interesting — and where it’s worth being precise, because “AI found the bug” is both true and not the whole truth.

The PHP Foundation’s timeline starts on 30 July 2026, when a small security firm called Calif began auditing PHP. Working there was researcher Ryan Austin, who used an AI model the way you’d use a very tireless junior partner. The Calif team’s own account is refreshingly honest about this: a human directed the work. The model — OpenAI’s GPT-5.6 Sol — was used as a “companion” that helped spot an ordering bug. Then came the clever bit: the team had the model generalise what it had found into a reusable checklist (a file they call a SKILL.md), and following that checklist led them to the second bug, hiding in PHP’s session upload-progress feature.

On 11 August, Calif reported unconditional remote code execution to the PHP team — the same root cause the 2024 human audit had spotted but couldn’t prove. Remarkably, OpenAI independently reported the same root cause that same day; OpenAI later said publicly that Calif identified the flaw using GPT-5.6 Sol as part of its “Patch the Planet” initiative. Days later, cloud security giant Wiz arrived at both bugs too, using its own AI tooling (called Wiz Atlas) together with Google’s Gemini 4 Argon and GPT-5.6 Sol — crediting the AI with helping in discovery, exploit development, attack detection and checking the patch. A Google DeepMind researcher quoted by Wiz called frontier AI “a game-changer for cyber defense.” Wiz says the flaws “rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,” and that a single researcher did in a week what once took a world-class team months.

Hold both facts at once, because both are true: the AI did real, credited discovery work — and it was steered by humans at every step. Calif says it plainly: “No model is simply capable of unearthing ‘all bugs’ with simple prompts. At least for now.” Three different teams converging on the same flaws within two weeks tells you this is a genuine shift in how security research gets done — not a press release.

New to the machinery behind all this? Two of our explainers cover the ground this story runs on: how large language models actually work and what an AI agent is — plus AI agents in the workplace for where it is heading next.

For the record: OpenAI has committed $1 billion in subsidised access to its Daybreak security programme off the back of this work. (An early figure of $10 billion floating around was wrong.)

The week everything leaked, rushed and shipped early

The disclosure itself nearly went off the rails. On 20 October, the CVE numbers leaked early — with the wrong severity score (a scary “10.0” that the PHP Foundation says was simply incorrect) and a wrong release time. No technical details leaked, thankfully. The PHP team pulled its announcement forward and moved the release from Thursday 22 October to Wednesday 21 October. That evening, Calif mistakenly published a proof-of-concept video; it was deleted, but copies had already circulated. On release morning, a security vendor broke the embargo by publishing patched images early. Through all of it, the patches shipped on 21 October — and, as covered above, governments spent the day deciding which of their websites to switch off first.

On scale, treat every number as an estimate with a method behind it, because the methods disagree: Palo Alto’s Unit 42 counted more than 22.6 million internet-exposed instances that “might be vulnerable”; Censys found roughly 1.57 million unpatched hosts among the ~1.58 million that report a PHP version (out of 2.58 million it could see at all); VulnCheck counted over 2.6 million hosts, more than a million of them running end-of-life PHP. Whichever figure you pick, the exposed surface is enormous.

What to do if you run a PHP website

Keep it simple, because the fix genuinely is simple:

1. Update PHP. The safe versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — or anything newer. This is the only complete fix. Restart your PHP workers afterwards.
2. On PHP 8.1 or older? There’s no official PHP release for you. Use your Linux distribution’s or hosting vendor’s patched packages — the PHP security team also published minimal source backports for 7.4, 8.0 and 8.1. And honestly, treat this as the push to finally upgrade; end-of-life PHP is exactly what CISA told people to take offline.
3. Can’t update today? The official partial mitigations buy you time, nothing more: set memory_limit=-1 in a way that can’t be overridden alongside a low post_max_size; disable session.upload_progress in php.ini or the FPM pool config (not via ini_set or .user.ini) and restart all workers; on PHP 8.5, set fatal_error_backtraces=0. One warning from the advisories: do not reach for RLIMIT_AS or RLIMIT_DATA — they can actually help trigger the first flaw.
4. WordPress users: you do not need a WordPress update, because the bug isn’t in WordPress — it’s in PHP itself, underneath it. What you need is your host to update PHP. Check your version under Tools → Site Health in your dashboard, and if it’s below the patched numbers, open a ticket with your host today. A security plugin cannot save you here: on the highest-risk setups the attack can fire before WordPress even loads.
5. Check for backdoors. Britain’s NCSC advises looking for signs of compromise if you were exposed — new admin users, unknown files, strange scheduled tasks. Nothing has been confirmed exploited at scale, but checking costs little.

FAQs

Was my website hacked by PHP2Shell?
Almost certainly not — as of 22 October 2026, no breach has been confirmed anywhere by any agency or company that has spoken publicly. Attack attempts are widespread, which is exactly why patching now matters.

Is WordPress itself vulnerable?
WordPress code has no flaw here. The vulnerability is in PHP, the language WordPress runs on. If your server’s PHP is unpatched, your WordPress site is exposed through it.

Which PHP versions are safe?
8.5.12, 8.4.27, 8.3.36 and 8.2.35 and above. Anything earlier in those branches — and everything 8.1 or older without a vendor patch — should be treated as vulnerable.

Can a firewall or security plugin protect me instead of updating?
Only partially. CISA says a web application firewall “may provide some protection,” and Cloudflare switched on WAF protections for its customers on 21 October. But both PHP and CISA are clear that these are stopgaps. Updating is the fix.

Did an AI really discover these vulnerabilities?
AI models — OpenAI’s GPT-5.6 Sol and Google’s Gemini 4 Argon — did genuine discovery work, but inside human-led audits run by researchers at Calif, Wiz and OpenAI. The humans aimed the tools, judged the results and proved the exploits. “AI-assisted and human-led” is the accurate description.

Why did governments take websites offline if nothing was breached?
Because the flaws need no password and affect an enormous share of the web, agencies judged a few hours of downtime cheaper than even a small chance of compromise. Finland, Germany, Belgium and New South Wales all said the same thing in their own words: precaution, not breach.

---

Sources: PHP.net and the PHP Foundation, CISA (21 Oct 2026), CERT-EU advisory 2026-018, UK NCSC, the GitHub security advisories for both CVEs, Calif, Wiz, OpenAI (all 21 Oct 2026), and Reuters reporting of 21–22 Oct 2026. Exposure figures are attributed to Unit 42, Censys and VulnCheck as published. This article will be updated if confirmed exploitation is reported.