PHP2Shell: Two Critical Flaws Threaten ~70% of Websites, Discovered with AI Help

What happened

On Oct 21, the PHP development team released emergency security updates fixing two critical vulnerabilities collectively called PHP2Shell: CVE-2026-109618 and CVE-2026-109619, both rated 9.2 (critical) under CVSS v4.0. The fixes ship in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. GitHub security advisories went out at 13:34 UTC on Oct 21 (21:34 Beijing time), with php.net updated shortly after.

The flaws were found independently by security firms Wiz and Calif. Wiz researchers said they used three AI models throughout the research: Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol; Calif found them through OpenAI's "Patch the Planet" project. OpenAI said its models helped researchers find the flaws, and Quarkslab also took part in the coordinated disclosure. Wiz researchers described the findings as among the most severe vulnerabilities in PHP history; the defects had sat unnoticed for decades, and frontier AI models substantially lowered the bar for proving them exploitable.

Details leaked early on Oct 20 (a Hacker News post, with security firm watchTowr confirming the flaws were real), ahead of a planned coordinated disclosure on Oct 22; after the leak, the PHP team moved the patch release up to Oct 21. Before the patch landed, several European organizations took websites offline as a precaution following CERT-EU advice, including the Dutch government services DigiD and MijnOverheid and the Dutch House of Representatives' website; several services in Japan also went into emergency maintenance.

Starting 3:02 UTC on Oct 21 (11:02 Beijing time), Cloudflare enabled default WAF protections for all customers, about 9 hours ahead of public disclosure; the protections use its new full-transaction-detection capability, which combines request and response signals to block exploitation. Cloudflare said it had already observed attack traffic targeting its customers before public disclosure, with attackers mutating payloads to try to bypass the rules.

Key facts

1. The two flaws: When PHP runs out of memory it interrupts the request while internal request data is only partially initialized, and cleanup may treat the invalid data as valid (CVE-2026-109618); request-owned internal state can survive after its memory has been freed, and a later request handled by the same worker may use that stale state before normal initialization resets it (CVE-2026-109619). A single unauthenticated request can trigger the attack, with mod_php setups at greatest risk.
2. Scope: The flaws sit in the PHP interpreter itself, not in any one application; every version since PHP 5.4 is affected, and all PHP installations serving web requests are in scope, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Cloudflare cites W3Techs data that PHP powers nearly 70% of websites.
3. Demonstrated exploitation: Researchers demonstrated unauthenticated remote code execution against the latest WordPress, Drupal and Joomla container images; even a simple “Hello World” app on a vulnerable PHP version can be exploited, and reading PHP worker memory (which can contain passwords, tokens and API keys) was also demonstrated.
4. Exploitation status: Cloudflare observed attack traffic before the patch went public; PoCs, write-ups and partial mitigations started circulating before the embargo lifted. Australia's cyber security agency said it was not aware of active exploitation at the time of its advisory.
5. Older versions: PHP no longer supports 8.1 and earlier, but released minimal source backports for 7.4, 8.0 and 8.1 for those building from source or without an LTS vendor; Linux distributions and LTS vendors received the patches ahead of the public release.