AI found the flaws, AI lowered the cost of exploiting them, and disclosure broke down.
PHP released emergency fixes on October 21, 2026, after researchers found two critical flaws with help from frontier AI models. The PHP2Shell vulnerability is rated 9.2 under CVSS v4.0 and allows unauthenticated remote code execution.
The scale sets this apart. PHP runs about 70% of websites, including WordPress, Drupal and Joomla, and the flaws affect every PHP version from 5.4 through 8.5.11, on every platform. Wiz reported even a minimal “Hello World” app may be vulnerable.
The Short Version: What the PHP2Shell Vulnerability Is
The PHP2Shell vulnerability is the collective name for two critical PHP runtime flaws, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 under CVSS v4.0. Both allow unauthenticated remote code execution: an attacker runs server code without logging in, via a crafted HTTP request.
- Two flaws, CVE-2026-109618 and CVE-2026-109619, rated 9.2 under CVSS v4.0.
- Both allow unauthenticated remote code execution via a crafted HTTP request.
- Every PHP version from 5.4 through 8.5.11 is affected.
- Emergency fixes, Oct 21, 2026: PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35.
Remote code execution is the most serious class of web flaw: no account, no password, no second vulnerability. The crafted request reaches the server, the flaw mishandles it, and the attacker runs commands. That is why the patch was an emergency release.
How the PHP2Shell Vulnerability Was Found
AI did the finding. Researchers at Calif, working inside OpenAI’s Patch the Planet program, used frontier models to locate the flaws, and Wiz researchers found them independently the same way. The flaws behind the PHP2Shell vulnerability had sat in PHP for over a decade.
Wiz credits its Wiz Atlas platform, running Google’s Gemini 4 Argon and GPT-5.6 Sol; its researchers were Sagi Tzadik, Shir Tamari, Nir Ohfeld and Tomer Schwartz. The first issue surfaced on August 19, 2026, and the PHP Foundation reports Calif, Wiz and OpenAI each independently reported the same out-of-memory root cause between August 11 and September 18, 2026.
The volume hitting small teams is the other story. The PHP project has published 15 CVEs since July 1, 2026, and handled more than 100 reports that were invalid, duplicates or not reproducible, per the Cloud Security Alliance. The PHP Foundation has 13 full- and part-time employees, per Wikipedia via Correlation One.
The PHP2Shell Vulnerability Timeline: October 17 to 28
The disclosure broke down in stages. The CVE identifiers leaked on October 20, so the PHP project moved the release forward a day. Within hours, one firm accidentally published a proof-of-concept video, and a distributor shipped patched binaries early. Some coverage called the episode “Black October”.
The most serious entry is the first one. Amazon Threat Intelligence recorded a PHP2Shell exploitation attempt in its MadPot honeypot on October 17, 2026, four days before disclosure and three days before the CVE identifiers leaked. How the actor obtained exploit information is unclear, so review windows should start no later than October 17.
Once disclosure of the PHP2Shell vulnerability happened, the pace was brutal: exploit attempts reached the millions within a day. CISA has warned of active exploitation, and Dutch Prime Minister Rob Jetten warned organizations to keep vulnerable systems offline until patched.
What the PHP2Shell Vulnerability Means for Site Owners
Patching is the first step, not the last one. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; sites on PHP 5.4 through 8.1 have no listed fix and need an upgrade. Patching closes the flaws but does not remove web shells, accounts or other persistence from an earlier compromise.
That check should cover October 17 onward: unknown files, new accounts, unexpected processes and outbound connections that do not match normal traffic. If anything looks wrong, treat the system as compromised and rebuild from clean sources.
There is also a warning about the flood of public exploits. Many flooded GitHub, and experts dismissed many as AI hallucinations because they required the target application to already contain a local file inclusion flaw. A proof of concept that needs a separate flaw is not a working exploit for the PHP2Shell vulnerability itself. ReliaQuest researchers independently reproduced exploitation of CVE-2026-109618 in a controlled lab on October 22, 2026, using public reporting and a commercial AI model. That was a lab result, not a universal weaponized chain, and ReliaQuest has seen no successful exploitation in customer environments.
The later reports show why the distinction matters. On October 26, Dream Research reported a suspected China-linked actor chained PHP2Shell with Linux kernel flaw CVE-2026-46300 to drop a PHP root webshell on 24 firewalls in the US, Japan, Taiwan and South Korea. On October 28, GreyNoise reported the first successful exploitation in its purview.
Confirmed, Reported and Still Unknown
Confirmed: two CVEs, each rated 9.2 under CVSS v4.0, both allowing unauthenticated remote code execution; every PHP version from 5.4 through 8.5.11 affected; fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. AI-assisted research found the flaws, with Calif, Wiz and OpenAI independently reporting the same root cause. A PHP2Shell vulnerability exploitation attempt was recorded on October 17, before disclosure, and attempts reached the millions within a day.
Reported, not confirmed: the suspected China-linked chaining attack from Dream Research on October 26, and the first successful exploitation in the wild reported by GreyNoise on October 28 in its purview. The “Black October” label also belongs here.
Still unknown: how the October 17 actor obtained exploit information, whether other pre-disclosure attempts went unrecorded, and the full scope of compromise. Those gaps are why the review window starts October 17.
Quick Answers
What is the PHP2Shell vulnerability?
Two critical PHP runtime flaws, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 under CVSS v4.0, allowing unauthenticated remote code execution through a crafted HTTP request.
Which PHP versions does the PHP2Shell vulnerability affect?
Every PHP version from 5.4 through 8.5.11 is affected, on every platform.
How do I fix the PHP2Shell vulnerability?
Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on your branch. Sites on PHP 5.4 through 8.1 have no listed fix and need an upgrade. Then check for compromise back to October 17, 2026.
Was the PHP2Shell vulnerability exploited before disclosure?
Yes. Amazon Threat Intelligence recorded an attempt in its MadPot honeypot on October 17, 2026, four days before public disclosure. Amazon states it is unclear how the actor obtained exploit information.
Does patching remove an existing compromise?
No. Patching closes the flaws but does not remove web shells, accounts or other persistence from an earlier compromise. A compromised server needs investigation and rebuilding from clean sources.
The Takeaway
The PHP2Shell vulnerability is a serious flaw with a simple fix and a hard follow-up. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or upgrade older branches, then check exposed servers for compromise back to October 17. AI found decade-old flaws. The window between discovery and attack is now measured in hours, not weeks.
Sources and Attribution
- IT Jungle, Critical PHP2Shell Security Vulns Evoke Black October, October 26, 2026. https://www.itjungle.com/2026/10/26/critical-php2shell-security-vulns-evoke-black-october/
- ReliaQuest, Threat Spotlight: PHP2Shell, Responding to Critical PHP Vulnerabilities, October 2026. https://reliaquest.com/blog/threat-spotlight-php2shell-responding-to-critical-php-vulnerabilities/
- Cloud Security Alliance, CSA Research Note: PHP2Shell Pre-Disclosure Exploitation, 2026. https://labs.cloudsecurityalliance.org/research/csa-research-note-php2shell-pre-disclosure-exploitation-2026/
- Intel 471, Testing a PHP2Shell Exploit in the Era of AI-Hallucinated PoCs. https://www.intel471.com/blog/testing-a-php2shell-exploit-in-the-era-of-ai-hallucinated-pocs
- Correlation One, PHP2Shell Vulnerability: AI Workforce Security. https://www.correlation-one.com/blog/php2shell-vulnerability-ai-workforce-security
The CNN article linked in the assignment could not be opened, so no claim in this article relies on it. PetaTech24 tested nothing for this article. All claims trace to the reporting named above, and anything beyond those sources is labelled unknown.
