PHP2Shell Exposes the Internet’s Patch Problem as AI Finds Critical PHP Flaws

PHP2Shell refers to 2 critical vulnerabilities in the PHP language, tracked as CVE-2026-109618 and CVE-2026-109619. The flaws involve memory-safety failures tied to out-of-memory handling and stale global state that persists between requests. One vulnerability carries a CVSS severity score of 9.2, and the flaws can enable unauthenticated attackers to disclose sensitive process memory or execute code on a server.

PHP underpins about 70% of websites whose programming language is known, including installations of WordPress, Drupal and MediaWiki. That reach turned a defect in core language code into a broad infrastructure concern rather than a problem limited to one application or vendor. The PHP Foundation issued an emergency security release on Oct. 21 and urged operators to update immediately.

The risk comes from PHP’s position beneath millions of websites and services. A vulnerable PHP runtime can expose an entire server even when the website’s visible application has received its own security updates. The affected ecosystem includes major publishing platforms and sites associated with public institutions, universities and businesses.

Scale also complicates remediation. One account placed roughly 1.5 million hosts in the exposed population, while broader estimates tied the issue to about 70% of websites using a known programming language. A patch protects only machines where operators install it, leaving old versions, unmanaged servers and overlooked hosting environments in the attacker’s path. The incident therefore links software security to inventory, ownership and routine maintenance, areas that often fail quietly until a critical flaw arrives.

AI-assisted security research played a central role in finding PHP2Shell. Researchers associated with OpenAI Codex Security and Calif identified vulnerabilities that had remained in PHP code since at least 2012, while Wiz researchers conducted an independent investigation and disclosure. The work shows AI systems operating as code-analysis and vulnerability-research tools, rather than only as chat interfaces or programming assistants.

The discovery process also raises the defensive stakes after disclosure. AI systems can inspect a security patch, infer the bug it addresses and produce exploit techniques faster than traditional research workflows. That creates a narrowing window between a fix becoming public and attackers turning the fix into an operational attack. OpenAI, Wiz and Calif are connected to the discovery effort, but responsibility for protection remains with organizations running PHP and their hosting providers.

Attack activity began before the Oct. 21 patches were released, according to reporting cited by Fortune AI. That timing made the emergency release a race against existing intrusion attempts, rather than a routine update cycle. Attackers targeting an unpatched PHP runtime could seek server control, sensitive memory and access to data or adjacent systems.

The episode also highlights a difficult disclosure sequence. Researchers must provide maintainers enough information to build a fix, maintainers must publish and distribute it, and defenders must identify every affected installation before attackers reverse-engineer the change. PHP2Shell’s age and reach increased the number of systems entering that chain at once. Operators needed to inventory PHP versions, apply the relevant security release, review logs for suspicious activity and account for systems managed by external hosting partners.

PHP2Shell turned long-lived technical debt into an immediate operational problem. The vulnerabilities sat in foundational code for more than a decade, illustrating how mature infrastructure can accumulate risk beneath applications that receive more visible security attention. The patch itself drew less public attention than a breach would, even though timely installation determined whether many organizations remained exposed.

The incident also fits a wider late-October run of serious software vulnerabilities, including issues affecting other language runtimes and widely deployed components. AI-assisted research is increasing the pace at which these weaknesses surface, while AI-assisted analysis gives defenders and attackers faster ways to understand them. That combination makes patch management, asset visibility and rapid incident review central security controls, not administrative afterthoughts.

Organizations running PHP need to identify every exposed runtime, apply the PHP Foundation’s security release and confirm that production systems no longer use vulnerable versions. Teams should review web-server and application logs for exploitation attempts, rotate credentials if compromise is suspected and check whether an affected server can reach sensitive internal services.

The response also needs to reach beyond directly managed machines. Hosting companies, content-management providers and agencies responsible for WordPress or Drupal deployments must verify updates across customer environments and document exceptions. PHP2Shell demonstrated that disclosure is only the opening event: the security outcome depends on how quickly millions of distributed systems receive, validate and retain the fix.