PHP2Shell (CVE-2026-109618): How AI Found a Decade-Old Bug in 70% of the Web

Every single year since 2010, someone on Hacker News or X posts a hot take declaring that PHP is dead. And then, in October 2026, frontier AI models uncovered a decade-old memory corruption flaw in the core PHP runtime engine, and suddenly 70% of the internet had to scramble into emergency patching mode.

Developer meme showing a hipster web developer saying 'Nobody uses PHP anymore, PHP is dead' contrasted with October 2026 when AI finds one bug in PHP (CVE-2026-109618 PHP2Shell) and 70% of the internet goes into emergency lockdown while the purple PHP elephant holds up the world.

As reported by BBC News, government portals, Wikimedia systems supporting Wikipedia, public health boards in Scotland, Edinburgh Council, the Finnish government, and even the Netherlands National Cyber Security Centre (NCSC) temporarily pulled services offline this week as a precaution against two critical vulnerabilities collectively dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619).

Both vulnerabilities carry a critical CVSS v4.0 score of 9.2 and affect every release of PHP from PHP 5.4 through PHP 8.5. Here is a technical breakdown of what happened, how AI models from OpenAI and Google Gemini accelerated the discovery, what actually breaks inside the Zend Engine, and how to verify and patch your servers right now.

What Is PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?

Unlike application-level vulnerabilities in a specific WordPress plugin or Composer package, PHP2Shell sits directly inside the C-based PHP interpreter itself, specifically in the paths responsible for request memory management and error handling.

According to The PHP Foundation's official security retrospective, the underlying Out-of-Memory (OOM) flaw behind CVE-2026-109618 was first glimpsed in 2024 after an external security audit by Quarkslab funded by the Sovereign Tech Agency through OSTIF. While fixing one of the audit findings, a contracted core developer noticed that hitting PHP's memory limit at a very specific moment could leave internal engine structures in an inconsistent state.

"Both issues sit in parts of PHP that nearly every request touches: memory management and error handling. Their central place in PHP is what made both vulnerabilities serious, and also so hard to fix without breaking compatibility, hurting performance, or forcing changes on the large ecosystem of third-party extensions." (The PHP Foundation)

Because no one had demonstrated a concrete Remote Code Execution (RCE) exploit path in 2024, and because every candidate fix risked breaking backward compatibility or C extensions, work on a patch stalled under the PHP security team's consensus model for nearly two years.

How Frontier AI Turned a Theoretical Bug into a Global Alert

What changed in late 2026 was not the underlying C code in PHP. What changed was the arrival of frontier AI models capable of reasoning across deep engine call graphs and synthesizing multi-step memory corruption chains:

Calif and OpenAI: In August 2026, security researcher Ryan Austin at Calif used OpenAI's GPT-5.6 Sol under OpenAI's Patch the Planet coordinated disclosure initiative to turn the theoretical OOM condition into a working pre-authentication RCE exploit chain across popular PHP platforms.
Wiz and Google Gemini: Cloud security firm Wiz independently discovered and reported both CVE-2026-109618 and CVE-2026-109619 using AI-driven vulnerability research agents powered by Google Gemini and GPT models, calling the flaws the most severe vulnerabilities ever uncovered by AI.

As UNSW Sydney cybersecurity researcher Salil Kanhere told the BBC, the underlying bugs were not new; what changed was our ability to find and weaponize them at machine speed.

The Embargo Breakdown and Cloudflare's Traffic Spike

Following coordinated work between Calif, Wiz, OpenAI, and the PHP Foundation's Ecosystem Security Team in August and September 2026, an embargoed release was scheduled for October 21 at 14:00 UTC.

However, the timeline fractured:

October 20, 2026: CVE identifiers and a deleted proof-of-concept video leaked on social media, prompting threat actors to begin probing servers.
October 21, 2026 at 07:41 UTC: More than six hours before the coordinated disclosure, container vendor Chainguard broke the embargo and published pre-built container images containing the patch. As The PHP Foundation noted, any attacker could immediately binary-diff the patched image against the previous build while the rest of the world was still waiting for the official release.
October 21, 2026 at 07:43 UTC: Two minutes after the premature image push, Cloudflare recorded the first wave of automated exploitation attempts. Cloudflare CEO Matthew Prince reported that exploit probes jumped from thousands prior to disclosure to tens of thousands within 45 minutes, hundreds of thousands within two hours, and millions across Cloudflare's global edge.

Under the Hood: Why Updating WordPress or Composer Is Not Enough

When a request hits a PHP server, the Zend Engine initializes per-request memory structures, parses incoming request variables, and sets up session and error-handling state. If an attacker crafts a request that triggers an Out-of-Memory (OOM) condition during a narrow initialization window, PHP invokes zend_bailout() to abort the request and clean up memory.

In unpatched versions of PHP (5.4 through 8.5), if zend_bailout() fired before specific internal pointers finished initializing, the shutdown destructor routine still treated those partially initialized structures as valid pointers. By combining CVE-2026-109618 and CVE-2026-109619, an unauthenticated remote attacker can corrupt engine memory before application authentication checks ever run.

According to Sansec Forensics' technical advisory, Calif demonstrated unauthenticated code execution against clean installations of:

WordPress 7.1.2 and WooCommerce
Laravel 13.11 and Symfony 8.1
Magento 2.4.9 and Shopware
Drupal 11.4.3 and Joomla 6.1.4
MediaWiki 1.46.2, Nextcloud 35.0.1, Roundcube 1.7.4, and phpMyAdmin 5.2.3

Because the vulnerability lives in the PHP binary (php-fpm, mod_php, or php-cgi), updating WordPress plugins, Composer dependencies, or application code will not fix PHP2Shell. You must patch the underlying PHP runtime on the host or container.

Reality Check: Is PHP2Shell Another Log4Shell?

While government advisories from the US NSA, UK NCSC, and Japanese Prime Minister Sanae Takaichi urged organizations to patch immediately or temporarily suspend unpatched sites, forensic researchers at Sansec, Tenable, and Bitdefender point out an important nuance:

Unlike Log4Shell or Shellshock, where a single static HTTP header could compromise almost any vulnerable server blindly, reliable PHP2Shell exploitation requires target-specific knowledge of the server's memory configuration and application state to hit the exact OOM window. Many noisy proof-of-concept scripts circulating on GitHub right now either fail against default PHP installations or rely on a separate Local File Inclusion (LFI) bug.

However, with AI-assisted offensive tooling rapidly evolving, as tracked by Recorded Future's Insikt Group and Sophos X-Ops, leaving an internet-facing PHP runtime unpatched is an unacceptable risk.

How to Check and Patch Your PHP Servers Immediately

The PHP project released official patched versions for all active branches on October 21, 2026:

PHP 8.5: Upgrade to 8.5.12 or later
PHP 8.4: Upgrade to 8.4.27 or later
PHP 8.3: Upgrade to 8.3.36 or later
PHP 8.2: Upgrade to 8.2.35 or later

If you are running an End-of-Life (EOL) version of PHP (such as PHP 7.4, 8.0, or 8.1), PHP.net does not publish official binary releases, and official Docker php:8.1 images will not receive an update. However, Debian, Ubuntu, CloudLinux, and Remi's RPM repository for RHEL, AlmaLinux, and Rocky Linux have backported the source patches into their distro packages while keeping the base version number.

Run the following commands on your server to verify whether your PHP package includes the backported fix for CVE-2026-109618 and CVE-2026-109619:

# 1. Check your running PHP version
php -v

# 2. On Debian / Ubuntu, verify the CVE patch in the package changelog
zgrep CVE-2026-109618 /usr/share/doc/php*-common/changelog.Debian.gz

# 3. On RHEL / AlmaLinux / Rocky Linux, check the RPM changelog
rpm -q --changelog php-common | grep CVE-2026-109618

# 4. Apply updates and restart PHP-FPM / Apache
sudo apt update && sudo apt install --only-upgrade 'php*'
sudo systemctl restart php8.4-fpm apache2

If you cannot patch immediately, place your site behind an edge WAF such as Cloudflare's emergency PHP2Shell WAF rules and audit your server logs for abnormal Allowed memory size of ... bytes exhausted spikes paired with unexpected POST payloads.

Sources, Advisories, and Further Reading

To track ongoing updates, vendor backports, and Indicators of Compromise (IoCs), bookmark these primary advisories and technical reports: