> Canonical URL: https://codingcat.dev/post/php2shell-cve-2026-109618-ai-php-security-scramble

# PHP2Shell (CVE-2026-109618): How AI Found a Decade-Old Bug in 70% of the Web

![CodingCat.dev tutorial cover image](https://cdn.sanity.io/images/hfh83o0w/production/12c99fc22a4279ab87ad57e19ac77fde2b31704b-1376x768.jpg?rect=6,0,1365,768&w=1920&h=1080&q=82&fit=max&auto=format)[![Alex Patterson](https://cdn.sanity.io/images/hfh83o0w/production/a606dfaa381aab08ddbe16a33fe1d3e1fb37c927-400x400.jpg?w=96&h=96&q=82&fit=max&auto=format)Alex Patterson](/author/alex-patterson)October 22, 2026

Every single year since 2010, someone on Hacker News or X posts a hot take declaring that PHP is dead. And then, in October 2026, frontier AI models uncovered a decade-old memory corruption flaw in the core PHP runtime engine, and suddenly **70% of the internet**  had to scramble into emergency patching mode.

![Developer meme showing a hipster web developer saying ](https://cdn.sanity.io/images/hfh83o0w/production/ff04548e545a1ea8e58707d7afdcb2cdc74360eb-896x1200.jpg?rect=0,348,896,504&w=1920&h=1080&fit=max&auto=format)

As [reported by BBC News](https://www.bbc.com/news/articles/c3qjnwye0ep5o), government portals, Wikimedia systems supporting Wikipedia, public health boards in Scotland, Edinburgh Council, the Finnish government, and even the Netherlands National Cyber Security Centre (NCSC) temporarily pulled services offline this week as a precaution against two critical vulnerabilities collectively dubbed **PHP2Shell**  (`CVE-2026-109618` and `CVE-2026-109619`).

Both vulnerabilities carry a critical **CVSS v4.0 score of 9.2**  and affect every release of PHP from **PHP 5.4 through PHP 8.5**. Here is a technical breakdown of what happened, how AI models from OpenAI and Google Gemini accelerated the discovery, what actually breaks inside the Zend Engine, and how to verify and patch your servers right now.

## What Is PHP2Shell (CVE-2026-109618 and CVE-2026-109619)?

Unlike application-level vulnerabilities in a specific WordPress plugin or Composer package, [PHP2Shell](https://en.wikipedia.org/wiki/PHP2Shell) sits directly inside the C-based PHP interpreter itself, specifically in the paths responsible for **request memory management and error handling**.

According to [The PHP Foundation's official security retrospective](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/), the underlying Out-of-Memory (OOM) flaw behind `CVE-2026-109618` was first glimpsed in 2024 after an external security audit by Quarkslab funded by the Sovereign Tech Agency through OSTIF. While fixing one of the audit findings, a contracted core developer noticed that hitting PHP's memory limit at a very specific moment could leave internal engine structures in an inconsistent state.

> "Both issues sit in parts of PHP that nearly every request touches: memory management and error handling. Their central place in PHP is what made both vulnerabilities serious, and also so hard to fix without breaking compatibility, hurting performance, or forcing changes on the large ecosystem of third-party extensions." (The PHP Foundation)

Because no one had demonstrated a concrete Remote Code Execution (RCE) exploit path in 2024, and because every candidate fix risked breaking backward compatibility or C extensions, work on a patch stalled under the PHP security team's consensus model for nearly two years.

## How Frontier AI Turned a Theoretical Bug into a Global Alert

What changed in late 2026 was not the underlying C code in PHP. What changed was the arrival of frontier AI models capable of reasoning across deep engine call graphs and synthesizing multi-step memory corruption chains:

- **Calif and OpenAI: ** In August 2026, security researcher Ryan Austin at Calif used OpenAI's `GPT-5.6 Sol` under OpenAI's [Patch the Planet coordinated disclosure initiative](https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/) to turn the theoretical OOM condition into a working pre-authentication RCE exploit chain across popular PHP platforms.
- **Wiz and Google Gemini: ** Cloud security firm Wiz independently discovered and reported both `CVE-2026-109618` and `CVE-2026-109619` using AI-driven vulnerability research agents powered by Google Gemini and GPT models, calling the flaws the most severe vulnerabilities ever uncovered by AI.

As UNSW Sydney cybersecurity researcher Salil Kanhere told the [BBC](https://www.bbc.com/news/articles/c3qjnwye0ep5o), the underlying bugs were not new; what changed was our ability to find and weaponize them at machine speed.

## The Embargo Breakdown and Cloudflare's Traffic Spike

Following coordinated work between Calif, Wiz, OpenAI, and the PHP Foundation's Ecosystem Security Team in August and September 2026, an embargoed release was scheduled for October 21 at 14:00 UTC.

However, the timeline fractured:

- **October 20, 2026: ** CVE identifiers and a deleted proof-of-concept video leaked on social media, prompting threat actors to begin probing servers.
- **October 21, 2026 at 07:41 UTC: ** More than six hours before the coordinated disclosure, container vendor Chainguard broke the embargo and published pre-built container images containing the patch. As [The PHP Foundation noted](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/), any attacker could immediately binary-diff the patched image against the previous build while the rest of the world was still waiting for the official release.
- **October 21, 2026 at 07:43 UTC: ** Two minutes after the premature image push, [Cloudflare recorded the first wave of automated exploitation attempts](https://blog.cloudflare.com/php-vulnerabilities-waf-protection). Cloudflare CEO Matthew Prince reported that exploit probes jumped from thousands prior to disclosure to tens of thousands within 45 minutes, hundreds of thousands within two hours, and millions across Cloudflare's global edge.

## Under the Hood: Why Updating WordPress or Composer Is Not Enough

When a request hits a PHP server, the Zend Engine initializes per-request memory structures, parses incoming request variables, and sets up session and error-handling state. If an attacker crafts a request that triggers an Out-of-Memory (`OOM`) condition during a narrow initialization window, PHP invokes `zend_bailout()` to abort the request and clean up memory.

In unpatched versions of PHP (5.4 through 8.5), if `zend_bailout()` fired before specific internal pointers finished initializing, the shutdown destructor routine still treated those partially initialized structures as valid pointers. By combining `CVE-2026-109618` and `CVE-2026-109619`, an unauthenticated remote attacker can corrupt engine memory before application authentication checks ever run.

According to [Sansec Forensics' technical advisory](https://sansec.io/research/php2shell), Calif demonstrated unauthenticated code execution against clean installations of:

- **WordPress 7.1.2 and WooCommerce**
- **Laravel 13.11 and Symfony 8.1**
- **Magento 2.4.9 and Shopware**
- **Drupal 11.4.3 and Joomla 6.1.4**
- **MediaWiki 1.46.2, Nextcloud 35.0.1, Roundcube 1.7.4, and phpMyAdmin 5.2.3**

Because the vulnerability lives in the PHP binary (`php-fpm`, `mod_php`, or `php-cgi`), **updating WordPress plugins, Composer dependencies, or application code will not fix PHP2Shell**. You must patch the underlying PHP runtime on the host or container.

## Reality Check: Is PHP2Shell Another Log4Shell?

While government advisories from the US NSA, UK NCSC, and Japanese Prime Minister Sanae Takaichi urged organizations to patch immediately or temporarily suspend unpatched sites, forensic researchers at [Sansec](https://sansec.io/research/php2shell), [Tenable](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote), and [Bitdefender](https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce/) point out an important nuance:

Unlike Log4Shell or Shellshock, where a single static HTTP header could compromise almost any vulnerable server blindly, reliable PHP2Shell exploitation requires target-specific knowledge of the server's memory configuration and application state to hit the exact OOM window. Many noisy proof-of-concept scripts circulating on GitHub right now either fail against default PHP installations or rely on a separate Local File Inclusion (LFI) bug.

However, with AI-assisted offensive tooling rapidly evolving, as tracked by [Recorded Future's Insikt Group](https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation) and [Sophos X-Ops](https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell), leaving an internet-facing PHP runtime unpatched is an unacceptable risk.

## How to Check and Patch Your PHP Servers Immediately

The PHP project released official patched versions for all active branches on October 21, 2026:

- **PHP 8.5: ** Upgrade to `8.5.12` or later
- **PHP 8.4: ** Upgrade to `8.4.27` or later
- **PHP 8.3: ** Upgrade to `8.3.36` or later
- **PHP 8.2: ** Upgrade to `8.2.35` or later

If you are running an End-of-Life (EOL) version of PHP (such as PHP 7.4, 8.0, or 8.1), PHP.net does not publish official binary releases, and official Docker `php:8.1` images will not receive an update. However, Debian, Ubuntu, CloudLinux, and Remi's RPM repository for RHEL, AlmaLinux, and Rocky Linux have backported the source patches into their distro packages while keeping the base version number.

Run the following commands on your server to verify whether your PHP package includes the backported fix for `CVE-2026-109618` and `CVE-2026-109619`:

```
# 1. Check your running PHP version
php -v

# 2. On Debian / Ubuntu, verify the CVE patch in the package changelog
zgrep CVE-2026-109618 /usr/share/doc/php*-common/changelog.Debian.gz

# 3. On RHEL / AlmaLinux / Rocky Linux, check the RPM changelog
rpm -q --changelog php-common | grep CVE-2026-109618

# 4. Apply updates and restart PHP-FPM / Apache
sudo apt update && sudo apt install --only-upgrade 'php*'
sudo systemctl restart php8.4-fpm apache2
```

If you cannot patch immediately, place your site behind an edge WAF such as [Cloudflare's emergency PHP2Shell WAF rules](https://blog.cloudflare.com/php-vulnerabilities-waf-protection) and audit your server logs for abnormal `Allowed memory size of ... bytes exhausted` spikes paired with unexpected POST payloads.

## Sources, Advisories, and Further Reading

To track ongoing updates, vendor backports, and Indicators of Compromise (IoCs), bookmark these primary advisories and technical reports:

- [BBC News: What is PHP and why did it spark a global cyber-security scramble?](https://www.bbc.com/news/articles/c3qjnwye0ep5o)
- [The PHP Foundation: Today's PHP Security Release, and How We're Strengthening PHP Security](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/)
- [OpenAI: Coordinated Disclosure of Critical Vulnerabilities (Patch the Planet)](https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/)
- [Cloudflare Blog: Protecting Against the PHP2Shell Vulnerabilities with Cloudflare WAF](https://blog.cloudflare.com/php-vulnerabilities-waf-protection)
- [Sansec Forensics: PHP2Shell PHP RCE (CVE-2026-109618, CVE-2026-109619) Technical Guide & Distro Patch Matrix](https://sansec.io/research/php2shell)
- [Tenable Security Response: PHP2Shell CVE-2026-109618 & CVE-2026-109619 Frequently Asked Questions](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote)
- [Bitdefender Business Insights: Technical Advisory for PHP2Shell Pre-Auth RCE](https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce/)
- [Recorded Future Insikt Group: PHP2Shell Vulnerability Exploitation Analysis](https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation)
- [Sophos Security Advisory: SOPHOS-SA-20261021-PHP2SHELL](https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell)
- [Wikipedia: PHP2Shell Vulnerability Overview and Disclosure Timeline](https://en.wikipedia.org/wiki/PHP2Shell)

## Recent Posts

[View More](/blog/page/1)[![Sanity Knowledge Bases](https://cdn.sanity.io/images/hfh83o0w/production/38b0f021c51d97043c8a1ebf31d505a0ea877b7c-2752x1536.jpg?rect=11,0,2731,1536&w=1920&h=1080&q=82&fit=max&auto=format)](/post/sanity-knowledge-bases)

### [Sanity Knowledge Bases](/post/sanity-knowledge-bases)

October 17, 2026

Eliminate query-time guessing in your AI agents. Learn how Sanity Context Knowledge Bases compile structured datasets, crawled documentation websites, and uploaded files ahead of time, resolve conflicting facts, and serve a compact outline over Context MCP.

[![Alex Patterson](https://cdn.sanity.io/images/hfh83o0w/production/a606dfaa381aab08ddbe16a33fe1d3e1fb37c927-400x400.jpg?w=96&h=96&q=82&fit=max&auto=format)Alex Patterson](/author/alex-patterson)[![The Five Layers of Agentic Context: Why Canon Only Turns When Someone Signs Off](https://cdn.sanity.io/images/hfh83o0w/production/d702615b4d3c30ea99dc40f10a576db4cd1c4c73-2752x1536.jpg?rect=11,0,2731,1536&w=1920&h=1080&q=82&fit=max&auto=format)](/post/the-five-layers-of-agentic-context-why-canon-only-turns-when-someone-signs-off)

### [The Five Layers of Agentic Context: Why Canon Only Turns When Someone Signs Off](/post/the-five-layers-of-agentic-context-why-canon-only-turns-when-someone-signs-off)

October 14, 2026

A deep-dive review of Magnus Hillestad's Five Layers of Agentic Context on the Sanity blog, exploring why Situation, Records, Memory, Process, and Canon move at different speeds, plus a working interactive HTML/SVG Situation-to-Canon wheel you can drop into any webpage.

[![Alex Patterson](https://cdn.sanity.io/images/hfh83o0w/production/a606dfaa381aab08ddbe16a33fe1d3e1fb37c927-400x400.jpg?w=96&h=96&q=82&fit=max&auto=format)Alex Patterson](/author/alex-patterson)