In October 2026, two critical remote code execution (RCE) flaws in PHP were disclosed: CVE-2026-109618 and CVE-2026-109619. Together they are called the PHP2Shell vulnerability. Details leaked on October 20, and PHP released emergency patches on October 21. Both flaws let an attacker run code on a server without logging in, and both are rated 9.2 (critical) on the CVSS v4.0 scale.
What Is the PHP2Shell Vulnerability?
PHP2Shell is the name for two memory-safety bugs in how PHP handles requests that end abnormally. CVE-2026-109618 involves memory exhaustion. CVE-2026-109619 involves stale global state. Either can let an attacker take control of the web worker process with a single crafted request. PHP’s team says the risk is highest for mod_php setups.
How AI Found the PHP2Shell Flaws
Security firm Calif found the first flaw in August using OpenAI’s GPT-5.6 Sol model. Google-owned Wiz independently found the flaws weeks later. OpenAI calls the time between AI discovery and public disclosure the “Defender’s Window.” It gave maintainers and hosting providers about two months to prepare fixes. The bug is reported to be around 14 years old.
Which PHP Versions Are Affected by PHP2Shell?
Affected versions reportedly go back to PHP 5.4. Fixes exist only for supported branches: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If you run an older PHP version, upgrading to a supported branch is the only safe option.
Is the PHP2Shell Vulnerability Being Exploited?
Yes. Security firm watchTowr reports exploitation in the wild, and Cloudflare pushed temporary firewall rules to customers. The NSA told organizations running PHP to patch or take affected systems offline. CERT-EU and the UK’s NCSC also urged quick updates.
How to Fix PHP2Shell: Steps for Website Owners
- Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
- Ask your hosting provider whether the patch has been applied.
- Check server logs for unusual requests around October 20–22.
- Enable WAF rules from providers such as Cloudflare as temporary protection.
- Check third-party software that bundles its own PHP.
What PHP2Shell Means for Website Security
PHP2Shell shows AI can find serious bugs faster than traditional methods, but attackers can use the same tools. Faster patching and better monitoring are now essential.
