PHP2Shell: Patch the Critical PHP Flaws AI Helped Find

PHP2Shell is one of the most serious web security flaws in years. Found by Wiz Research with help from frontier AI models, it affects PHP itself, the language behind WordPress, Drupal and about 70% of websites. On an unpatched server, an attacker can run their own code without logging in.

PHP released fixes on October 21, 2026. If you run PHP anywhere, patch now. This guide covers which versions are fixed, how to patch, what to do if you can't patch today and what the AI side of the story means.

Disclosure: Van Data Team builds with Claude and other models, and this article was researched with Claude. The AI models in this story come from Google and OpenAI, which compete with Anthropic, so we've stuck closely to the published accounts of all three companies involved in finding the bug. Sources are linked.

Key Takeaways

• PHP2Shell is two critical CVEs in core PHP, rated up to CVSS 9.2. Attackers can run code or read server memory without logging in.
• Every PHP version from the last decade, back to 5.4, has at least one of the flaws. WordPress, Drupal, Joomla and custom apps are all at risk.
• Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Patching is the only complete fix.
• Exploitation attempts were reported before the public release. Don't wait.
• Wiz says frontier AI let one researcher do in a week what once took a top team months. That cuts both ways.

PHP2Shell at a Glance

Item	Details
CVEs	CVE-2026-109618 and CVE-2026-109619
Severity	Up to CVSS 9.2
Impact	Remote code execution and memory disclosure, without logging in
Affected	PHP versions back to 5.4 that serve web requests
Fixed in	PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35
Released	October 21, 2026
Found by	Wiz Research, Calif and OpenAI, with AI models

What Is PHP2Shell?

PHP2Shell is the name Wiz Research gave to a group of memory-safety bugs in the core PHP engine. They're tracked under two CVEs. In plain terms, they're mistakes in how PHP cleans up after a request fails badly, for example when it runs out of memory.

When that cleanup goes wrong, PHP can leave broken data behind. A later request handled by the same worker may then reuse it. Wiz showed that an attacker can turn this into two kinds of harm.

• Taking over the server: running their own code, without logging in.
• Reading memory: pulling data from the server's memory, which may hold passwords, tokens, API keys and certificates from other users' requests.

The key point is that the bugs sit in PHP, not in your app. Wiz says even a simple "Hello World" page on an affected version can be vulnerable.

Who Is Affected

If you serve web pages with PHP, assume you're affected until you've checked. According to Datadog Security Labs, that includes every common way of running PHP on the web: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

That covers most of the web's popular software:

• Content management systems: WordPress, Drupal and Joomla. Wiz demonstrated attacks on the latest versions of all three.
• Wikis and forums: MediaWiki, the software behind Wikipedia, and many forum platforms.
• Custom apps: anything built with Laravel, Symfony or plain PHP, including the internal tools and old marketing sites that nobody has touched in years.
• Containers: images that bundle their own PHP, which are easy to forget.

Command-line PHP scripts that never serve web requests are less exposed. But the runtime your site uses may differ from the one on your command line, so check both.

PHP2Shell Fixed Versions

According to the PHP project, these releases fix both CVEs:

PHP branch	Fixed version	Support status
8.5	8.5.12	Supported
8.4	8.4.27	Supported
8.3	8.3.36	Supported
8.2	8.2.35	Security fixes until December 31, 2026
8.1, 8.0, 7.4	Source backports only	End of life; check your vendor

Watch for one trap. Some Linux distributions patch older versions without changing the version number. So check your vendor's advisory before you assume an old number means you're unsafe.

How to Patch PHP2Shell Step by Step

Patching PHP is usually routine. The hard part is finding every place PHP runs. Work through these steps:

• Step 1: list every PHP runtime. Include web servers, containers, staging sites and anything a vendor runs for you. Note the version, where it came from and who owns it.
• Step 2: update the package. Install the fixed release from PHP, your Linux distribution or your support vendor.
• Step 3: rebuild container images. An updated base image doesn't help until you rebuild and redeploy every app that uses it.
• Step 4: restart every worker. PHP-FPM pools and web server processes keep running old code until they restart.
• Step 5: check the running version. Confirm the version on the live web runtime, not just on the command line.

Teams with many servers should start with anything facing the internet, then work inward, keeping a simple shared list of what's patched, what's waiting and who owns each item, so nothing slips through the cracks.

If You Can't Patch Today

Some systems can't be updated at once. PHP and security vendors list ways to reduce risk in the meantime, but none of them is a full fix.

• Turn on firewall rules. Cloudflare says it has deployed web application firewall rules for known attack patterns, available to all customers, including free plans, Help Net Security reports. Other content delivery and cloud providers have prepared rules too.
• Limit request sizes. Cap the size of uploads and form posts at your proxy, before requests reach PHP.
• Change risky settings. PHP's guidance includes turning off session upload progress (session.upload_progress.enabled=0). Follow the full official guidance, because some settings need extra limits to be safe.
• Restrict access. Put admin areas and internal apps behind single sign-on or a VPN.
• Consider going offline. The UK's National Cyber Security Centre advises considering taking systems offline if they can't be fixed quickly.

Treat these as a bridge to patching, not a replacement for it.

Signs of PHP2Shell Exploitation

Because the bugs sit below your app, your app's own logs may show little. Wiz and Datadog point to signs worth checking:

• Unusually large or odd form posts, especially huge field names or binary data in form fields.
• Out-of-memory errors in the PHP log that don't point to any script, often next to oversized requests.
• Crashing or restarting PHP workers, or more HTTP 500 errors than usual.
• Unexpectedly large session cookies in responses.
• A web worker starting a shell or other command. This one is the clearest sign of compromise, and it's worth setting up an alert for it even after you patch, because it catches many other attacks too.

Clean logs prove little. Datadog warns that a successful attack may return a normal response and leave the worker running. If you find a shell started by a web worker, treat the server as compromised. Our AI agent incident response playbook covers how to prepare a response team.

Is PHP2Shell Being Exploited?

The risk isn't theoretical. Datadog reports that AWS saw exploitation attempts starting October 17, 2026, before the public disclosure. Other security firms report broad scanning for vulnerable servers.

The release itself was rushed. According to Decrypt, details leaked online before the fixes were ready, so PHP's maintainers moved the release up a day to October 21. Decrypt also reports that governments in Finland, the Netherlands and France took some websites offline after the disclosure.

Put simply, attackers had a head start. If your servers were reachable before you patched, check them for the signs above.

What WordPress Site Owners Should Do

Most small businesses don't manage PHP directly. Their host or agency does. If that's you, here's what to do today:

• Ask your host which PHP version runs your site and when it will be patched. Many managed hosts update automatically.
• Check your dashboard. Many hosting panels show the PHP version and let you switch to a newer one.
• Turn on your host's firewall or a CDN with a free plan, if you don't already use one.
• Change passwords and API keys for important admin accounts if your site ran unpatched PHP before October 21. The memory bug could expose them.

If nobody can tell you which PHP version your site uses, that's a sign you need a clearer owner for your website.

PHP2Shell Checklist by Role

Different people need to do different things this week. Here's a short checklist by role:

Role	What to do now
Website owner	Ask your host or agency which PHP version runs your site and when it will be patched
Developer	Update PHP in every project and container image, then redeploy
Operations team	Patch internet-facing servers first, restart workers and confirm the live version
Security team	Turn on firewall rules, watch for the warning signs and check servers that were exposed early
Leadership	Make sure someone owns every public website, including vendor-run ones

If one person wears all these hats, start with the first row and work down. A small site can usually be patched in under an hour once you know where PHP runs.

Questions to Ask Your Host or Agency

If someone else runs your website, you still own the risk. Send them these questions today:

• Which PHP version serves our site right now, and has it been updated to a fixed release?
• When exactly was it patched? If it was after October 17, have you checked for signs of attack?
• Do you run a web application firewall in front of our site, and are the new rules turned on?
• Are there other copies of our site, such as staging or old test sites, that also need patching?
• Who's our contact if something looks wrong?

A good partner will answer within a day, with specific dates and versions. If the answers are vague, ask for written confirmation, and consider whether you need a partner who can move faster next time.

How AI Helped Find PHP2Shell

The most important part of this story may be how the bugs were found. The flawed code had been in PHP for more than a decade. Turning it into a working attack was so complex that it sat at the edge of what human experts could do.

According to Wiz, AI changed that. Its researchers used their own Wiz Atlas tool plus two frontier models, Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol. Wiz says Gemini 4 Argon made an especially large contribution, from finding the bug to checking the patch.

Wiz's summary is striking. "With frontier AI models and the right tools," it writes, one researcher finished in a week what once would have taken "a world-class team months of work."

Wiz compares PHP2Shell to Heartbleed in 2014 and Log4Shell in 2021, two bugs that changed how the industry thinks about shared software. Our post on Gemini 4 Argon covers the model itself.

Two Accounts of Who Found It

The companies involved tell the story a little differently, so it's worth being precise:

• Wiz's account: Wiz found the first flaw on August 19, 2026, confirmed attacks on Drupal and WordPress within two days and reported them to PHP on August 24.
• OpenAI's account: as reported by Decrypt, security firm Calif found a version of the bug in August using GPT-5.6 Sol under OpenAI's Patch the Planet program. OpenAI's own team found a fuller version in September, and Wiz found both flaws independently.

Both accounts agree on the main points. The flaws were found with frontier AI, reported privately and fixed with PHP's maintainers before full public disclosure. Wiz thanks the PHP team, Calif and OpenAI for their work.

Patch the Planet and the $1 Billion Pledge

OpenAI says it led a coalition to respond, working with US government agencies including the Office of the National Cyber Director and CISA, plus international partners. It also committed $1 billion in subsidized access to Daybreak, its AI security offering, for organizations with limited security resources that protect essential services.

PHP2Shell came out of Patch the Planet, a program OpenAI runs with security firm Trail of Bits to find and fix bugs in open-source software. Its public tracker currently shows:

Patch the Planet tracker	Count
Codebases under review	68
Issues found	1,995
Patches written	679
Patches accepted upstream	466

The tracker updates over time and doesn't show an as-of date, so the counts may have changed since we checked.

Why This Is a Turning Point

PHP2Shell shows both sides of AI in security. The same tools that helped defenders find and fix these flaws could help attackers adapt old bugs into new attacks.

Wiz makes the point directly. Complex memory bugs used to be protected by their difficulty. If AI makes building and adapting exploits fast and cheap, "complexity may no longer provide a meaningful barrier." We saw the attacker side of that shift in our post on autonomous AI hacking.

For defenders, the takeaway is speed. The gap between a bug being found and being attacked is shrinking. Patch processes built for monthly cycles will struggle.

What Development Teams Should Change

PHP2Shell is a good moment to fix the habits that make patching slow. A few changes go a long way:

• Keep a runtime inventory. Know every language runtime you run, its version and its owner, including inside containers.
• Make rebuilds routine. Rebuild and redeploy container images on a schedule, so a base-image update reaches production quickly.
• Plan for emergency patches. Agree in advance who can approve and ship an urgent fix outside the normal release cycle.
• Retire old versions. Running PHP 8.1 or older means relying on backports. PHP 8.2 reaches end of life on December 31, 2026, so plan that upgrade now.
• Watch process behavior. Alert when a web worker starts a shell or an unexpected program.

Our post on defensive AI agents looks at how teams can use AI to keep up with this pace.

PHP2Shell: Our Take

PHP2Shell is serious on its own: a critical, easy-to-reach flaw in the language behind most of the web. Patch it this week, starting with anything public.

It also marks a shift. Bugs that hid for over a decade were found and turned into working attacks in days, with AI doing much of the hard work. That will happen again, in other software, and attackers will try the same methods.

The good news is that defenders got there first this time, and the fix is a normal update. The teams that cope best with the next one will be those that know what they run and can patch it quickly.

How Van Data Team Helps Teams Respond to PHP2Shell

We help companies keep their web and data platforms patched and secure. That means building an inventory of runtimes and containers, setting up rebuild and deploy pipelines that can ship urgent fixes in hours and adding monitoring for suspicious process behavior.

If PHP2Shell exposed gaps in how you track and patch your systems, our posts on agentic AI security and AI agent attacks are good next reads.