A machine found a ghost in the machine. In October 2026, the tech world woke up to an emergency security advisory that shook the foundations of the web. Two critical flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively dubbed "php2shell," hit PHP installations globally.
What makes this different from the endless stream of routine CVE notifications? An advanced AI model helped unearth it.
Security researchers at Calif used OpenAI's GPT-5.6 Sol during a code audit, exposing deep memory corruption vectors that had sat silently in the language's core source code for decades. Google's Wiz team independently flagged similar exploit paths around the same time. With a CVSS v4.0 severity rating of 9.2 (and independent estimates hitting a full 10.0), this incident marks a dangerous turning point. Artificial intelligence isn't just writing code anymore. It's rewriting the rules of software warfare by finding the microscopic mistakes human developers missed for thirty years.
The Anatomy of the PHP2Shell Flaws
If you run a server handling web requests, you need to understand what went wrong under the hood. The vulnerabilities don't live in a third-party plugin or an obscure package. They reside directly inside PHP's core request-handling behavior.
CVE-2026-109618 targets memory corruption during out-of-memory handling. When PHP hits your configured memory_limit, it fires a longjmp() call to abort the request. But if that interruption happens while internal data is only partially initialized—like during a complex form-based file upload—the cleanup routine gets confused. It treats invalid junk data as legitimate memory structures, trying to free blocks that were never actually allocated. That opens the door wide for an attacker to slip malicious payloads into earlier allocations.
CVE-2026-109619 attacks stale global state. When a fatal error tears down a request, internal tracking states sometimes survive in memory after their backing structures are freed. A subsequent request hitting the exact same worker process picks up those rotting variables before standard initialization routines can wipe them clean.
Both flaws allow unauthenticated remote code execution. An attacker doesn't need valid credentials, session cookies, or special access. They just send a crafted request, and code executes before your application logic even boots up.
Why This Scale of Exposure Is Unprecedented
PHP quietly runs an estimated 70% of the internet. WordPress, Drupal, custom enterprise platforms, and government web portals lean heavily on it.
When the PHP Foundation dropped emergency patches for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, the scramble was immediate. Censys scanning telemetry revealed that roughly 1.5 million out of 2.6 million scanned hosts were running unpatched versions of PHP within hours of the advisory.
Older, end-of-life branches like PHP 8.1 and earlier received no official fixes because they are officially out of support. Millions of legacy sites running older stacks face an impossible choice: scramble to upgrade complex legacy codebases overnight or leave their servers entirely exposed to automated exploitation scripts. Major platforms like Wikimedia temporarily disabled critical infrastructure instances as a precaution. Agencies like CISA and the NSA rushed out urgent advisories, warning that the flaw offered a direct pathway to server file systems.
The AI Factor Changes Everything
We have lived through massive vulnerability disclosures before. Think Log4Shell or Heartbleed. Those were discovered by human security analysts grinding away through manual code reviews or fuzzing campaigns.
Php2shell is different. It represents the inaugural wave of AI-accelerated vulnerability research hitting foundational internet infrastructure at scale.
Human developers had glanced at these parts of the codebase for decades. Some old security notes even flagged adjacent problem areas years ago, writing them off as too complex or unlikely to exploit. GPT-5.6 Sol didn't suffer from human blind spots, fatigue, or historical assumptions. It tore through complex C source code trees, mapped out pointer behaviors under failure states, and synthesized functional exploit paths in a fraction of the time.
This creates a brutal asymmetry for defenders. Attackers and security researchers armed with frontier AI models can scour legacy codebases across every open-source project on GitHub with terrifying speed. If you are an enterprise relying on aging internal software or unmaintained open-source dependencies, your security posture is fighting a machine-speed threat with human-speed patching cycles.
What You Need to Do Right Now
Sitting tight and hoping your hosting provider handles it is a fast track to getting owned. Here is the playbook to secure your infrastructure today.
First, verify your exact runtime versions. Run php -v in your terminal or check your server control panels. If you are running anything below PHP 8.2, updating is no longer optional maintenance. It's an emergency containment action.
Second, check your application dependencies. Many commercial and open-source systems bundle specific versions of PHP or rely on low-level extensions. Consult the advisory tracking repositories maintained by organizations like NCSC-NL to identify third-party software packages that embed vulnerable PHP runtimes.
Third, isolate if you cannot patch. If your legacy codebase breaks under PHP 8.2 or higher and you cannot patch immediately, pull your internet-facing applications off public networks behind a web application firewall configured with strict request-filtering rules, or take the affected services offline.
The era of AI-driven code auditing is here. The vulnerabilities hiding in your stack aren't waiting for you to find them.
