Oct 24, 2026 · 3 min read
AI Just Found a Decade-Old Flaw in the Software Behind the Web
Two critical PHP bugs, nicknamed PHP2Shell, let attackers take over servers with no login. They sat hidden for over a decade and were surfaced by AI in about a week. Here is what happened and what to do.
Two critical bugs in PHP itself, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), let an attacker take over a web server without ever logging in. PHP runs roughly 70% of all websites, including most WordPress, Drupal, and Joomla sites, so this is about as broad as a vulnerability gets.
What makes this one worth paying attention to is not just the severity. It is how it was found.
Read the original reporting on CNN.
What the flaw does
The bug lives in how PHP handles a request that fails partway through, such as running out of memory. It can leave behind a corrupted state that later code trusts, and an attacker triggers it with oddly shaped form uploads.
The impact:
- Unauthenticated remote code execution. A crafted request over the internet can take control of the server. No credentials required.
- Memory leaks. One variant can leak chunks of server memory, which may include passwords and API keys.
- A 9.2 out of 10 severity rating from the PHP team.
It reportedly takes thousands of requests to land a hit, which is exactly the kind of work automated mass scanning does well.
The part that changes things: AI found it
Researchers at Wiz, OpenAI, and a security auditing effort found the bugs in August 2026 and reported them privately to PHP. The code had been sitting in PHP for more than a decade, with earlier near-misses going back years.
According to the reporting, Wiz used frontier AI models and said one researcher did in about a week what would normally take "a world-class team months."
That is the real story. A decade-old flaw in critical infrastructure, surfaced by AI in days, not months.
The timeline moved fast
- August 2026: Reported privately to PHP.
- August to October: PHP builds a fix in private.
- October 20: Details leaked early on a public forum. PHP moved the release up.
- October 21: Fixed versions shipped. Attack attempts were already being seen, and some government and media sites went offline temporarily as a precaution.
The gap between disclosure and live, large-scale attacks shrank to hours.
What to do right now
This is the part people get wrong. Updating your apps does not fix this.
- Update PHP itself to a patched version (8.5.12, 8.4.27, 8.3.36, or 8.2.35), or the patched package from your distro. Updating WordPress, plugins, or themes does nothing.
- Fully restart the web server and PHP. Apache needs a real restart, not a graceful reload.
- Rebuild Docker images that bundle PHP, and check every machine, including staging.
- On shared hosting, ask your host in writing whether PHP was updated on or after October 21.
- Avoid unofficial "fix" plugins. They cannot patch PHP.
- Rotate secrets if your host reports suspicious activity, and rotate API keys if you see signs of attack.
- PHP 8.1 and older have no official fix. Upgrade to 8.4 or 8.5.
The bigger shift
The uncomfortable takeaway is not about this one bug. It is that AI just compressed "months of expert work" into a week, and it did it on the attacker's side of the equation too. Security teams are already warning of roughly 18 more months of AI-found vulnerabilities surfacing across widely used software.
The lesson for every engineer: patch the floor, not just the app. Your framework, your plugins, and your own code all sit on top of a runtime, and that runtime is now being audited by machines that do not get tired.
Update PHP. Restart everything. Verify every server.
Reporting via CNN and PHP.net, October 2026.