The code behind PHP2Shell sat in PHP for more than a decade. With AI, researchers turned it into a working exploit in a day.
What PHP2Shell is
On 21 October 2026, PHP shipped fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619. Both are rated CVSS v4.0 9.2 and can allow unauthenticated remote code execution. The PHP project says every installation that serves web requests is at risk (PHP advisory).
The bugs are in PHP itself, not the apps built on it. A fatal error, often from running out of memory, can leave corrupted state behind for a later request on the same worker. Researchers used this to run code without logging in on stock WordPress, Drupal and Joomla images. They also read process memory that can hold passwords, tokens and API keys. It’s reported that every PHP version back to 5.4 is affected by at least one of the bugs (Wiz Research).
Old code, new tools
The PHP Foundation says a PHP core developer spotted early signs of the memory problem in 2024. The PHP team found no concrete way to exploit it, and work on a fix stalled and restarted for months (PHP Foundation).
AI changed that. On 11 August 2026, Calif and OpenAI independently reported that the same memory problem could be used for remote code execution. Using its Atlas agent with Gemini 4 Argon and GPT-5.6 Sol, Wiz found its first bug on 19 August 2026. It had unauthenticated code execution against Drupal the next day. The models made it practical to chain the flaws and adapt them to each target, with working exploits across several applications in hours (PHP Foundation, Wiz Research).
PHP2Shell exploit timeline
Attackers are moving fast too. Cloudflare has already reported attack traffic against its customers, with attackers changing payloads to get past its new WAF rules (Cloudflare).
What to do now
- Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your vendor’s patched package, then restart Apache, PHP-FPM and any long-running PHP workers. PHP 8.1 and older get no official release, but source backports exist for 7.4, 8.0 and 8.1 (PHP advisory).
- Use stopgaps only if you can’t patch yet. Settings such as
upload_progress.enabled=0
inphp.inior your FPM pool config reduce exposure once every worker is restarted. PHP says they don’t make a server safe. A WAF is a backstop, not a fix (PHP advisory, Cloudflare). - Look for odd multipart requests followed by memory-limit errors or repeated HTTP 500s. Also watch for oversized or malformed PHPSESSID response cookies and unexplained PHP worker churn.
Testing has to keep up
Patching is the only fix for PHP2Shell. The bigger lesson is about how often we test everything else.
Most security programs still test on a calendar. That cadence assumes a weakness found today will still take real time and skill to exploit. PHP2Shell breaks that assumption. Researchers built working exploits across several applications in hours. The PHP Foundation says tools are now finding bugs faster than ever, for attackers and defenders alike (PHP Foundation). An annual pentest still has value. It shows what skilled testers found in a fixed window. It can’t show what an attacker with frontier models will find after your next few releases.
AI-driven penetration testing should become a standard control, run routinely like scanning. That way, flaws in existing software get found and new ones get caught before they reach production.
As a standard, AI-driven penetration testing should:
- stay inside a defined scope
- run after significant code changes, not just when the audit calendar requires
- start from what you already know, like earlier scan results, instead of from scratch
- chain weaknesses together rather than checking issues one at a time
That’s the thinking behind Edgescan Atomic. It runs agentic, frontier-model testing on demand against web apps and APIs, looking for weaknesses like broken access control, injection and business logic flaws. It starts from your validated scan data. The Edgescan Harness keeps it inside the scope, permissions and approvals you set. Each finding is re-checked in a separate step before it’s marked validated.
Patch PHP today. Then make sure your testing keeps pace with the tools attackers already have.
Sources
- Security advisory: Critical remote code execution vulnerabilities, update now (php.net, 21 Oct 2026)
- PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet (Wiz Research, 21 Oct 2026)
- Today’s PHP Security Release, and How We’re Strengthening PHP Security (The PHP Foundation, 21 Oct 2026)
- Cloudflare deploys protections against php2shell vulnerability (Cloudflare, 21 Oct 2026)
