PHP2Shell: AI turned an old flaw into a working attack. What your website needs now

TL;DR. On October 21, the PHP project closed two critical flaws that affect almost every PHP version since 5.4. They let an attacker run their own code on the web server without logging in. Security researchers found them and turned them into working attacks with AI models, including Gemini 4 Argon and GPT-5.6 Sol. The suspicion already existed in 2024, but nobody could prove it back then. What is new is not the flaw, it is the speed: AI turns an old suspicion into a working attack within days, for defenders and attackers alike. If you run a website, an online shop or an intranet on PHP, have someone check today that the update has really arrived.

What happened

PHP is the programming language behind a large part of the web. According to W3Techs, it runs on 69.3% of all websites whose server-side language is known. WordPress, TYPO3, Drupal, Joomla, Magento and Nextcloud are written in PHP, and so are the web interfaces of some firewalls.

The two flaws (CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell) sit in PHP itself, in memory management and error handling. If a request hits its memory limit at exactly the wrong moment, leftovers stay in memory and a later request reuses them. According to the researchers at Wiz who found them, this lets an attacker run code or read other parts of the process memory, including passwords, access keys and certificates. The application itself does not need to have a bug. Even a simple "Hello World" page on an affected version can be vulnerable.

Both flaws have a severity of 9.2 out of 10. On October 21, Germany's Federal Office for Information Security (BSI) issued a security notice at level 3 of 4: action must be taken without delay. According to php.net, the problem is fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

What AI changed

The weakness is old. In 2024, while working on an external audit, developers noticed first signs of the memory problem, but an attack was only theoretical. The PHP Foundation writes openly that the fix stalled again and again after that. Every solution had drawbacks, and the small team was stretched.

In the summer of 2026, AI tools entered the picture. The security firm Calif started reviewing PHP on July 30 as part of an OpenAI programme. Within a few days it had a first attack path against WordPress. On August 11, Calif and OpenAI reported the same root cause independently of each other, and Wiz followed on August 24 with further paths. Wiz writes that with Gemini 4 Argon, GPT-5.6 Sol and its own tools, a single researcher achieved in one week what used to take a world-class team months. Adapting the attack to different applications took hours.

Calif stresses two points: the first finding needed no special models, the models used are open to everyone. And the researcher knew the bug history of PHP and steered the model there on purpose. The BSI draws a clear conclusion: "Since the arrival of AI-assisted tools for exploit development at the latest, actors have the means to analyse patches and generate exploits within a short time" (our translation).

The tools that found this flaw are open to attackers too.

The race before the update

The release was planned for today, October 22, at 16:00 CEST. But two days earlier the CVE numbers appeared online. PHP brought the date forward. An attack video published by mistake and container images shipped too early gave attackers extra material.

Even before the update, Hadrian, Patchstack and Cloudflare reported first attack attempts, SecurityWeek reports. WatchTowr had not seen any successful attacks by the afternoon, but expects them soon. A web application firewall helps but does not replace the update, say Cloudflare and the BSI.

The small print

• The version number can mislead. Linux distributions patch their packages without changing the number. After the update, Ubuntu 24.04 still reports PHP 8.3.6. If you only read the version number, you may take a patched server for a vulnerable one or the other way round. What counts is the distribution's security notice.
• Old versions only get emergency fixes. For PHP 7.4, 8.0 and 8.1, the PHP project has only published fixes in the source code. Ready-made updates for them come only from Linux distributions or paid long-term support vendors.
• Installing is not enough. Running PHP processes keep using the old code until they are restarted. Containers have to be rebuilt.
• AI also creates noise. Since July, the PHP security team has published 15 vulnerabilities and handled more than 100 reports that were invalid, duplicates or could not be reproduced. People still decide which fix is the right one.

How many websites have a ready-made update

We recalculated the W3Techs version statistics from October 22. Only just over half of all PHP websites run a version that has had a ready-made update since yesterday.

The figure does not show how many servers are vulnerable, because distributions also patch older versions under their old number. It does show how many operators now have to do more than click an update. Shortly after 6:00 CEST this morning, patched packages were available for Debian 12 and 13 and for Ubuntu 22.04 and later, and for Ubuntu 20.04 only through the paid Ubuntu Pro. The official Docker images for PHP were rebuilt in the evening and night before October 22.

What this means for a mid-sized company

Very few companies run PHP themselves. It runs at the hosting provider, at the agency, inside the shop system or in a device with a web interface. So the key question is not whether you are affected, but who updates what by when, and who confirms it. According to the BSI, some operators in Germany took their servers offline as a precaution until they were updated.

The speed is what is really new. If AI can turn a published fix into an attack within hours, the next maintenance window is no longer good enough. The good news is in the same finding: the same tools help defenders find old bugs first.

What you should do now

1. Take stock. Where does PHP run? Website, shop, intranet, ticketing system, file storage such as Nextcloud, firewall interface, forgotten campaign pages. The Dutch NCSC keeps a list of affected products.
2. Get the update confirmed. Ask your hosting provider and agency in writing: which version, installed when, all PHP processes restarted? For Linux packages, the distribution's security notice counts, not the version number.
3. Look for traces. Attack attempts started before the update. Have the logs checked for clusters of memory and server errors, and the web directory for unknown files. On servers that were openly reachable, consider renewing the passwords and keys stored on them.
4. Retire old versions. PHP 8.1 and older no longer get official updates, and according to the BSI PHP 8.2 only gets them until the end of the year. Plan the move to 8.3 or later now, not during the next emergency.
5. Define the emergency route. Who may approve an urgent update, even in the evening? Who checks afterwards that it works? Settle this before the next flaw.

AI is currently finding old bugs faster than many companies fix them. Another tool will not solve that, a short route from warning to update will. If you would like to walk through that route for your systems, we are happy to talk.