PHP2Shell Vulnerability: The 14-Year-Old PHP Flaw AI Found and How to Patch It
Key takeaways
- PHP2Shell is two critical PHP flaws (CVSS 9.2) that let attackers run code on servers without logging in.
- Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released Oct. 21, 2026.
- Update PHP itself and restart Apache or PHP-FPM; WordPress or plugin updates alone won’t fix it.
A huge share of the web runs on PHP. Now a serious flaw that sat undetected in PHP for 14 years has come to light: the PHP2Shell vulnerability. It was serious enough that some government agencies and major web services in Europe briefly went offline.
PHP2Shell lets an attacker run malicious commands on a server from the outside. What makes it stand out is that AI helped find a problem people had missed for years.
Why a PHP bug hits so many websites
PHP started in the 1990s as a tool for personal home pages. Today it’s one of the most widely used languages for building websites. WordPress, MediaWiki, Drupal and Joomla all run on it.
According to web technology survey W3Techs, 69.3% of websites whose server-side language can be identified use PHP. That’s close to 7 in 10 sites. The next most common language, JavaScript, sits at 8.2%.
With reach like that, one security flaw can affect a huge number of websites.
Yet the PHP Foundation, which supports PHP’s development and maintenance, has a core team of about 13 people, most of them part-time. Managing years of accumulated code and complex memory handling with so few people likely made it hard to catch every security issue.
Why the PHP2Shell vulnerability is so dangerous
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. Both scored 9.2 on CVSS 4.0, the standard severity scale, which puts them in the highest tier: Critical.
The biggest problem is that an attacker doesn’t need to log in. They can run commands on the server from outside, which is called remote code execution (RCE). A successful attack could deface a website or steal data stored on the server.
The root cause lies in how PHP handles memory.
When a server runs out of memory (OOM) while handling a request, PHP stops the work and cleans up the memory it was using. During that cleanup, some data isn’t handled correctly. The PHP advisory describes two separate bugs: an OOM error can leave request data only partly set up, and some internal state can survive after its memory has been freed.
The risk is highest where one process handles many requests in a row, such as the Apache module (mod_php) or PHP-FPM. A later request can reuse memory that an earlier request left in a bad state, which can change how the server behaves.
Attackers could use this to reach sensitive data such as database passwords, session tokens and API keys. Even if a site’s login works perfectly, a flaw in the PHP engine itself means you can’t assume you’re safe.
A 14-year-old flaw, found with AI
The flaw has reportedly existed since PHP 5.4, released in 2012. A 2024 external security audit flagged a memory-handling problem, but at the time no one could show it could be used to attack a server.
AI-assisted security research is what exposed the real threat. In August 2026, Ryan Austin, a researcher at security firm Calif, used GPT-5.6 Sol through OpenAI’s Patch the Planet project to find a flaw that could lead to a real attack.
Security firm Wiz, working separately, used its own agent, Wiz Atlas, along with Gemini 4 Argon and GPT-5.6 Sol. Wiz used AI to analyze the complex attack chain and confirm it actually worked.
The striking part: one researcher did in a week what used to take an expert team months. AI isn’t just writing code anymore. It’s also finding security holes hidden in old software.
Public disclosure was originally set for Oct. 22.
But details leaked on Oct. 20, raising the risk that attackers would strike first. The PHP team moved the schedule up a day and shipped an emergency security patch on Oct. 21.
What happened after PHP2Shell went public
Security agencies and website operators moved quickly. In the US, CISA and the NSA, along with European security agencies, urged organizations to update PHP servers fast. CISA said it had not seen exploitation when it published its alert, and the FBI advised taking systems offline if they can’t be updated right away, according to ABC7.
Cloudflare also rolled out web application firewall (WAF) rules to block attacks, before the official patch was even out. Its CTO said the company was already seeing early attacks.
Still, a site going offline doesn’t mean it was hacked. Some organizations reportedly paused their websites as a precaution or to apply the patch.
Because PHP is so widely used, a single flaw can ripple across public agencies and private services in many countries.
How to patch PHP2Shell and check your server
If you run a PHP-based website, start by checking which PHP version your server runs (for example with php -v, or in your hosting control panel).
The flaw is in the PHP engine itself, so updating WordPress or plugins won’t fix it. On Oct. 21, 2026, the PHP team released these fixed versions:
| What to check | Recommended action |
|---|---|
| PHP 8.5 | Update to 8.5.12 or later |
| PHP 8.4 | Update to 8.4.27 or later |
| PHP 8.3 | Update to 8.3.36 or later |
| PHP 8.2 | Update to 8.2.35 or later |
| PHP 8.1 and older | Check for your distribution’s security patch, or move to a supported version |
| Server processes | Restart Apache, PHP-FPM and related services |
| Credentials | If there are signs of a breach, change passwords and API keys |
After updating, restart your web server and PHP processes too. Even after the program files are replaced, a process that’s still running can keep the vulnerable code in memory.
If you can’t update right away, consider limiting outside access or taking the service offline for now. Settings such as session.upload_progress.enabled = 0 or upload size limits can’t fully block these flaws. As php.net puts it, “There are no complete mitigations, updating is the only safe choice.”
On Oct. 23, php.net also suggested setting session.upload_progress.enabled=0 until the next regular bugfix release. That covers a separate, unlikely RCE path tracked as CVE-2026-115560, on top of the update.
For versions that no longer get official support, such as PHP 8.1 and older, check whether your operating system’s distribution provides its own security patch. Some distributions and long-term support vendors backport the fixes. CISA advises taking systems on PHP 8.1 or earlier offline if they can’t be updated.
And if you’re on PHP 8.2, which reaches end of life on Dec. 31, 2026, this is a good time to plan a move to 8.3 or later.
Bottom line: check your PHP server now
The PHP2Shell vulnerability is drawing attention because AI found a flaw that had gone unnoticed for years. AI speeds up security research, but attackers can use the same tools. The window to respond after disclosure keeps shrinking.
If you run a PHP-based website, start by checking your version. Services built on PHP, such as WordPress, depend on regular updates and server security checks, so use this as a chance to review how your site is managed.
