PHP2Shell: AI models found two critical PHP flaws that went unnoticed for over a decade

Industry news · 2026-10-22

On October 21, 2026 the PHP project shipped emergency releases — PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — fixing two critical vulnerabilities now known as PHP2Shell: CVE-2026-109618 and CVE-2026-109619. Both are rated CVSS v4.0 9.2 and allow unauthenticated remote code execution on servers that handle web requests with PHP.

What is affected

According to the PHP announcement, every PHP installation serving web requests is at risk — PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed — with mod_php at highest risk, because the attack can run before any application code does. Wiz, which disclosed the issues, says every PHP version released in the last decade is affected by at least one of the bugs, going back to PHP 5.4. WordPress, Drupal and Joomla were all shown to be exploitable without logging in.

The root cause is memory-safety: an out-of-memory error can abort a request halfway through, and request state left behind is reused by the next request handled by the same worker.

AI found it before attackers did

The bugs sat in PHP's core for more than ten years. They were found this summer with AI. In its write-up, Wiz Research says the first vulnerability was discovered on August 19 using AI tools, with Gemini 4 Argon and GPT-5.6 Sol named among the models used for discovery, exploit development and patch validation. Wiz thanks the PHP team, Calif and OpenAI for discovery, coordination and patch verification. The issues were reported to the PHP security team on August 24 and fixed in a coordinated release two months later.

Wiz sums up the shift: "a single researcher completed in a week what previously would have taken a world-class team months of work." Humans still chained the bugs and verified the fix, but the search itself is now fast and cheap. At publication, CISA said it had not observed exploitation — the defenders got there first this time. The same tools are available to attackers, so the window to patch is short.

What to do now

• Upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart PHP workers. The PHP project says updating is the only safe choice; the partial settings it lists do not make an installation safe.
• PHP 8.1 and older receive no fixes from the PHP project. Ask your distribution or LTS vendor for a backport, or upgrade. CISA advises taking unpatched internet-facing systems offline.
• Check your logs for unusual multipart requests followed by memory-limit errors or bursts of HTTP 500s, oversized PHPSESSID cookies, and PHP workers launching shells.
• Rotate secrets stored on any PHP server you suspect was compromised — including API keys. You can revoke and recreate OneFast keys in the console at any time.

Is OneFast affected?

No. The OneFast gateway and console are written in Go and do not run PHP. If your own application calls OneFast from PHP, your servers need the update above.

Sources: PHP security announcement, GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp, Wiz Research, CISA alert. Facts as of October 22, 2026.