PHP2Shell: AI-found PHP flaws were probed four days before the patch. Update PHP now

The PHP project shipped PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October to fix two critical bugs, together nicknamed PHP2Shell, that can let an unauthenticated attacker run code on a server. The reports that showed how dangerous they were came from researchers using frontier AI models. And according to Amazon, someone was already trying to exploit them four days earlier.

The two bugs

• CVE-2026-109618, “RCE via OOM corruption” (GHSA-w8hw-w9fx-j79w). If a request hits PHP’s memory limit at the wrong moment, PHP can leave half-initialized internal data behind and later treat it as valid. On Apache with mod_php, the PHP Foundation says, an unauthenticated request can trigger it before any application code runs, and full code execution was shown with default settings.
• CVE-2026-109619, “RCE via stale global state” (GHSA-6wmf-4rv5-p3rp). A fatal error at the wrong point can leave state pointing at memory from a previous request, which a later request on the same worker then uses.

php.net lists PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed as at risk, with mod_php highest. The PHP Foundation gives the CVSS score as 9.2. Wiz says every PHP version from the last decade is hit by at least one of the two, back to 5.4. PHP 8.1 and older get no official releases, though the security team posted minimal source backports for 7.4, 8.0 and 8.1.

Where AI came in

The Foundation’s own timeline is the clearest. Its developers saw the first signs of the memory-limit problem in 2024 but found no concrete attack and could not agree on a fix. On 11 August Calif, auditing PHP under OpenAI’s Patch the Planet program, reported an unconditional code-execution path, and OpenAI reported the same root cause that day. Wiz followed on 24 August. OpenAI says Calif used GPT-5.6 Sol, and that “to our knowledge, frontier AI found these vulnerabilities before attackers did”. Wiz says frontier models made the exploit chain practical “in hours”.

The embargo did not hold

The Foundation says the CVE IDs started circulating on 20 October with a wrong 10.0 score, so it moved the release forward a day. Calif then mistakenly posted a video of its proof of concept, and at 07:41 UTC on 21 October Chainguard published patched images more than six hours before the coordinated release, which the Foundation says “broke the embargo”. AWS says its honeypots logged an attempt on 17 October from an anonymizing network, more attempts in the hours before release, and that PHP2Shell “is now being broadly exploited in the wild”. AWS adds that it is unclear whether those early attempts would have worked.

What to do

1. Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your distribution’s patched package. OpenAI also published a PHP version checker as a Codex skill.
2. If you cannot update yet, php.net lists stopgaps such as memory_limit=-1 set where apps cannot override it, a low post_max_size, and session.upload_progress.enabled=0. It says none of them makes a server safe.
3. AWS advises starting any investigation from 17 October and checking web servers for unexpected processes or file changes.