PHP patches PHP2Shell RCE zero-days found by AI models, but EOL versions get no fix

Emergency fixes for two engine-level flaws

The PHP project shipped emergency security releases on October 21, 2026, closing two critical remote-code-execution zero-days tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. According to a dev.to write-up that assembled the disclosure timeline, both flaws score 9.2 under CVSS v4.0. A second dev.to analysis adds an important caveat: the CVE identifiers came from a leak rather than PHP's own announcement, which listed no numbers, and the 10.0 severity score that circulated beforehand was a rumor that The Hacker News later corrected.

Two use-after-free bugs in the core

CVE-2026-109618 is triggered when memory runs out at the wrong moment during request setup: internal structures are left half-initialized and cleanup code trusts the corrupted state, producing a use-after-free. CVE-2026-109619 leaves internal pointers alive across request boundaries after a fatal error, so a later request served by the same PHP worker can hijack them; a related variant leaks passwords, API keys and certificates from other requests via the PHPSESSID cookie even without a session_start call. The dev.to report says unauthenticated RCE was demonstrated against Apache mod_php with default settings and against the latest WordPress, Drupal and Joomla container images. Because the bugs sit in the engine, patching a CMS or framework accomplishes nothing until PHP itself is updated.

AI-assisted researchers got there first

Security firm Calif, working under OpenAI's Patch the Planet initiative, began auditing PHP's source on July 30, 2026 using GPT-5.6 Sol; researcher Ryan Austin identified the first exploitable flaw on August 1. Wiz Research independently rediscovered the bugs on August 19 using Gemini 4 Argon, GPT-5.6 Sol and its own Wiz Atlas tool, confirming unauthenticated RCE against Drupal and WordPress within two days. Both teams reported to the PHP security team on August 24, and PHP acknowledged the reports on September 21. The timeline notes the out-of-memory pattern had been noticed as early as 2024 during an OSTIF/Quarkslab audit, but no exploit was found and the fix stalled — something the PHP Foundation reportedly described as a structural failure of its consensus-based security process.

The embargo leaked before it opened

A Hacker News post on October 20 disclosed details with incorrect timing and scoring. WatchTowr confirmed on X that the leak was genuine, and PHP moved its release up by a day to Wednesday, per the second dev.to timeline. Chainguard published patched container images roughly six hours ahead of the coordinated release, handing attackers a binary diff to reverse-engineer, and Calif accidentally published a proof-of-concept video. A public exploit named php2shell appeared on GitHub within hours of disclosure. Most troubling, Amazon's MadPot honeypot recorded exploitation attempts on October 17 — four days before disclosure — from a commercial anonymization network; AWS says it is unclear how the actor obtained the information under embargo. Once the news broke, Cloudflare reported tens of thousands of exploit attempts within 45 minutes and millions by evening, and AWS confirmed broad exploitation in the wild. The Netherlands and Finland took government websites offline as a precaution, and Archive.org went temporarily dark.

Most exposed installs will never get the patch

PHP ships fixes only for supported branches: 8.2, 8.3, 8.4 and 8.5. According to Mallory figures cited in the second dev.to analysis, based on counting HTTP banners through Shodan, roughly 1.5 million hosts expose a PHP version and 883,717 of them (59%) run PHP 8.1 or older — versions that will receive no official patch — while another 740,000 advertise PHP without revealing a version. The worst figures include Algeria at essentially 100%, South Korea at 82% of 30,102 hosts, Cambodia at 79%, Thailand at 78% of 18,701 and Vietnam at 62%, against 54% in the US and 53% in India. The two sources disagree on scope: one claims every version back to PHP 5.4 and an estimated 70% of the web, Mallory claims reach back to 2004, and The Hacker News and Huntress both note that the affected range was never confirmed in official guidance. Banner scanning also cannot prove a specific host is vulnerable.

What operators should do now

The Hacker News lays out the options for end-of-life installs: upgrade to a supported branch, take the machine off the internet, or shield it behind a VPN or WAF until migration, and ask hosting providers and Linux vendors about backported fixes. Cloudflare deployed temporary WAF rules before the release. After patching, monitor for php-fpm, php-cgi or Apache processes spawning shells, interpreters or downloaders — Florian Roth's process-watcher logs those child processes with command lines — and hunt for web shells, new files in web roots, new cron jobs and new accounts. The precedent is CVE-2024-4577, where Akamai observed exploitation attempts against honeypots within 24 hours of disclosure.

Why it matters

PHP2Shell is the first internet-scale vulnerability where AI-assisted discovery demonstrably beat public disclosure, yet pre-disclosure exploitation and a cascade of leaks undercut that advantage — the dual-use risk OpenAI itself has acknowledged. It also exposes the hard limit of patch-first advice: when most internet-facing PHP installs run end-of-life branches, emergency releases reach only a minority. With FIRST projecting 66,000 CVEs in 2026, up from 48,000 in 2025, and Mandiant measuring a negative seven-day mean time-to-exploit, the window defenders have to work with keeps shrinking even as AI accelerates the finding.