PHP shipped emergency releases on October 21 for two critical flaws that, the PHP Foundation says, "under the right conditions, allow an unauthenticated attacker to execute code on servers running PHP." The bugs, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed php2shell, were found with help from frontier AI models, and the coordinated disclosure broke down two days before the planned date. The PHP security advisory says to update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now.
What the two bugs do
The PHP Foundation's write-up describes both flaws as problems in "memory management and error handling," parts of PHP "that nearly every request touches."
- CVE-2026-109618, RCE via OOM corruption. If a request hits PHP's memory_limit "at exactly the wrong moment," PHP can leave half-built internal data behind and later treat it as valid. On Apache with mod_php, an unauthenticated request can trigger this before any application code runs.
- CVE-2026-109619, RCE via stale state. A fatal error can leave internal state pointing at memory from a previous request, which a later request on the same worker may then use.
The advisory says every PHP install that serves web requests is at risk, "including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed." Cloudflare says the flaws affect web servers running PHP 5.4 or later and notes PHP "is used by almost 70% of websites." PHP rates both 9.2 out of 10.
How AI found them
OpenAI says security firm Calif "identified a critical flaw using GPT-5.6 Sol" as part of its Patch the Planet program, and that Wiz "independently" found and reported both bugs. OpenAI calls this "one of the most impactful security issues in recent memory" and expects "similar findings to increase sharply in the coming months."
A PHP core developer contracted by the PHP Foundation found "the first signs of the OOM problem" in 2024, but no concrete attack path was found and work on a fix stalled and restarted for months. The foundation calls that delay "a structural failure." On August 11, Calif and OpenAI each reported the same root cause, followed by more attack paths from Wiz on August 24 and OpenAI on September 18.
AI is also changing the workload. The foundation says it has published 15 CVEs since July 1 and worked through more than 100 reports that were invalid, duplicates or not reproducible. AI helps sort them, "but a person makes every call and works on every patch." It scanned PHP earlier this year with Anthropic's Claude Mythos and now also uses OpenAI's Daybreak Red to validate reports.
How the embargo broke
The foundation says coordinated disclosure "worked well until 2 days ahead of the targeted release date." The steps below use its UTC times, converted to PT (UTC-7):
- Oct 20, about 8:00 AM PT: the two CVE IDs began circulating online with a wrong release time and a wrong score of 10.0. No technical details leaked.
- Oct 20, 12:30 PM PT: PHP posted its pre-announcement and moved the release up one day, to October 21 at 7:00 AM PT.
- Later on Oct 20: after the leak and pre-announcement, Calif "mistakenly published a video" of its proof of concept. The foundation says it "contributed to accelerated development of various PoCs."
- Oct 21, 12:41 AM PT: per the foundation, Chainguard "unilaterally broke the embargo" by publishing built images with the fix more than six hours early, so "any attacker could now study the fix in binary form."
Chainguard disputes that framing. Its chief executive told The Register the company "didn't leak," did not dispute the timeline, and said it shipped because "people were getting hit in advance" of the official disclosure. He said Chainguard notified the PHP disclosure channel of its plans, and that his team had independently found the same bugs with its AI harness and a frontier model after hearing "something was coming in PHP."
Attacks have started
Cloudflare says its firewall rules were on by default for free and paid customers from October 20 at 8:02 PM PT, about nine hours before disclosure, and that it "observed attack traffic targeting our customers" after the leak. SecurityWeek reports that watchTowr saw in-the-wild exploit attempts around the time patches landed but no successful ones, while Hadrian said hours earlier that php2shell was being "exploited in the wild at scale."
What to do
Update PHP itself. Cloudflare notes that updating site code or plugins alone does not fix these flaws. PHP 8.1 and older no longer get project updates, though the advisory says the team released minimal source backports for 7.4, 8.0 and 8.1. Ask your distribution or host for patched packages. The advisory's stopgaps, such as memory_limit=-1 and a low post_max_size, "do not make an installation safe."
Why it matters
AI models found these bugs, and Chainguard's chief executive told The Register his team found the same ones the night it heard "something was coming in PHP." The same week brought reports of one hacker's AI agents breaching 100+ company sites and the OpenCode Console key breach, while AI security engineer job postings climbed. The PHP Foundation's point is that tools find bugs, but a small team of engineers still has to pick the fix, and it is asking the companies that run on PHP to fund that work.
Sources
- PHP: Security advisory, critical remote code execution vulnerabilities (Oct 21, 2026)
- The PHP Foundation: Today's PHP Security Release, and How We're Strengthening PHP Security
- OpenAI: Patch the Planet, global response coordination as agents uncover critical vulnerabilities
- Cloudflare: Cloudflare deploys protections against php2shell vulnerability
- The Register: PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk
- SecurityWeek: PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
