PHP2Shell: What the Critical PHP Vulnerabilities Mean for Your Organisation

Why this one Demands Immediate Attention

The exposure is broad. PHP powers roughly 70% of websites, including WordPress, Drupal, e-commerce platforms and countless internal business applications, and Palo Alto Networks’ initial analysis identified 22.6 million potentially vulnerable instances. Attacks are already under way, and CISA, the FBI, the NSA and CERT-EU have all urged organisations to patch immediately.

How AI uncovered PHP2Shell

PHP2Shell is among the first internet-scale vulnerabilities found with significant help from artificial intelligence. Several security teams found it independently in August 2026, and all of them used AI models to do so.

• Calif, a California-based AI red-teaming firm, was first. Working within OpenAI’s Patch the Planet initiative, it identified the initial issue on 1 August using OpenAI’s GPT-5.6 Sol. OpenAI then investigated further and uncovered additional elements of the bug.
• Wiz, the Google-owned cybersecurity company, found the vulnerabilities independently, identifying the first issue on 19 August using Google’s Gemini 4 Argon, GPT-5.6 Sol and its own Wiz Atlas.

OpenAI then brought the parties together in a coalition, including Wiz, Calif, the PHP Foundation, Cloudflare, Quarkslab and several US government agencies, to develop fixes and coordinate disclosure.

The vulnerable code had sat in PHP for more than a decade. According to Wiz, AI’s contribution was the ability to understand those weaknesses and turn them into a working exploit chain. OpenAI has cautioned that the same capability can help attackers build exploits just as quickly.

Key Discoveries and Timeline

Attackers Moved within Minutes

Once the details leaked, exploitation followed almost immediately. Cloudflare observed tens of thousands of exploit attempts within 45 minutes, rising to millions by the evening of 21 October. Amazon Web Services reported the flaws were being broadly exploited in the wild, and had seen attempts in the days before public disclosure. Government agencies in the Netherlands and Finland took websites offline as a precaution.

The Two Vulnerabilities Explained

PHP processes many requests in sequence using the same worker processes. Both flaws stem from how PHP handles fatal errors: it exits a request abruptly and does not always clean up partially built or leftover data before the next request arrives.

• CVE-2026-109618: out-of-memory corruption. When a request exceeds PHP’s memory limit, processing can stop while request data is only partly initialised. The cleanup routine then treats that incomplete data as valid, which an attacker can exploit to execute code.
• CVE-2026-109619: stale global state. Internal state owned by one request, such as session data, error traces or serialised objects, can persist after its memory has been freed. A subsequent request on the same worker can then use that stale data, a classic use-after-free condition.

The outcome in both cases is unauthenticated remote code execution. Critically, the attack triggers before any application code runs, so application-level controls such as input validation cannot prevent it. The fix has to happen in the PHP runtime itself.

Who is Affected

If you serve web requests with any PHP release from PHP 5 onward, you are in scope. This covers all common runtimes: Apache mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Deployments using Apache with mod_php face the greatest risk.

The remediation is a version upgrade. Move to at least the following releases:

The practical challenge is visibility. PHP is frequently embedded in container images, vendor appliances, hosting control panels and legacy internal applications. For many organisations, building a complete inventory will take longer than applying the patch.

Recommended Actions

Upgrading PHP is the only complete remediation. Interim measures reduce exposure but should not replace patching.

1. Inventory all PHP deployments. Include servers, containers and appliances. Note that php -v reports the command-line binary, which may differ from the version your web server uses.
2. Patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
3. Restart PHP workers (PHP-FPM pools, Apache) so the patched runtime is loaded. Restarting also clears the in-memory state that CVE-2026-109619 relies on.
4. Apply interim mitigations where patching is delayed:
   • Isolate or disable internet-facing PHP services.
   • Enable WAF rules from your provider; several block the multipart requests used in known attack paths.
   • Set session.upload_progress.enabled=0 if the feature is not needed. This blocks one demonstrated path for CVE-2026-109619 only.
5. Hunt for indicators of compromise. Review logs from before 20 October. Alert when php-fpm, php-cgi, httpd or apache2 spawns shells (sh, bash, cmd) or utilities such as curl and wget.
6. Rotate credentials on internet-facing hosts that remained unpatched after 20 October, including database passwords, API keys and session secrets.

The Broader Lesson: AI has Raised the Stakes for Security Talent

PHP2Shell marks a turning point. AI helped defenders find a flaw that had escaped expert review for more than a decade, and the same capabilities are available to attackers. The window between disclosure and exploitation has shrunk from weeks to minutes.

Organisations that respond well share common capabilities: an accurate asset inventory, the ability to assess advisories critically, disciplined patch management, teams that can detect and contain intrusions quickly, and increasingly, the skills to use AI tools for both discovery and defence.

These capabilities depend on skilled people, and demand continues to exceed supply. The global shortage of cybersecurity professionals is estimated at more than 4 million.

Why a Masters in Cybersecurity in India is worth considering now

India’s digital economy runs on the same web technologies that PHP2Shell targets, and organisations across sectors need professionals who can secure them. For working professionals, a structured postgraduate qualification offers the depth and credibility that short courses rarely provide.