PHP2Shell: How AI Found It and Who Went Offline

PHP2Shell is the name for two critical flaws in PHP itself, and they affect almost every PHP site on the web. Two questions about PHP2Shell keep coming up: who found the bug, and how much did AI help? And which big websites and organisations were actually hit? This post answers both, with each claim linked to the source that makes it.

Updated 27 October 2026. This story is still moving. Fix tables and outage lists change daily.

What PHP2Shell is, briefly

PHP2Shell covers two bugs in the PHP engine, CVE-2026-109618 and CVE-2026-109619. The PHP project says both "can allow unauthenticated remote code execution". In plain terms, an attacker may be able to run code on your server without logging in.

• CVE-2026-109618 sits in out-of-memory handling. It can leave request data half set up.
• CVE-2026-109619 lets request state outlive the memory behind it, so a later request can reuse it.

PHP fixed both on 21 October 2026, with one release per supported branch:

PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed are all affected. PHP rates the risk highest for mod_php, and it says plainly: "There are no complete mitigations, updating is the only safe choice."

How AI helped find PHP2Shell

Several teams found the same flaw at different times. The sources also credit different AI tools. So here is each credit, next to the source that makes it.

Who reported PHP2Shell, and with which tools

Calif came first. Researcher Ryan Austin at Calif found the first bug on 1 August 2026. Calif reported it to PHP on 11 August and sent a second bug on 21 August. Calif's own write-up names no AI model. It says it used generally available models through OpenAI's "Patch the Planet" initiative, with "No special harness". However, Fortune reports that Calif found the first issue "on Aug. 1 using GPT-5.6 Sol". OpenAI and Wikipedia (citing the Wall Street Journal) give the same model.

Wiz reported on 24 August. Fortune says Wiz identified the issue on 19 August. Wiz and the PHP Foundation both give 24 August as the report date. Wiz names its own tools: "We used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout this research." Google Cloud adds that Gemini 4 Argon helped Wiz find the flaw, build an exploit, detect attacks and check the patch. Keep in mind that Google supplies that model, so it has an interest.

OpenAI reported it independently. The PHP Foundation says OpenAI reported the same root cause on its own, then sent more attack paths on 18 September. It thanks "OpenAI Codex Security, especially Amy Burnett". The CVE record lists OpenAI as a finder.

Two names that did not find it

Two other names come up, and neither found this bug:

• Quarkslab's 2024 audit did not find it. While fixing a separate audit finding, a core developer saw "the first signs of the OOM problem". An exploit was theorised, but no concrete path was found.
• Anthropic's Claude Mythos was used by Alpha-Omega to scan PHP earlier in 2026. The Foundation states no findings from that scan.

The Foundation calls the gap between the August reports and the October fix "a structural failure". It now uses AI, including OpenAI's Daybreak Red, to sort incoming reports. A person still makes every decision.

PHP2Shell timeline

The release was moved up a little, too. The CVE IDs leaked on forums on 20 October, so PHP shipped on 21 October at 14:00 UTC.

Who was affected by PHP2Shell

First, the key point. As of 27 October 2026, no primary source confirms a successful breach of any named organisation. Every organisation below either acted as a precaution or is a vendor with affected products.

What has been seen is attack attempts. Amazon's honeypots logged one on 17 October, four days before the fix. Amazon says "it's unclear if any of these attempts would have succeeded". On 26 October, CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog. That is serious, but it is not proof of victims. Under CISA's own criteria, "Successful malicious code execution on a honeypot is considered attempted exploitation".

Organisations that went offline

CISA told anyone who could not patch to take PHP systems offline. The UK NCSC said to "consider taking the system offline" if mitigations could not be applied quickly. Many organisations did just that.

Reuters also lists the Czech government, some BBC portals, Edinburgh council, some Government of Canada sites, and Japanese agencies and firms.

Products with vendor advisories

These products bundle PHP. Status is as of 27 October 2026.

Platforms exposed because they run on PHP

The flaw is in PHP, not in your CMS. Cloudflare warns that "updating website code or a plugin(s) alone does not fix these vulnerabilities".

Calif says it confirmed pre-login code execution on current versions of WordPress, Drupal, Joomla, MediaWiki, Roundcube, Magento, phpMyAdmin, Nextcloud, Laravel, Symfony and WHMCS. Wiz showed it on WordPress, Drupal and Joomla. Sansec adds Shopware and WooCommerce, even when their own code is clean. Sansec also now thinks mass exploitation is less likely, because attacks need specific conditions on the target.

How big is the exposure? Wiz estimates 70% of the internet. W3Techs measures something different: PHP runs on 69.2% of websites whose server-side language it knows. Unit 42 counted over 22.6 million exposed instances that are "potentially vulnerable".

What site owners should do

1. Update PHP to the fixed release for your branch (see the table above) or anything newer. On managed hosting, ask your host.
2. Restart PHP (PHP-FPM, Apache, FrankenPHP or LiteSpeed). Running workers keep the old code.
3. Check backports by changelog. Distro and CloudLinux packages may show an older version number. Look for "CVE-2026-109618" in the changelog rather than trusting php -v.
4. On PHP 8.1 or older, use a vendor backport, or the source-only patches PHP published for branches 7.4, 8.0 and 8.1, then plan an upgrade. Our PHP 8.2 end-of-life guide covers the upgrade path.
5. Set session.upload_progress.enabled=0 in php.ini or the FPM pool (not with ini_set() or .user.ini), then restart. Keep it off even after patching. A related bug, CVE-2026-115560, is not fixed yet.
6. If you cannot patch today, turn on WAF rules from Cloudflare, AWS WAF, Google Cloud Armor or Imunify360. Every vendor says a WAF is not a fix. If nothing else works, take the site offline until it is patched.
7. Check for compromise from 17 October onward. Look for new web shells, odd cron jobs and new accounts. Save your logs before you change anything.

What to do next

Check your PHP version today, patch it, and restart. Then review your logs back to 17 October. For the rest of the week's news, see tech news this week.

If you would rather hand this off, our managed tech service covers hosting and security updates. You can also contact us for a one-off PHP check.