PHP2Shell: Old Bugs, Faster Exploits

The bedtime question in the meme has acquired a very specific answer. Two critical vulnerabilities disclosed on October 21 can let attackers run code on vulnerable PHP servers without logging in. Updating the application on top of PHP does not necessarily update the machinery underneath it.

For the AI debate, the striking development is the work between noticing a memory error and demonstrating a reliable attack. Researchers describe models helping them cross that distance, then helping defenders test the repairs. PHP2Shell is a useful case study in what faster security research demands from the people maintaining the software.

Meme supplied for this article. The useful follow-up is which PHP runtime is actually serving the website.

The failure is underneath the website

Hover or focus a citation to see its evidence and warrant. Click or tap to keep it open; source links are inside the panel.

The two issues, CVE-2026-109618 and CVE-2026-109619, concern PHP’s handling of memory and internal request state. The technical advisories describe errors that can become remote code execution rather than simply crashing a request.

PHP workers handle requests on behalf of an application. If their internal state becomes unsafe, careful application code cannot be assumed to contain the damage. One demonstrated Apache mod_php attack can reach the vulnerable path before the application starts running.

Deployment details still matter. A working attack against one server configuration does not establish that the same attack works unchanged against every PHP site. The seriousness comes from the vulnerable layer and demonstrated impact, without needing to turn every installation into an identical target.

Part of this problem was already known

The PHP Foundation’s account traces signs of the out-of-memory problem back to 2024. A possible exploit was considered then, but no concrete attack vector had been found.

The Foundation describes fixes stalling amid compatibility, performance, and denial-of-service trade-offs, limited specialist capacity, and a consensus process that struggled to reach a decision. It calls the delay a structural failure. Concrete remote-code-execution reports in 2026 made the impact clearer and pushed the repair to the top of the team’s priorities.

That history matters when reading “AI discovered it” headlines. Identifying suspicious behavior, establishing exploitability, and finding a repair that can safely ship are different achievements. This case includes work at each stage, by multiple researchers over time.

What the models contributed

Wiz’s researchers say they used Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol during discovery, exploit development, and validation. They describe models helping adapt attacks to different PHP versions, configurations, and memory layouts through repeated testing and debugging.

This is an important kind of assistance. An exploit that works once in a research environment can still fail when a target allocates memory differently or follows a different request path. Investigating those failures is part of the work. A tool that helps researchers iterate can change which bugs are practical to pursue.

The account comes from a participating research vendor. It demonstrates reported capabilities in this investigation; it does not supply a controlled measurement of how much faster every security researcher becomes. Claims about an industry-wide productivity multiplier need additional evidence.

Someone still has to ship the fix

OpenAI’s disclosure credits PHP’s maintainers with leading the fixes and release, with research, testing, and coordination contributed by partners. It attributes Calif’s discovery of a critical flaw to work using GPT-5.6 Sol and acknowledges Wiz’s independent reports.

Finding more exploitable bugs creates more work for maintainers: reproduce the problem, understand its scope, assess proposed fixes, preserve legitimate behavior, and help distributors deliver updates. Model assistance can contribute throughout that process. The responsibility for accepting and shipping a repair still needs a clear owner.

The practical test for AI security is whether it helps more systems reach a repaired state. Counting discoveries alone leaves out the work between a convincing demonstration and a server that is safe to keep online.

Attack traffic is a separate piece of evidence

Cloudflare reported seeing attack traffic targeting its customers and attempts to vary payloads around its protections. Its account also tells customers to patch PHP while keeping firewall protections enabled.

Observed attempts establish that operators are facing more than a hypothetical research demonstration. They do not, by themselves, tell us how many servers were successfully compromised. A scanner, a blocked exploit attempt, and a confirmed intrusion should not be counted as the same event.

For operators, an edge filter is an additional barrier. It does not remove the underlying PHP bug, and its usefulness depends on the traffic and attack paths it covers. “The firewall is handling it” needs to be followed by “and the origin is patched.”

Check the runtime, and check the current guidance

The October 21 fixes were released in these supported PHP branches:

Confirm the update serving web requests, including any vendor backport, and replace or restart old workers. An updated command-line installation is insufficient evidence about a different runtime behind the website. Managed-hosting customers need confirmation from their provider.

PHP 8.1 and earlier are outside normal upstream support. Exceptional source-backports and vendor packages exist. Verify the exact package or build; those fixes do not restore general upstream support.

There is also new PHP guidance dated October 23: an unusual session-serialization configuration leaves an additional remote-code-execution path to address. PHP recommends disabling session upload progress until the next regular bugfix release; its notice explains the specific runtime handler change required for exposure and says applications that never make that change can keep the feature enabled. A full advisory for CVE-2026-115560 is planned with that release.

Treat this as current operational guidance, alongside installing the October 21 security updates. A patch checklist should record the running version, relevant configuration, and vendor advice checked—not simply that someone clicked an update button.

PHP2Shell makes the old patching joke more uncomfortable because the exploitation work is becoming easier to accelerate. The useful response is to bring the same attention to maintenance: knowing which systems depend on the affected software, supporting the people fixing it, and verifying that the repair has reached the machines doing the work.

---

Advisories and research accounts checked on 23 October 2026. Researcher and vendor claims are attributed; this article does not independently reproduce their exploits. The meme was supplied for this article.