PHP2Shell: The AI-Found Flaw in the Software Behind 70% of Websites

On the afternoon of Tuesday 20 October 2026, two short codes started circulating on hacker forums: CVE-2026-109618 and CVE-2026-109619. They meant nothing to most people. To the small team that looks after PHP, the programming language behind almost 70% of the world's websites, they meant the secret they had been guarding since August was out, two days early.

By Wednesday (21 October 2026) night, government websites were running a limited service, engineers were patching servers around the clock, and Cloudflare was watching attack attempts climb from thousands to millions. The flaws had a name, PHP2Shell, and part of their story was artificial intelligence.

DEFINITION

PHP2Shell is the name given to two critical vulnerabilities in the PHP programming language, tracked as CVE-2026-109618 and CVE-2026-109619 and disclosed on 21 October 2026. Both can allow an attacker, without logging in, to run their own code on a web server running PHP. They affect PHP 5.4 and later and are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

What is PHP2Shell, in plain English?

Every time someone visits a PHP website, the server sets aside a little memory to build the page, then tidies it away. PHP2Shell lives in the moment that tidying goes wrong. If a request runs out of memory or hits an error at exactly the wrong instant, PHP can leave half-finished data lying around, or keep a note pointing to memory it has already handed back.

An attacker who sends the right request can exploit that mess. Depending on the server, they may be able to crash it, read whatever is sitting in memory (passwords included), or take control of it completely. No login is needed. Both flaws are rated 9.2 out of 10 for severity.

How did the disclosure go wrong?

Security fixes for widely used software are normally released on an agreed date, so that hosting companies and software distributors can update everyone at once before attackers learn the details. PHP2Shell was meant to follow that script. It did not.

TWO DAYS IN OCTOBER: THE PHP2SHELL TIMELINE

2024: an external audit of PHP turns up the first signs of a memory problem. No practical attack is found and the fix stalls. 11 August 2026: researchers at Calif and OpenAI independently report that the problem can be used to take over a server. 20 October, around 15:00 UTC: the vulnerability identifiers leak online, two days before the planned fix. That evening: a demonstration video is published by mistake and copies spread. 21 October, 07:41 UTC: one distributor releases patched software six hours ahead of the agreed time. 21 October, 14:00 UTC: the official fix ships, a day early. Within hours: exploitation attempts climb into the millions.

The PHP Foundation, which funds PHP's security work, was unusually candid about the delay in the middle of that story. Its own account calls the months-long stall between 2024 and 2026 a structural failure, caused by a slow decision process and too few people with the knowledge to fix it.

Where does AI come into it?

The first hint of the problem was found by people, in a 2024 audit. What changed in 2026 was proof. Calif, a security firm working within OpenAI's Patch the Planet programme, and OpenAI's own researchers each showed in August that the flaw could be turned into a working attack. OpenAI says one of the flaws was found with the help of its AI model.

“Given the severity of these flaws and PHP's widespread use, we consider this one of the most impactful security issues.” - OpenAI, 21 October 2026

That is the uncomfortable part. The tools that helped defenders find PHP2Shell are not locked in a vault. Anyone with access to capable AI models can point them at popular software, and the gap between a flaw existing, being found and being exploited is getting shorter.

Is my organisation affected?

If your website, booking system, learning portal or online shop runs on PHP, and many built on WordPress, Magento and similar platforms do, the honest answer is: probably, until someone confirms otherwise. That includes sites built and hosted by an agency on your behalf.

Here is the catch that has tripped up many teams this week. Updating WordPress, your theme or your plugins does not fix PHP2Shell. The flaw is in PHP itself, the engine underneath. Only updating that engine closes the hole.

What should organisations do this week?

Update PHP itself. Move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Website or plugin updates are not enough.
Get it in writing from your host or agency. "We're on it" is not an answer. Ask which version you are now running and when it was updated.
Hunt down the forgotten sites. The old campaign microsite, the conference registration page, the test server nobody switched off. These are the ones attackers find first.
Leave your web application firewall switched on. Cloudflare had protective rules live about nine hours before disclosure. They buy time; they do not replace the patch.
Look for signs someone got in. Review logs and unusual activity from 20 October onwards, when details began to circulate.
Write down what you did and when. Auditors, insurers and regulators will ask, and memories fade fast.

What is the bigger lesson?

Try a simple test. If someone asked you right now which of your organisation's websites run PHP, who maintains each one and whether they were patched on Wednesday, how long would it take to get a confident answer? For many organisations the answer this week was days. The attackers needed hours.

None of that is about writing code. It is about knowing what you run, holding suppliers to account, and having a patching and incident process people have actually practised. Those are management skills, the kind covered on the GLOMACS IT Governance, Risk and Compliance course, and they are what separated the organisations that slept on Wednesday night from the ones that did not.

Which GLOMACS courses build these skills?

Every step in the checklist above is something a team can learn and rehearse before the next emergency. These GLOMACS programmes map directly onto it.

IT Governance, Risk and Compliance. For IT and operations managers who need to know what the organisation runs, who owns it and how quickly it can be fixed. Covers IT security threats, controls, governance standards and compliance.
Cybersecurity Governance, Risk and Compliance. For the people who write the policies behind steps 1 to 6, including ISO 27001 controls and information governance.
Cybersecurity Leadership for Non-Technical Executives. For senior managers who need to ask the right questions of IT teams and suppliers without becoming technical experts.
Cybersecurity Awareness for Managers and Staff. For wider teams who need to spot and report suspicious activity, the human side of step 5.

See the full GLOMACS cybersecurity training courses, or browse cybersecurity courses in Dubai.

KEY TAKEAWAY

PHP2Shell is a pair of critical PHP flaws, found with help from AI, that can let attackers take over web servers without logging in. Because PHP runs almost 70% of websites, every organisation should confirm that PHP itself, not just its website software, has been updated, and should build the asset, supplier and patching disciplines that make the next emergency manageable.

Frequently asked questions

What is PHP2Shell?

PHP2Shell is the collective name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, disclosed on 21 October 2026. They can allow an unauthenticated attacker to run code on a server running PHP.

Which PHP versions are affected by PHP2Shell?

Web servers running PHP 5.4 or later are affected. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Is updating WordPress or my plugins enough to fix PHP2Shell?

No. The flaws are in the PHP runtime, so PHP itself must be updated. If your hosting provider manages PHP, ask them to confirm the update and the version in writing.

Was PHP2Shell found by AI?

AI played a part. The root cause was first noticed in a 2024 audit. In August 2026, researchers at Calif and OpenAI independently showed it could be exploited, and OpenAI says one of the flaws was found with the help of its AI model.

Is PHP2Shell being exploited?

Yes. Cloudflare reported millions of exploitation attempts within hours of disclosure, so unpatched servers should be treated as at risk.

What training helps organisations respond to vulnerabilities like PHP2Shell?

Courses such as IT Governance, Risk and Compliance, Cybersecurity Governance, Risk and Compliance, and Cybersecurity Leadership for Non-Technical Executives build the skills needed to identify affected systems, oversee suppliers and act quickly. GLOMACS runs them in Dubai, London, other international locations and online.

« Back to Articles