AI-found PHP2Shell flaws in PHP now under attack

PHP2Shell is a pair of critical flaws in core PHP

On October 21, 2026, Wiz Research disclosed critical security flaws in the PHP engine itself, and the PHP project shipped fixes the same day. PHP is the programming language behind WordPress, Drupal, Joomla and MediaWiki, the software that runs Wikipedia. Because the bugs live in PHP rather than in any one app, a site can be exposed even if its own code is clean.

Two CVEs rated up to CVSS 9.2

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. A CVE is a public ID number given to each known vulnerability. Wiz rates them up to 9.2 on CVSS, the 0-to-10 scale used to score how severe a vulnerability is.

Both can let an attacker run code on the server without logging in. Wiz also showed attackers could read server memory that may hold passwords, tokens and API keys, without needing to take over the server first.

Wiz took over WordPress, Drupal and Joomla without a login

Wiz combined the flaws into one script and used it to run code on the latest WordPress, Drupal and Joomla container images, with no account at all. Those three were chosen as examples. Wiz says the app does not need its own bug for the attack to work.

Which PHP versions are affected

Wiz says nearly every PHP version going back to 5.4 has at least one of the two flaws. It also notes that PHP runs 70% of the world's websites.

The PHP project's advisory says every PHP installation that serves web requests is at risk. That covers PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php at the highest risk.

Patched releases for PHP 8.2 through 8.5

The PHP project fixed both flaws in four releases and asked every user to update right away. The table shows which release closes the gap for each branch.

Affected versions and fixed releases (PHP security advisory)

Branch	Affected	Fixed release
8.5	before 8.5.12	8.5.12
8.4	before 8.4.27	8.4.27
8.3	before 8.3.36	8.3.36
8.2	before 8.2.35	8.2.35

Linux distributions and long-term support vendors received the patches before disclosure. If you install PHP from one of them, look for its updated package rather than the version number alone.

No official fix for PHP 8.1 and older

PHP 8.1 and older no longer get updates from the PHP project. Some distributions and long-term support vendors have backported the fix. The PHP security team also posted minimal source patches for 7.4, 8.0 and 8.1 for people who build PHP themselves.

The advisory is clear that settings changes are not a substitute. They can close specific attack paths, but only an update fully fixes the flaws.

How AI helped Wiz find and prove the flaws

Wiz says it used its own Wiz Atlas plus Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol throughout the research. It credits Gemini 4 Argon with help on finding the bug, building the exploit, spotting attacks and checking the patch.

Wiz's disclosure timeline

Date	Event
Aug 19, 2026	Wiz finds the first flaw
Aug 20, 2026	Login-free code execution confirmed on Drupal
Aug 21, 2026	Same result on WordPress
Aug 24, 2026	Wiz reports the flaws to the PHP security team
Sep 21, 2026	PHP acknowledges and starts a coordinated fix
Oct 21, 2026	Patched releases and public disclosure

A decade-old bug turned into a working exploit

The vulnerable code had been in PHP for more than a decade. Proving it could be exploited meant chaining several bugs and adjusting to each server's memory layout through repeated testing. Wiz says that work sat at the edge of what human researchers could practically do.

With AI doing much of the trial and error, Wiz says one researcher finished in a week what would once have taken a top team months. The same speed is open to attackers, which is why Wiz argues that complexity can no longer be counted on as protection. Other AI labs are building tools for the same job (see OpenAI Daybreak: GPT-5.5-Cyber and Codex Security).

From discovery to disclosure in two months

Wiz reported the flaws to PHP on August 24, and the fix and the disclosure both landed on October 21. Wiz worked with the PHP team, Calif and OpenAI on discovery, coordination and patch checks.

Before the details went public, cloud and network companies prepared protections for customers who could not patch at once. Wiz names Automattic, Akamai, AWS, Cloudflare, Fastly, Google, Imperva, Microsoft and Vercel among them.

CISA confirms the flaws are being exploited

On October 26, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its Known Exploited Vulnerabilities (KEV) catalog. The KEV catalog is CISA's list of vulnerabilities confirmed to be exploited in real attacks.

CISA first warned about the flaws on October 21 and urged immediate patching. On October 23 it added a detection rule to help defenders spot suspicious activity in their logs.

Check whether your company runs PHP

If any of your sites or internal tools run on PHP, treat this as an urgent fix rather than routine maintenance. CISA's alert lays out what organizations should do, and the steps below follow it.

CISA's recommended actions (CISA alert)

Situation	Action
You run PHP anywhere	List every system that uses it
A patch is available	Update now, internet-facing systems first
You cannot update, or run 8.1 or older	Take the PHP-based system offline
You are waiting to update	A web application firewall may help in the meantime

What companies should do now

Start with an inventory of every system that runs PHP, including products that bundle it inside. CISA warns that PHP is often a component of other software, so you may not see it at first glance.

Then update to a fixed release, beginning with anything reachable from the internet. Systems on PHP 8.1 or older, or ones you cannot patch yet, should come offline until they are updated. A web application firewall can buy some time, but CISA treats it as partial protection only.

What employees should do now

If you look after a website, a WordPress install or a business tool, find out whether it runs on PHP. When a web agency or hosting company manages it for you, ask them directly whether they have applied the PHP2Shell fix.

CISA also tells defenders to watch for PHP worker processes that open a command shell or download tools. If you notice odd behavior on a PHP server, report it to your IT or security team rather than investigating it alone.