{"slug": "php2shell-cve-2026-109618-how-ai-found-a-decade-old-bug-in-70-of-the-web", "title": "PHP2Shell (CVE-2026-109618): How AI Found a Decade-Old Bug in 70% of the Web", "summary": "Frontier AI models from OpenAI and Google Gemini uncovered a decade-old memory corruption flaw in the core PHP runtime engine, tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed PHP2Shell, affecting every PHP release from 5.4 through 8.5 with a CVSS v4.0 score of 9.2. The PHP Foundation said the underlying out-of-memory bug was first glimpsed in a 2024 Quarkslab audit but stalled for nearly two years because no concrete remote code execution path had been demonstrated. Government portals, Wikimedia systems, Scottish public health boards, Edinburgh Council, the Finnish government and the Netherlands NCSC temporarily pulled services offline as coordinated patching began.", "body_md": "Original: [https://codingcat.dev/post/php2shell-cve-2026-109618-ai-php-security-scramble](https://codingcat.dev/post/php2shell-cve-2026-109618-ai-php-security-scramble)\n\nEvery single year since 2010, someone on Hacker News or X posts a hot take declaring that PHP is dead. And then, in October 2026, frontier AI models uncovered a decade-old memory corruption flaw in the core PHP runtime engine, and suddenly **70% of the internet** had to scramble into emergency patching mode.\n\nAs [reported by BBC News](https://www.bbc.com/news/articles/c3qjnwye0ep5o), government portals, Wikimedia systems supporting Wikipedia, public health boards in Scotland, Edinburgh Council, the Finnish government, and even the Netherlands National Cyber Security Centre (NCSC) temporarily pulled services offline this week as a precaution against two critical vulnerabilities collectively dubbed **PHP2Shell** (`CVE-2026-109618` and `CVE-2026-109619`).\n\nBoth vulnerabilities carry a critical **CVSS v4.0 score of 9.2** and affect every release of PHP from **PHP 5.4 through PHP 8.5**. Here is a technical breakdown of what happened, how AI models from OpenAI and Google Gemini accelerated the discovery, what actually breaks inside the Zend Engine, and how to verify and patch your servers right now.\n\nUnlike application-level vulnerabilities in a specific WordPress plugin or Composer package, [PHP2Shell](https://en.wikipedia.org/wiki/PHP2Shell) sits directly inside the C-based PHP interpreter itself, specifically in the paths responsible for **request memory management and error handling**.\n\nAccording to [The PHP Foundation's official security retrospective](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/), the underlying Out-of-Memory (OOM) flaw behind `CVE-2026-109618` was first glimpsed in 2024 after an external security audit by Quarkslab funded by the Sovereign Tech Agency through OSTIF. While fixing one of the audit findings, a contracted core developer noticed that hitting PHP's memory limit at a very specific moment could leave internal engine structures in an inconsistent state.\n\n\"Both issues sit in parts of PHP that nearly every request touches: memory management and error handling. Their central place in PHP is what made both vulnerabilities serious, and also so hard to fix without breaking compatibility, hurting performance, or forcing changes on the large ecosystem of third-party extensions.\" (The PHP Foundation)\n\nBecause no one had demonstrated a concrete Remote Code Execution (RCE) exploit path in 2024, and because every candidate fix risked breaking backward compatibility or C extensions, work on a patch stalled under the PHP security team's consensus model for nearly two years.\n\nWhat changed in late 2026 was not the underlying C code in PHP. What changed was the arrival of frontier AI models capable of reasoning across deep engine call graphs and synthesizing multi-step memory corruption chains:\n\n`GPT-5.6 Sol` under OpenAI's `CVE-2026-109618` and `CVE-2026-109619` using AI-driven vulnerability research agents powered by Google Gemini and GPT models, calling the flaws the most severe vulnerabilities ever uncovered by AI.\nAs UNSW Sydney cybersecurity researcher Salil Kanhere told the [BBC](https://www.bbc.com/news/articles/c3qjnwye0ep5o), the underlying bugs were not new; what changed was our ability to find and weaponize them at machine speed.\n\nFollowing coordinated work between Calif, Wiz, OpenAI, and the PHP Foundation's Ecosystem Security Team in August and September 2026, an embargoed release was scheduled for October 21 at 14:00 UTC.\n\nHowever, the timeline fractured:\n\nWhen a request hits a PHP server, the Zend Engine initializes per-request memory structures, parses incoming request variables, and sets up session and error-handling state. If an attacker crafts a request that triggers an Out-of-Memory (`OOM`) condition during a narrow initialization window, PHP invokes `zend_bailout()` to abort the request and clean up memory.\n\nIn unpatched versions of PHP (5.4 through 8.5), if `zend_bailout()` fired before specific internal pointers finished initializing, the shutdown destructor routine still treated those partially initialized structures as valid pointers. By combining `CVE-2026-109618` and `CVE-2026-109619`, an unauthenticated remote attacker can corrupt engine memory before application authentication checks ever run.\n\nAccording to [Sansec Forensics' technical advisory](https://sansec.io/research/php2shell), Calif demonstrated unauthenticated code execution against clean installations of:\n\nBecause the vulnerability lives in the PHP binary (`php-fpm`, `mod_php`, or `php-cgi`), **updating WordPress plugins, Composer dependencies, or application code will not fix PHP2Shell**. You must patch the underlying PHP runtime on the host or container.\n\nWhile government advisories from the US NSA, UK NCSC, and Japanese Prime Minister Sanae Takaichi urged organizations to patch immediately or temporarily suspend unpatched sites, forensic researchers at [Sansec](https://sansec.io/research/php2shell), [Tenable](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote), and [Bitdefender](https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce/) point out an important nuance:\n\nUnlike Log4Shell or Shellshock, where a single static HTTP header could compromise almost any vulnerable server blindly, reliable PHP2Shell exploitation requires target-specific knowledge of the server's memory configuration and application state to hit the exact OOM window. Many noisy proof-of-concept scripts circulating on GitHub right now either fail against default PHP installations or rely on a separate Local File Inclusion (LFI) bug.\n\nHowever, with AI-assisted offensive tooling rapidly evolving, as tracked by [Recorded Future's Insikt Group](https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation) and [Sophos X-Ops](https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell), leaving an internet-facing PHP runtime unpatched is an unacceptable risk.\n\nThe PHP project released official patched versions for all active branches on October 21, 2026:\n\n`8.5.12` or later`8.4.27` or later`8.3.36` or later`8.2.35` or later\nIf you are running an End-of-Life (EOL) version of PHP (such as PHP 7.4, 8.0, or 8.1), PHP.net does not publish official binary releases, and official Docker `php:8.1` images will not receive an update. However, Debian, Ubuntu, CloudLinux, and Remi's RPM repository for RHEL, AlmaLinux, and Rocky Linux have backported the source patches into their distro packages while keeping the base version number.\n\nRun the following commands on your server to verify whether your PHP package includes the backported fix for `CVE-2026-109618` and `CVE-2026-109619`:\n\n```\n# 1. Check your running PHP version\nphp -v\n\n# 2. On Debian / Ubuntu, verify the CVE patch in the package changelog\nzgrep CVE-2026-109618 /usr/share/doc/php*-common/changelog.Debian.gz\n\n# 3. On RHEL / AlmaLinux / Rocky Linux, check the RPM changelog\nrpm -q --changelog php-common | grep CVE-2026-109618\n\n# 4. Apply updates and restart PHP-FPM / Apache\nsudo apt update && sudo apt install --only-upgrade 'php*'\nsudo systemctl restart php8.4-fpm apache2\n```\n\nIf you cannot patch immediately, place your site behind an edge WAF such as [Cloudflare's emergency PHP2Shell WAF rules](https://blog.cloudflare.com/php-vulnerabilities-waf-protection) and audit your server logs for abnormal `Allowed memory size of ... bytes exhausted` spikes paired with unexpected POST payloads.\n\nTo track ongoing updates, vendor backports, and Indicators of Compromise (IoCs), bookmark these primary advisories and technical reports:", "url": "https://wpnews.pro/news/php2shell-cve-2026-109618-how-ai-found-a-decade-old-bug-in-70-of-the-web", "canonical_source": "https://dev.to/codingcatdev/php2shell-cve-2026-109618-how-ai-found-a-decade-old-bug-in-70-of-the-web-32l4", "published_at": "2026-10-22 17:59:08+00:00", "updated_at": "2026-10-22 18:11:47.887251+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence", "large-language-models", "ai-agents"], "entities": ["PHP", "PHP Foundation", "OpenAI", "Google Gemini", "Quarkslab", "Wikimedia", "Netherlands NCSC", "Salil Kanhere"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/php2shell-cve-2026-109618-how-ai-found-a-decade-old-bug-in-70-of-the-web", "markdown": "https://wpnews.pro/news/php2shell-cve-2026-109618-how-ai-found-a-decade-old-bug-in-70-of-the-web.md", "text": "https://wpnews.pro/news/php2shell-cve-2026-109618-how-ai-found-a-decade-old-bug-in-70-of-the-web.txt", "jsonld": "https://wpnews.pro/news/php2shell-cve-2026-109618-how-ai-found-a-decade-old-bug-in-70-of-the-web.jsonld"}}