PHP2Shell (CVE-2026-109618): How AI Found a Decade-Old Bug in 70% of the Web

Frontier AI models from OpenAI and Google Gemini uncovered a decade-old memory corruption flaw in the core PHP runtime engine, tracked as CVE-2026-109618 and CVE-2026-109619 and dubbed PHP2Shell, affecting every PHP release from 5.4 through 8.5 with a CVSS v4.0 score of 9.2. The PHP Foundation said the underlying out-of-memory bug was first glimpsed in a 2024 Quarkslab audit but stalled for nearly two years because no concrete remote code execution path had been demonstrated. Government portals, Wikimedia systems, Scottish public health boards, Edinburgh Council, the Finnish government and the Netherlands NCSC temporarily pulled services offline as coordinated patching began.

Original: https://codingcat.dev/post/php2shell-cve-2026-109618-ai-php-security-scramble https://codingcat.dev/post/php2shell-cve-2026-109618-ai-php-security-scramble Every single year since 2010, someone on Hacker News or X posts a hot take declaring that PHP is dead. And then, in October 2026, frontier AI models uncovered a decade-old memory corruption flaw in the core PHP runtime engine, and suddenly 70% of the internet had to scramble into emergency patching mode. As reported by BBC News https://www.bbc.com/news/articles/c3qjnwye0ep5o , government portals, Wikimedia systems supporting Wikipedia, public health boards in Scotland, Edinburgh Council, the Finnish government, and even the Netherlands National Cyber Security Centre NCSC temporarily pulled services offline this week as a precaution against two critical vulnerabilities collectively dubbed PHP2Shell CVE-2026-109618 and CVE-2026-109619 . Both vulnerabilities carry a critical CVSS v4.0 score of 9.2 and affect every release of PHP from PHP 5.4 through PHP 8.5 . Here is a technical breakdown of what happened, how AI models from OpenAI and Google Gemini accelerated the discovery, what actually breaks inside the Zend Engine, and how to verify and patch your servers right now. Unlike application-level vulnerabilities in a specific WordPress plugin or Composer package, PHP2Shell https://en.wikipedia.org/wiki/PHP2Shell sits directly inside the C-based PHP interpreter itself, specifically in the paths responsible for request memory management and error handling . According to The PHP Foundation's official security retrospective https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ , the underlying Out-of-Memory OOM flaw behind CVE-2026-109618 was first glimpsed in 2024 after an external security audit by Quarkslab funded by the Sovereign Tech Agency through OSTIF. While fixing one of the audit findings, a contracted core developer noticed that hitting PHP's memory limit at a very specific moment could leave internal engine structures in an inconsistent state. "Both issues sit in parts of PHP that nearly every request touches: memory management and error handling. Their central place in PHP is what made both vulnerabilities serious, and also so hard to fix without breaking compatibility, hurting performance, or forcing changes on the large ecosystem of third-party extensions." The PHP Foundation Because no one had demonstrated a concrete Remote Code Execution RCE exploit path in 2024, and because every candidate fix risked breaking backward compatibility or C extensions, work on a patch stalled under the PHP security team's consensus model for nearly two years. What changed in late 2026 was not the underlying C code in PHP. What changed was the arrival of frontier AI models capable of reasoning across deep engine call graphs and synthesizing multi-step memory corruption chains: GPT-5.6 Sol under OpenAI's CVE-2026-109618 and CVE-2026-109619 using AI-driven vulnerability research agents powered by Google Gemini and GPT models, calling the flaws the most severe vulnerabilities ever uncovered by AI. As UNSW Sydney cybersecurity researcher Salil Kanhere told the BBC https://www.bbc.com/news/articles/c3qjnwye0ep5o , the underlying bugs were not new; what changed was our ability to find and weaponize them at machine speed. Following coordinated work between Calif, Wiz, OpenAI, and the PHP Foundation's Ecosystem Security Team in August and September 2026, an embargoed release was scheduled for October 21 at 14:00 UTC. However, the timeline fractured: When a request hits a PHP server, the Zend Engine initializes per-request memory structures, parses incoming request variables, and sets up session and error-handling state. If an attacker crafts a request that triggers an Out-of-Memory OOM condition during a narrow initialization window, PHP invokes zend bailout to abort the request and clean up memory. In unpatched versions of PHP 5.4 through 8.5 , if zend bailout fired before specific internal pointers finished initializing, the shutdown destructor routine still treated those partially initialized structures as valid pointers. By combining CVE-2026-109618 and CVE-2026-109619 , an unauthenticated remote attacker can corrupt engine memory before application authentication checks ever run. According to Sansec Forensics' technical advisory https://sansec.io/research/php2shell , Calif demonstrated unauthenticated code execution against clean installations of: Because the vulnerability lives in the PHP binary php-fpm , mod php , or php-cgi , updating WordPress plugins, Composer dependencies, or application code will not fix PHP2Shell . You must patch the underlying PHP runtime on the host or container. While government advisories from the US NSA, UK NCSC, and Japanese Prime Minister Sanae Takaichi urged organizations to patch immediately or temporarily suspend unpatched sites, forensic researchers at Sansec https://sansec.io/research/php2shell , Tenable https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote , and Bitdefender https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-php2shell-pre-auth-rce/ point out an important nuance: Unlike Log4Shell or Shellshock, where a single static HTTP header could compromise almost any vulnerable server blindly, reliable PHP2Shell exploitation requires target-specific knowledge of the server's memory configuration and application state to hit the exact OOM window. Many noisy proof-of-concept scripts circulating on GitHub right now either fail against default PHP installations or rely on a separate Local File Inclusion LFI bug. However, with AI-assisted offensive tooling rapidly evolving, as tracked by Recorded Future's Insikt Group https://www.recordedfuture.com/blog/php2shell-vulnerability-exploitation and Sophos X-Ops https://www.sophos.com/en-us/security-advisories/sophos-sa-20261021-php2shell , leaving an internet-facing PHP runtime unpatched is an unacceptable risk. The PHP project released official patched versions for all active branches on October 21, 2026: 8.5.12 or later 8.4.27 or later 8.3.36 or later 8.2.35 or later If you are running an End-of-Life EOL version of PHP such as PHP 7.4, 8.0, or 8.1 , PHP.net does not publish official binary releases, and official Docker php:8.1 images will not receive an update. However, Debian, Ubuntu, CloudLinux, and Remi's RPM repository for RHEL, AlmaLinux, and Rocky Linux have backported the source patches into their distro packages while keeping the base version number. Run the following commands on your server to verify whether your PHP package includes the backported fix for CVE-2026-109618 and CVE-2026-109619 : 1. Check your running PHP version php -v 2. On Debian / Ubuntu, verify the CVE patch in the package changelog zgrep CVE-2026-109618 /usr/share/doc/php -common/changelog.Debian.gz 3. On RHEL / AlmaLinux / Rocky Linux, check the RPM changelog rpm -q --changelog php-common | grep CVE-2026-109618 4. Apply updates and restart PHP-FPM / Apache sudo apt update && sudo apt install --only-upgrade 'php ' sudo systemctl restart php8.4-fpm apache2 If you cannot patch immediately, place your site behind an edge WAF such as Cloudflare's emergency PHP2Shell WAF rules https://blog.cloudflare.com/php-vulnerabilities-waf-protection and audit your server logs for abnormal Allowed memory size of ... bytes exhausted spikes paired with unexpected POST payloads. To track ongoing updates, vendor backports, and Indicators of Compromise IoCs , bookmark these primary advisories and technical reports: