{"slug": "the-bug-that-sat-in-php-for-a-decade-until-ai-cracked-it-in-weeks", "title": "The Bug That Sat in PHP for a Decade, Until AI Cracked It in Weeks", "summary": "Researchers using frontier AI models turned two decade-old PHP vulnerabilities, dubbed PHP2Shell and rated CVSS 9.2, into working unauthenticated remote code execution exploits within weeks, prompting emergency patching on October 21 and forcing government and media sites offline. Wiz said \"a single researcher completed in a week what previously would have taken a world-class team months of work,\" while Amazon reported hackers attempting exploitation four days before public disclosure. One flaw also leaks worker memory, including passwords and API keys, via a PHPSESSID cookie, drawing Heartbleed comparisons.", "body_md": "On Wednesday, Finland took its government websites offline. The Dutch parliament went dark. Edinburgh council's site disappeared. Parts of Wikipedia stopped loading. Even a few BBC programme pages went down.\n\nThe reason: two bugs in PHP, the language that quietly runs most of the web. The vulnerable code had been sitting there for more than a decade. Then AI-assisted researchers turned it into working exploits within weeks, and everything kicked off.\n\nThis is the story of PHP2Shell, and I think it's the most interesting security story of the year, because the good guys and the bad guys are about to use the exact same trick.\n\nPHP powers roughly 70% of websites, according to [Wiz's estimate](https://www.wiz.io/blog/php2shell-php-rce). WordPress, Drupal, Joomla, MediaWiki (the software behind Wikipedia) and a mountain of shared hosting and control panels all sit on top of it. If you run WordPress or WooCommerce, which is the stack I build on, your server runs PHP.\n\nOn October 21, the PHP team patched two critical vulnerabilities, [CVE-2026-109618 and CVE-2026-109619](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching), both rated CVSS 9.2. Researchers named them PHP2Shell, which tells you the punchline: unauthenticated remote code execution. An attacker doesn't need a login, and they don't need a bug in your code. The bugs are in PHP itself, so [even a \"Hello World\" app on a vulnerable version can be exposed](https://www.php2shell.com/).\n\nThe technical idea is elegant in a nasty way. When PHP hits a fatal error, like running out of memory mid-request, it can leave corrupted internal state behind. The worker process survives, and the next request handled by that same worker can inherit the stale state. Chain it right and you get [use-after-free primitives that turn into full code execution](https://www.wiz.io/blog/php2shell-php-rce), demonstrated on default WordPress, Drupal and Joomla installs.\n\nOne of the bugs is worse in a quieter way. It lets an attacker read the PHP worker's memory remotely, including passwords, tokens and API keys from other people's requests, and the stolen data comes back inside a `PHPSESSID` cookie. Wiz compared it to Heartbleed, and the comparison is fair. No login, no code execution needed. Ask nicely and the server hands you its secrets.\n\n*Image: [Wiz Research](https://www.wiz.io/blog/php2shell-php-rce)*\n\nThe vulnerable code survived more than a decade of humans reading it. There's a reason for that, and it isn't that nobody cared. According to [Tom's Hardware](https://www.tomshardware.com/tech-industry/cyber-security/openai-says-gpt-5-6-sol-helped-uncover-critical-php-flaws-that-could-affect-70-percent-of-websites-ai-assisted-researchers-turned-two-year-old-bug-that-stumped-human-developers-into-working-exploits-in-two-weeks), the PHP Foundation had known something was wrong with the underlying code since 2024, but couldn't identify an exploitation method or a fix. The chain was too complex to demonstrate: too many steps, too much fiddly memory layout work.\n\nThen two teams, working independently, pointed frontier AI models at it.\n\nWiz's claim stuck with me: \"a single researcher completed in a week what previously would have taken a world-class team months of work.\" The bugs weren't new. What changed is that exploiting them stopped being impractical.\n\nThe plan was a calm, coordinated disclosure. Patches and technical details were scheduled for October 22, with defenders briefed in advance. That's not what happened.\n\nOn October 20, [details of the flaws leaked on social media](https://www.bbc.com/news/articles/cmly0lg3w5x2o), and the release was pulled forward a day. Separately, and more worrying: [Amazon said it identified hackers attempting to exploit the bug four days before public disclosure](https://arstechnica.com/security/2026/10/hackers-got-a-four-day-head-start-on-epic-php2shell-vulnerability/), and described the flaws as \"now being broadly exploited in the wild.\"\n\nTwo honesty notes here. First, those are exploitation attempts reported by Amazon via the Financial Times and Ars Technica; CISA said it [had not observed exploitation as of its October 21 advisory](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching), and I've seen no confirmed breach attributed to these bugs yet. Attempts are not the same as a successful compromise. Second, the \"AI found it first\" claim needs care. It's [OpenAI's account](https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities), and it covers discovery: the private window was real, about two months from the August discoveries to the October patch. But the public window was essentially zero. Amazon says exploitation attempts were already happening four days before disclosure, so by the time the world knew, attackers were already moving.\n\nEither way, Wednesday looked dramatic. The [NSA, CISA and FBI](https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/) warned organizations to patch immediately or take systems offline, with the NSA saying the vulnerabilities \"often provide a direct path to the server's file system or database.\" The UK's NCSC, CERT-EU, and agencies in Australia and Japan issued similar advice. Japan's Prime Minister personally posted on X urging people to check whether their sites run PHP, [per the BBC](https://www.bbc.com/news/articles/cmly0lg3w5x2o). When a head of government is doing patch comms, it's a real one.\n\nIt would be easy to read this as an AI triumph story. It isn't, quite.\n\nOn OpenAI's account, defenders got there first on discovery. OpenAI calls that lead time a [\"Defender's Window\"](https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities) and used it to coordinate a genuinely impressive response: WAF rules ready at Cloudflare, AWS, Akamai and Fastly before public disclosure, government agencies engaged, and $1 billion committed in subsidized security tooling for under-resourced defenders.\n\nBut Wiz is blunt about the flip side: [\"With AI this is no longer a barrier. LLMs can help adapt an exploit to different PHP versions, configurations and memory layouts.\"](https://www.wiz.io/blog/php2shell-php-rce) The same capability that let Calif and Wiz build these exploits is the capability that makes the bugs dangerous now. For a decade, these flaws were protected by the sheer difficulty of exploiting them. That protection just expired, for defenders and attackers alike.\n\nAlso, one caveat on scale: the \"70%\" figure is Wiz's estimate of PHP's share of websites, and the [BBC noted it couldn't verify it](https://www.bbc.com/news/articles/cmly0lg3w5x2o). Usage share also isn't the same as exploitable share, and nobody has published a solid count of how many servers are still unpatched. Even so, the vulnerable footprint is enormous by any measure.\n\nIf you run anything PHP, and if you self-host WordPress or WooCommerce that's you:\n\n`PHPSESSID` cookies, and unexplained PHP worker restarts.\nWiz framed PHP2Shell as a Heartbleed or Log4Shell moment for the AI era, and I think that's right, but for a different reason than most coverage says. Those bugs taught us the internet runs on shared infrastructure nobody audits. This one teaches us that \"too hard to exploit\" was never a security property. It was a labour cost, and AI just made that labour cheap.\n\nOpenAI says it [expects similar findings to increase sharply in the coming months](https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities). I believe them. The open question is who finds the next one first, and how wide the Defender's Window stays when both sides have the same models.\n\nWhat do you think: does the window hold, or was this the widest it will ever be? And if you run PHP anywhere, how painful was your Wednesday?\n\n*Sources: [Wiz Research](https://www.wiz.io/blog/php2shell-php-rce), [OpenAI](https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities), [php2shell.com](https://www.php2shell.com/), [CISA](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching), [NSA](https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/), [BBC](https://www.bbc.com/news/articles/cmly0lg3w5x2o), [Ars Technica / FT](https://arstechnica.com/security/2026/10/hackers-got-a-four-day-head-start-on-epic-php2shell-vulnerability/), [TechCrunch](https://techcrunch.com/2026/10/21/php-armageddon-openai-googles-wiz-find-ancient-holes-panicking-the-internet/), [Tom's Hardware](https://www.tomshardware.com/tech-industry/cyber-security/openai-says-gpt-5-6-sol-helped-uncover-critical-php-flaws-that-could-affect-70-percent-of-websites-ai-assisted-researchers-turned-two-year-old-bug-that-stumped-human-developers-into-working-exploits-in-two-weeks), [AWS Security Blog](https://aws.amazon.com/blogs/security/using-aws-waf-to-apply-mitigations-for-php2shell-rce-vulnerabilities-cve-2026-109618-and-cve-2026-109619/). Wiz's announcement post: [https://infosec.exchange/@wiz/117479149813368302](https://infosec.exchange/@wiz/117479149813368302)*", "url": "https://wpnews.pro/news/the-bug-that-sat-in-php-for-a-decade-until-ai-cracked-it-in-weeks", "canonical_source": "https://dev.to/ashthecoder_000005/the-bug-that-sat-in-php-for-a-decade-until-ai-cracked-it-in-weeks-3dn5", "published_at": "2026-10-23 08:35:56+00:00", "updated_at": "2026-10-23 08:41:17.084351+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence", "ai-research"], "entities": ["PHP", "Wiz", "PHP Foundation", "Amazon", "WordPress", "Drupal", "Joomla", "MediaWiki"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/the-bug-that-sat-in-php-for-a-decade-until-ai-cracked-it-in-weeks", "markdown": "https://wpnews.pro/news/the-bug-that-sat-in-php-for-a-decade-until-ai-cracked-it-in-weeks.md", "text": "https://wpnews.pro/news/the-bug-that-sat-in-php-for-a-decade-until-ai-cracked-it-in-weeks.txt", "jsonld": "https://wpnews.pro/news/the-bug-that-sat-in-php-for-a-decade-until-ai-cracked-it-in-weeks.jsonld"}}