PHP2Shell: AI agents found two critical PHP bugs that sat unnoticed for a decade

Two critical bugs in the PHP engine, disclosed on 21 October 2026 and nicknamed PHP2Shell, were found with the help of frontier AI models. The official CVE records credit an AI security firm, an AI lab and an independent researcher alongside the PHP maintainers. For anyone tracking what these systems can actually do, that credit line is the story.

The bugs themselves are serious but ordinary in kind. What is not ordinary is that they sat in widely read open source C code for roughly a decade, and that the thing which finally surfaced them was a set of models pointed at the problem for about a week.

What the two bugs actually are

Both carry a CVSS 4.0 base score of 9.2, rated critical, with the vector AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H. Both allow remote code execution without authentication, and both were published on 21 October 2026.

CVE-2026-109618 is titled "RCE via OOM corruption". PHP uses longjmp() to bail out when it runs out of memory, abandoning the current request. The CVE record states that some contexts do not properly account for that escape and leave request memory in an uninitialized state before performing an allocation. The cleanup that follows then reads or branches on that memory. Multiple out-of-memory strategies can trigger the condition consistently.

CVE-2026-109619 is titled "RCE via stale global state". PHP keeps global state that temporarily points into request memory. In some scenarios that state is not correctly reset, or is repopulated after being reset, so it can still refer to request memory after the memory has been freed. A later request can then read or branch on that stale state before it is fully initialized.

Neither bug lives in an application. Both live in the engine, which is why patching WordPress or Drupal does not help and upgrading PHP does.

Who found them, and what the models did

The CVE records credit Ryan at Calif.io, Wiz and OpenAI, together with PHP maintainers Arnaud Le Blanc, Ilija Tovilo and Jakub Zelenka. Seeing an AI lab named in the credits of a core infrastructure CVE is new.

Wiz has published its own account. It says the first vulnerability was discovered on 19 August 2026 using Wiz Atlas together with Gemini 4 Argon and GPT-5.6 Sol, and singles out Gemini 4 Argon as having made what it calls an invaluable contribution to finding the vulnerability, as well as to exploit development, attack detection and patch validation.

The timeline Wiz gives is tight. Unauthenticated remote code execution was confirmed against Drupal on 20 August and against WordPress on 21 August, one and two days after the initial find. The reports went to the PHP security team on 24 August. PHP acknowledged them and began a coordinated fix on 21 September, and the patched releases went out on 21 October.

Wiz's summary of what changed is the line worth arguing about: that a single researcher completed in a week what previously would have taken a world-class team months of work.

The claim to be careful with

Wiz also says PHP powers 70 percent of all websites and describes 70 percent of the internet as affected. That figure is the company's own and is not independently sourced in its post. It is a vendor describing the reach of a vulnerability it found, which is exactly the kind of number that deserves a second look before it is repeated.

The more defensible version is narrower. Palo Alto Networks said its Cortex Xpanse telemetry identified over 22.6 million exposed instances potentially vulnerable. That is a measurement of one vendor's visible internet rather than a share of the web, and it is still a very large number.

Why this is a capability story, not just a security one

The interesting claim is not that AI wrote an exploit. It is about which part of the work got cheaper.

Finding memory-safety bugs in C is not new, and neither is fuzzing. What Wiz describes is a model chaining a long sequence of conditions into a working exploit, then adapting it across different PHP versions, configurations and memory layouts, which it says made the process practical where it previously was not. That is a claim about reducing the cost of the hardest, most judgment-heavy step, not about automating the easy one.

It also cuts both ways, and the defensive side is real. The same models were used for patch validation, and Gemini 4 Argon is credited with attack detection as well as discovery. The capability is symmetric. What is asymmetric is who moves first.

What happened after disclosure

Details of both vulnerabilities leaked on 20 October, a day before the patches shipped, which removed whatever grace period a coordinated release usually buys.

Amazon has said its MadPot honeypots recorded an exploitation attempt on 17 October, four days before public disclosure. Scanning volume rose quickly once the advisories were public, and several security vendors reported broad scanning with mixed evidence of successful compromise. Arctic Wolf was notably cautious, saying its telemetry did not establish that observed PHP2Shell requests downloaded or executed a payload, and that exploitation would need application-specific conditions beyond the PHP bugs themselves.

One widely circulated claim, that a state-linked group used agentic AI for post-exploitation against a European government, rests on a single vendor's reading of behavioral artifacts rather than a confirmed attribution. Treat it as unverified.

What to do about it

Upgrade PHP. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Configuration changes do not close either hole, because the flaw is in request handling before application code runs. Older branches are affected too, including versions long out of support, so inventory every PHP installation rather than only the ones you think of as production.

If you track AI capability rather than infrastructure, the thing to file is narrower and more durable than the patch note. A decade-old bug class in one of the most widely deployed pieces of software on the internet was surfaced in a week, by a small team using frontier models, and the AI lab behind one of those models is named in the CVE. Our open-weight AI cyber capability gap tracker follows how fast this is moving, and we have looked at how these claims hold up when tested against real CVEs on a benchmark.