PHP2Shell: When AI Turned a 20-Year-Old Bug Into an Exploit
By Arash Latifi
In October 2026 PHP patched two critical RCE vulnerabilities (CVE-2026-109618, CVE-2026-109619) after AI-assisted researchers found the exploit path. Practical lessons for anyone running PHP or WordPress.
TL;DR — A harmless out-of-memory crash bug reported in 2024 became a demonstrated remote code execution after AI-assisted researchers connected the dots; PHP 8.5.12/8.4.27/8.3.36/8.2.35 shipped the fix on October 21, 2026. Lesson: don't postpone security updates.
When a researcher using AI tools turned a simple crash into a full RCE within two weeks, the security equation changed. The PHP2Shell story — which IEEE Spectrum called the opening act of "cybersecurity hell" — shows why "it's just a crash, we'll fix it later" no longer holds.
The bugs
The PHP Foundation's official post describes two critical vulnerabilities:
CVE-2026-109618 — RCE via OOM corruption: If a request hits PHP's memory_limit at exactly the wrong moment, PHP can leave partially initialized internal data behind and later treat it as valid, corrupting memory. On Apache with mod_php, an unauthenticated request can trigger this before any application code runs, and full remote code execution was demonstrated with default settings. Confirmed on PHP-FPM through application-level paths too.
CVE-2026-109619 — RCE via stale global state: A fatal error at the wrong point can leave internal state pointing at memory belonging to a previous request; the next request on that worker uses freed memory. Use-after-free and worker crash confirmed, with demonstrated RCE against a real-world Apache+mod_php application.
Both sit in code nearly every request touches — memory management and error handling — and both trace back to a 2024 report that looked like "just a crash."
How it unfolded
Per the PHP Foundation's own account:
- 2024: PHP's first external security audit in years (funded by the Sovereign Tech Agency via OSTIF, performed by Quarkslab). While fixing a reported issue, a core developer found the first signs of the OOM problem; no concrete exploit path existed.
- The security team had several competing fix approaches with real trade-offs (compatibility breaks, new DoS potential, ecosystem-wide extension changes) and the decision stalled for months — the Foundation candidly called it "a structural failure."
- July 30, 2026: PHP entered the Patch the Planet program; security firm Calif began an audit.
- August 11: researcher Ryan A at Calif reported an unconditional RCE with the same OOM root cause; OpenAI independently reported it, then Wiz added more attack vectors.
- October 21: patched releases shipped a day early after the CVE IDs leaked on forums.
| Milestone | Date | What happened | | --- | --- | --- | | Initial OOM report | 2024 | "Just a crash" — deprioritized | | Calif audit (Patch the Planet) | July 30, 2026 | AI-assisted audit begins | | Full RCE reported | August 11, 2026 | Calif + OpenAI + Wiz | | Patched releases | October 21, 2026 | 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 |
Why AI was decisive
Suman Jana (Columbia University) put it plainly in IEEE Spectrum's coverage: exploiting the bug "isn't really rocket science. It's just that it's a lot of very specific reasoning that is painful to do. And AI, I think, has done a very good job at that." The gap between the top 0.1% of exploit experts and everyone else just narrowed.
The PHP Foundation confirms the floodgates: since July 1 it has published 15 CVEs and worked through more than 100 reports that turned out to be invalid, duplicates, or not reproducible. The asymmetry favors attackers — every legacy bug is a potential target for the next generation of models.
Checklist
- [ ] Check your PHP version (
php -v) — it must be at least 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 - [ ] On WordPress or Drupal? Move fast — IEEE Spectrum listed NASA, Wikipedia, and the White House among potentially exposed sites
- [ ] Set a sane
memory_limitand confirm your host actually applied the patch - [ ] Apache+mod_php was the worst-case setup; consider PHP-FPM (after updating)
- [ ] Take Matthew Green's (Johns Hopkins) advice: when your device says "security update available," install it now, not next week
- [ ] Stop treating "just a crash" reports as low priority — the PHP2Shell pattern can repeat in any language
The bigger lesson
Four PHP engineers spent two months on the patch, because fixing must close every attack path without breaking existing behavior — while finding the bug only requires one path. AI amplifies this asymmetry: discovery gets faster and cheaper, patching doesn't. For underfunded open-source projects (and PHP is one of the biggest), that means professional security organization and sustainable funding — exactly what the PHP Foundation started building this year with its Ecosystem Security Team and an AI Security Engineer in Residence.
FAQ
Q: I'm on shared hosting — what do I do?
Open a ticket and ask your host for the exact PHP version and whether it includes 8.5.12/8.4.27/8.3.36/8.2.35+. If the answer is vague, take it seriously — on shared hosting you don't control the update.
Q: Is this a WordPress-only bug?
No. The flaw is in PHP core itself; anything running PHP (WordPress, Drupal, Laravel, even a small script) was exposed.
Q: Was it exploited in the wild?
Per the PHP Foundation, PoCs circulated after the CVE leak, but no functional exploits were identified at release time. That was luck, not a guarantee — the same pattern next time may not be.