PHP2Shell: AI-Driven Discovery of Decade-Old Flaws Forces Global Website Shutdowns

Key points

• PHP released fixes in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026, addressing two critical flaws (CVE-2026-109618 and CVE-2026-109619) with a CVSS score of 9.2.
• The vulnerabilities, known as PHP2Shell, stem from memory-safety issues in how PHP handles fatal errors, allowing attackers to execute code or read sensitive data like passwords without authentication.
• Wiz Research, along with OpenAI and Calif, discovered the flaws in August 2026 using AI models like Gemini 4 Argon and GPT-5.6 Sol, which reduced the time to develop exploits from months to weeks.
• Global entities, including Dutch and Finnish government sites, UK government services, and Wikipedia, temporarily took websites offline as a precaution before patches were deployed.
• PHP 8.1 and older versions remain unsupported, though limited source fixes are available for PHP 7.4, 8.0, and 8.1. Apache servers using mod_php face the highest risk.
• Cloudflare reported millions of exploitation attempts in the days following disclosure, highlighting the rapid pace of AI-enabled attacks.

Background

This incident follows a trend of AI-accelerated vulnerability discovery, as noted in earlier coverage of the WordPress 7.1.2 patch in September 2026. The PHP2Shell flaws are compared to historical turning points like Heartbleed (2014) and Log4Shell (2021), but with the distinction that AI tools made complex, decade-old bugs practically exploitable. Previous archive articles highlighted the growing gap between discovery and exploitation, a theme central to this event.

How outlets are covering it

Wiz Research emphasized the 'AI inflection point,' stating that frontier AI models turned a longstanding flaw into a viable exploit, reducing the effort required from a world-class team to a single researcher. CNN and CBS News focused on the global impact, highlighting government shutdowns and consumer risks, while noting the FBI's advice to take sites offline. Search Engine Journal stressed the urgency of patching, warning that firewalls are not a substitute for updates. All sources agreed on the critical nature of the flaws but differed in emphasis: Wiz highlighted the AI aspect, while news outlets focused on the immediate operational and consumer impact.

Why it matters

The PHP2Shell vulnerabilities affect 70% of the web, including critical infrastructure, e-commerce platforms, and government services. The ability of AI to rapidly develop exploits for complex, long-standing bugs shifts the cybersecurity landscape, compressing the window between discovery and exploitation. This event underscores the need for immediate patching and proactive security measures, as workarounds are insufficient. It also highlights the growing role of AI in both discovering and exploiting vulnerabilities, potentially accelerating future cyber threats.

What to watch

Website owners must immediately update PHP to patched versions (8.5.12, 8.4.27, 8.3.36, or 8.2.35) or take sites offline if patching is not possible. Hosting providers should confirm that their updates include the fixes. For unsupported PHP versions, limited source fixes are available, but upgrading to a supported version is essential. Security teams should monitor for web shells, unfamiliar admin accounts, and unexpected PHP file changes, as patches do not remove existing compromises. The incident may lead to increased scrutiny of AI's role in cybersecurity and faster adoption of AI-driven vulnerability detection tools.