AI Finds PHP Flaw: PHP2Shell Hits 70% of Sites [2026]

Two AI models just found the kind of bug that security researchers spend entire careers hoping to never see: a flaw quiet enough to hide for over a decade, and severe enough to hand an attacker a shell on roughly 70% of the websites on the internet. The vulnerability, now tracked under the informal name PHP2Shell, forced the PHP project into an emergency release cycle on October 21, 2026, and triggered what The Information described as a global race to patch before attackers could weaponize the disclosure.

The story is notable less for the bug itself, PHP has had critical flaws before, and more for how it was found. According to OpenAI’s own account of the episode, two separate security research efforts, run by a firm called Calif and by Google-owned Wiz, used large language models to comb through PHP’s source code and surfaced the same class of bug independently, weeks apart. Neither team set out looking for a PHP bug specifically. Both found one anyway, and both say AI did the heavy lifting.

Google · Preferred Sources

Don't miss new tech stories on Google

Add TrendinTech once in the Google app and our stories appear in your news suggestions.

Add Now

What Is PHP2Shell: Breaking Down the Two CVEs

PHP2Shell is not one vulnerability but two, patched together because they share a root cause in how PHP’s engine manages memory and global state during request handling. The PHP project tracks them as CVE-2026-109618 and CVE-2026-109619, and both carry a CVSS v4.0 severity score of 9.2, within a point of the maximum possible rating. Attackers do not need valid credentials, a logged-in session, or any form of prior access to exploit either one. That is what makes unauthenticated remote code execution the most frightening phrase in this story: a hostile request, properly crafted, can run arbitrary code on the server that receives it.

CVE-2026-109618: RCE via out-of-memory corruption

The first bug exploits a corruption condition that surfaces when PHP runs out of memory mid-request. Under specific conditions, the out-of-memory handler leaves internal state in a bad configuration that an attacker can steer toward code execution rather than a clean crash.

CVE-2026-109619: RCE via stale global state

The second bug involves global state that should be scoped to a single request but, under the right circumstances, persists and gets reused by a later request on the same worker process. That stale data becomes an attacker’s foothold.

Beyond code execution, the PHP project and researchers who analyzed the flaws say exploitation can let an attacker read process memory, which on a typical production server means database passwords, API keys, and session tokens sitting in plaintext in RAM. From there, an attacker can disrupt the service outright or quietly exfiltrate customer data, all without leaving the kind of failed-login trail that security teams are trained to watch for.

How OpenAI’s GPT-5.6 Sol and Calif Found the First Flaw

The first thread back to this bug runs through a security research firm called Calif and OpenAI’s GPT-5.6 Sol model. Reuters reported that Calif’s researchers reported the first flaw to the PHP project on August 11, 2026, after finding it using GPT-5.6 Sol during a source-code audit. That audit was reportedly carried out under OpenAI’s Patch the Planet initiative, a program the company has positioned as a coordinated effort to point frontier models at widely used open-source infrastructure before criminals get there first.

GPT-5.6 Sol is part of the GPT-5.6 family, alongside Terra and Luna, which OpenAI released on July 9, 2026, and has since repriced twice, first in late July and again with a promotional discount in August. It is not OpenAI’s current flagship model, that distinction now belongs to GPT-6, which rolled out broadly across ChatGPT’s consumer and enterprise tiers starting October 7, 2026. But Sol remains available through ChatGPT Work, Codex, and the API, and it was Sol, not GPT-6, that OpenAI credits with the PHP audit work. That distinction matters for anyone trying to map which specific model is doing security research right now versus which one OpenAI is marketing hardest to consumers.

OpenAI’s own telling of the episode frames it as validation that AI-assisted auditing has moved from research curiosity to production tool. The company’s write-up credits PHP’s maintainers with leading the actual remediation work, while Wiz, Cloudflare, and other partners contributed research support and coordination once the scope of the problem became clear.

Wiz’s Independent Discovery: Google, Gemini 4 Argon, and a Second Bug

Thirteen days after Calif’s report, on August 24, 2026, Wiz reported a second, related flaw to PHP maintainers, arriving at a similar class of bug through a separate investigation that reportedly combined its own Wiz Atlas tooling with outside models including Gemini 4 Argon and GPT-5.6 Sol. Wiz has operated as a Google Cloud company since Google completed its roughly $32 billion acquisition on March 11, 2026, while continuing to run its security platform under its own brand and serving customers across Amazon Web Services, Microsoft Azure, and Oracle Cloud in addition to Google’s own infrastructure.

The Gemini 4 Argon detail is its own small subplot. Google’s newest frontier model first went to a restricted group of what the company calls trusted cyber defenders on October 1, 2026, through a program named Fairwind, specifically built to let vetted security teams use the model to find and fix vulnerabilities before wider release. Argon then opened to developers, enterprises, and eligible subscribers on October 13, 2026, with introductory API pricing of $2 per million input tokens and $10 per million output tokens running through the end of November, after which the price rises to $4 and $20. The UK’s AI Security Institute had already flagged dual-use risks tied to Argon’s security capabilities before its public launch, a tension that this very episode now illustrates in both directions: the same model class that can find a bug responsibly can, in less careful hands, find one to exploit.

Whether Argon was decisive in Wiz’s specific find, as opposed to a supporting tool alongside Wiz’s own systems and GPT-5.6 Sol, is not something either company has spelled out in granular detail. What both companies agree on is the broader point: two independent teams, using overlapping but not identical AI toolchains, converged on the same vulnerable code path within about two weeks of each other, without coordinating in advance.

Why 70% of the Web Running PHP Matters

The 70% figure attached to this story, repeated across outlets covering the disclosure, describes PHP’s estimated footprint across the web’s server-side code, not a confirmed count of vulnerable or compromised machines. PHP itself makes no such claim in its own release notes. The number is a media estimate of PHP’s overall market share, and it persists because it is roughly consistent with longstanding web technology surveys that have tracked PHP’s dominance in server-side scripting for years.

WordPress is the biggest reason that number holds up. WordPress runs on PHP by definition, and the platform’s own October 6, 2026 security release, version 7.1.3, is a reminder of how entangled AI-assisted discovery has already become with the broader PHP ecosystem: that release fixed a stored cross-site scripting bug reported by Trail of Bits working with OpenAI, plus a denial-of-service issue reported by Anthropic. PHP2Shell is a language-level bug, not a WordPress-specific one, but any WordPress install, and by extension a meaningful share of the sites on the internet, inherits the risk until the underlying PHP runtime itself is patched.

That inheritance problem is exactly why Verizon’s latest Data Breach Investigations Report findings are relevant here even though the report predates this specific bug. Verizon found that exploitation of vulnerabilities grew by 34% in 2025 and accounted for 20% of breaches that year, and that only about 54% of perimeter-device vulnerabilities were fully remediated, with a median remediation time of 32 days. If that pattern holds for PHP2Shell, a meaningful share of exposed servers will still be running unpatched PHP a month from now, regardless of how fast the fix shipped.

The Emergency PHP Releases: What Actually Shipped

PHP’s maintainers shipped fixes across four actively supported branches on October 21, 2026: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Each release note states plainly that updating is the only complete fix, and the project is urging every PHP user across every supported branch to update immediately rather than waiting for a routine maintenance window.

Branch	Patched version	Status before patch	Project guidance
PHP 8.5	8.5.12	Current stable line	Update immediately
PHP 8.4	8.4.27	Actively supported	Update immediately
PHP 8.3	8.3.36	Actively supported	Update immediately
PHP 8.2	8.2.35	Actively supported	Update immediately
PHP 8.1 and earlier	No official patch	No longer receives updates from the PHP project	Upgrade to a supported branch, or contact an LTS vendor for a backport

A rare backport for end-of-life branches

Given how severe the bugs are, PHP’s security team made an exception to its usual policy and provided minimal source-level backports for PHP 7.4, PHP 8.0, and PHP 8.1, three branches that had already reached end of life and normally would not receive any further security attention. That is an unusual move for a volunteer-run open-source project, and it signals how seriously the maintainers are treating a flaw researchers say reaches back to roughly PHP 5.4, a version first released well over a decade ago. PHP 8.6 remains in its own separate release-candidate cycle, with the same fixes folded into RC4, and a final release candidate planned for November 5, 2026, ahead of a stable launch.

The Global Race to Patch: NSA Guidance and Government Sites

The United States National Security Agency weighed in with direct guidance once the scope became clear, telling organizations running PHP to apply the fixes immediately or, if that was not immediately possible, to take the affected systems offline rather than leave them exposed. That is a stark binary for operators to hear from a national security agency: patch now, or disconnect.

Reuters, reporting through its Internazionale syndication partner, said the scramble did knock some government websites offline during the response window, though the report did not detail which countries or exactly how long those outages lasted. That detail reflects something security teams have learned the hard way in past incidents: patching at this scale is not instantaneous, and for organizations running PHP in configurations that cannot tolerate a mid-business-day restart, taking a system temporarily offline can be the more defensible choice than leaving a 9.2-severity, unauthenticated code-execution bug exposed to the open internet.

Researchers close to the discovery were blunt about how they rank this one. CNN reported that the researchers who found the bugs described them as “the most severe vulnerabilities ever discovered by AI, if not in all of software history,” a framing that has circulated widely since the disclosure. It is worth treating that as the researchers’ own characterization rather than an independently verified ranking, but even as characterization, it tells you how this specific team, with visibility into years of prior AI-assisted bug hunting, is choosing to talk about what they found.

OpenAI’s Patch the Planet vs Google’s Fairwind: Two Companies, One Pitch

Strip away the branding and OpenAI and Google are making nearly identical bets through different vehicles. OpenAI’s Patch the Planet initiative, which it credits with surfacing the first PHP2Shell flaw through Calif’s audit, is explicitly framed as a program to turn frontier models loose on critical open-source infrastructure, with PHP maintainers, Wiz, and Cloudflare named as contributors to the coordinated response once the bug surfaced. Google’s Fairwind Program, which gave trusted cyber defenders early access to Gemini 4 Argon specifically to find and fix vulnerabilities before general release, is pursuing the same outcome from the model side rather than the audit side.

Both companies have an obvious incentive to be the one whose model finds the next headline-grabbing bug first. A credible claim to “our AI found a critical flaw in widely used software” is now valuable marketing in a market where enterprise buyers are being asked to trust AI systems with increasingly sensitive access. That incentive cuts in the industry’s favor this time, since both efforts converged on responsible disclosure rather than a race to publish first. Whether that holds the next time two AI-assisted security teams stumble onto the same bug independently is a genuinely open question, and one the PHP2Shell episode does not fully answer.

Historical Context: AI-Discovered Bugs Are Becoming the Norm, Not the Exception

PHP2Shell is not the first time an AI-assisted audit has surfaced a vulnerability with this kind of blast radius, and the pace of similar disclosures through 2026 suggests it will not be the last. Wiz’s own published research history includes RediShell, a 13-year-old critical flaw in Redis with a maximum CVSS score of 10.0 that the company said impacted more than 75% of cloud environments, a strikingly similar shape to PHP2Shell: an old, deeply trusted piece of infrastructure, sitting quietly vulnerable for over a decade before AI-assisted tooling finally surfaced the problem.

Earlier in 2026, researchers disclosed an Ivanti Connect Secure zero-day that let attackers chain three separate bugs together to reach root access, and a separate flaw in Danfoss industrial control software that reportedly sat exposed for 63 days before attackers exploited it in a French hack. Both cases shared a theme with PHP2Shell: the gap between disclosure and full remediation, not the initial discovery, is where the real risk tends to concentrate. A separate incident involving a flaw nicknamed Plex2Shell showed how quickly attackers pivot once a patch exists but adoption lags, with roughly 36,000 servers still unpatched and actively targeted weeks after a fix shipped. Security teams increasingly lean on structured CVE patch pipelines tied to CISA’s Known Exploited Vulnerabilities catalog specifically to close that gap faster than manual triage allows.

Date	Event
June 2026	OpenAI reportedly launches the Patch the Planet initiative
August 11, 2026	Calif reports the first flaw to PHP maintainers after finding it with GPT-5.6 Sol
August 24, 2026	Wiz independently reports a second, related flaw found using AI models
October 6, 2026	WordPress 7.1.3 ships security fixes credited to Trail of Bits, OpenAI, and Anthropic
October 21, 2026	PHP ships emergency patches across four branches; NSA issues update guidance
November 5, 2026 (planned)	Final PHP 8.6 release candidate expected, carrying the same fixes

Market Impact: What This Means for Hosting, WordPress, and Enterprise IT

For the shared hosting industry, which runs the bulk of the world’s smaller PHP-based sites, this is the kind of disclosure that forces an uncomfortable choice between automatic patching and customer disruption. Most consumer-grade hosts can push PHP updates to customer accounts without asking permission, and the ones that can will likely do so within days. The exposure that lingers longest sits with self-managed servers, legacy enterprise deployments running PHP 8.1 or older without a paid long-term support contract, and small businesses running a PHP application nobody at the company has touched in years.

For OpenAI and Google specifically, the commercial upside is straightforward even if neither company is likely to say so directly: every credible story about an AI model finding a critical flaw before criminals do is a data point enterprise security buyers will cite when deciding whether to trust these same vendors with deeper access to their codebases. Developers surveyed by Stack Overflow already reported that 76% were using or planning to use AI tools in their development process, up from 70% the prior year, and 62% said they were currently using AI tools day to day, compared with 44% a year earlier. A high-profile security win like PHP2Shell gives that adoption curve another reason to keep climbing, specifically in the security and code-audit niche where trust has historically lagged behind general coding assistance.

The flip side is liability exposure for everyone who runs PHP in production and does not patch promptly. With a 9.2 severity score and unauthenticated exploitation, PHP2Shell sits in the small category of bugs that regulators and cyber-insurance underwriters tend to treat as a “should have known” risk once a patch exists and enough time has passed. Verizon’s finding that perimeter-device vulnerabilities take a median of 32 days to fully remediate suggests a long tail of exposed PHP installations will persist well into November and December, even with an emergency patch available on day one.

What the Data Says About Patch Speed and Developer Trust

Verizon’s 2025 Data Breach Investigations Report findings quantify the pressure now sitting on every PHP operator. Exploitation of vulnerabilities grew by 34% in 2025 and accounted for 20% of all breaches that year, a sharp enough rise that incident responders had already flagged vulnerability exploitation as a growth category before PHP2Shell surfaced. The same research found that only about 54% of perimeter-device vulnerabilities were fully remediated, with a median remediation time of 32 days, a baseline that gives a rough sense of how long a meaningful share of the internet’s PHP footprint is likely to stay exposed after today’s disclosure.

On the adoption side, Stack Overflow’s developer survey data shows 76% of developers using or planning to use AI tools in their workflow, with 62% already doing so day to day and 43% saying they felt good about the accuracy of AI output, against 31% who remained skeptical. That skepticism gap matters here specifically: a story like PHP2Shell, where AI-assisted audits found a real, severe, previously unknown bug in one of the internet’s most trusted runtimes, is precisely the kind of evidence that tends to move skeptical developers toward trusting these tools with higher-stakes work.

Five Predictions for What Happens Next

Expect similar AI-driven audits to target other decades-old, universally trusted runtimes next, Python, Perl, and older Java application servers are the most obvious candidates given their own long histories and broad install bases.
Enterprise security teams will push harder for automated patch pipelines tied to vulnerability databases, aiming to shrink the 32-day median remediation window Verizon documented before the next PHP2Shell-scale disclosure lands.
OpenAI and Google will keep publicizing AI-found vulnerabilities as proof points in their enterprise security pitches, turning what used to be a quiet researcher credit into a marketing moment.
Smaller hosting providers and plugin developers will face a wave of scanning activity from both defenders and attackers probing for unpatched PHP installs, echoing the pattern seen after the Plex2Shell disclosure.
Expect renewed scrutiny of end-of-life software policies industry-wide, after PHP’s maintainers broke their own support rules to backport fixes to PHP 7.4, 8.0, and 8.1 given the severity involved.

How to Protect Your Site Right Now

If you manage a server running PHP, the immediate action is unambiguous: update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 depending on which branch you run, and do it today rather than waiting for a scheduled maintenance window. If your environment runs PHP 8.1 or an older version with no LTS vendor contract, treat the minimal source backports for PHP 7.4, 8.0, and 8.1 as a stopgap only, and prioritize moving to a supported branch as soon as possible. WordPress site owners should also confirm they are running at least version 7.1.3 released on October 6, since that update closed separate AI-flagged issues that, while less severe than PHP2Shell, add to the same attack surface.

If an immediate update genuinely is not possible, the National Security Agency’s guidance stands: take the affected system offline rather than leave an unauthenticated, 9.2-severity remote code execution bug exposed. That advice sounds extreme until you consider what The Hacker News and other outlets tracking vulnerability disclosures through 2026 have documented repeatedly: the window between a public patch and the first wave of exploitation attempts keeps shrinking, and attackers increasingly automate their scanning the moment a CVE identifier goes public.

Frequently Asked Questions

What is PHP2Shell?
PHP2Shell is the informal name researchers gave to two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both carrying a CVSS v4.0 score of 9.2. Together they allow unauthenticated remote code execution on affected PHP servers.

Which PHP versions are affected?
Researchers say the underlying bug class reaches back to roughly PHP 5.4. Official emergency patches cover the four actively supported branches, PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, with minimal source backports also provided for the end-of-life PHP 7.4, 8.0, and 8.1 branches given the severity.

Did AI actually discover this bug, or just assist?
According to OpenAI and reporting from Reuters, security firm Calif used OpenAI’s GPT-5.6 Sol model during a source-code audit to find the first flaw, while Wiz, owned by Google, independently found a related second flaw using a combination of its own tooling and outside AI models including Gemini 4 Argon. Both teams credit AI with directly surfacing the bugs rather than simply assisting human researchers who had already spotted them.

Is the claim that 70% of websites are affected accurate?
That figure describes PHP’s broad estimated footprint across the web’s server-side code, repeated widely in coverage of the disclosure, rather than a confirmed count of compromised or currently vulnerable servers. PHP’s own release notes do not cite that statistic.

Is my WordPress site at risk?
Any WordPress installation runs on PHP, so it inherits the underlying risk until the server’s PHP runtime itself is updated to a patched version. WordPress’s own October 6, 2026 security release, version 7.1.3, addressed separate, less severe issues and does not substitute for patching PHP itself.

What should I do if I cannot update PHP immediately?
The National Security Agency’s guidance is to take the affected system offline until it can be updated, rather than leave an unauthenticated, critical-severity remote code execution flaw exposed to the public internet.

Were any websites actually compromised?
The scale of actual compromise has not been independently established in current reporting. Reuters reported that the patching response itself temporarily affected some government websites, without detailing which ones or for how long.

What is OpenAI’s Patch the Planet initiative?
It is a program OpenAI has used to point its models at widely used open-source infrastructure to find critical vulnerabilities proactively. The company credits the initiative with surfacing the first PHP2Shell flaw through Calif’s audit using GPT-5.6 Sol, with PHP maintainers, Wiz, and Cloudflare contributing to the coordinated response.

AI Finds PHP Flaw: PHP2Shell Hits 70% of Websites [2026]