Millions of hacking attempts hit servers worldwide this week as organizations scrambled to patch critical flaws in PHP, the scripting language that powers roughly 70 percent of all websites. The emergency updates arrived after researchers found that attackers had already tried to exploit the vulnerabilities days before a fix existed.
AI Turns Decades-Old Flaws Into Working Exploits
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed “php2shell,” are memory-safety failures in the core PHP engine. They allow unauthenticated remote code execution and memory disclosure independent of the application running on top, according to Wiz Research. That means an attacker can take control of a server, steal sensitive data, or deface a website without touching the site’s own code.
The underlying flaws had been present for decades, present in every PHP version released since 5.4 in 2012. Demonstrating their exploitability previously required an exceptionally complex chain of steps at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into a working exploit, Wiz Research reported. The issues stem from key architecture decisions made over a decade ago in the Zend Engine that powers the standard PHP interpreter.
In plain terms, think of it like a master key cut for a lock designed in the 1990s. The lock was always theoretically pickable, but the tools required were too complex for most people to build. AI acted as a master locksmith, designing the tools automatically and putting them in the hands of anyone who asked.
Patches Arrive After Active Exploitation Begins
PHP released emergency patches on October 21, 2026, covering versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Both vulnerabilities carry a CVSS v4.0 severity rating of 9.2. The PHP project’s advisory was blunt: “There are no complete mitigations; updating is the only safe choice.”
Attackers did not wait for the patches. Amazon Threat Intelligence found an exploitation attempt in its MadPot telemetry dating to October 17, four days before the official release. The attempt originated from an IP address associated with a commercial anonymization network. Amazon advised customers to investigate logs from at least October 17 onward. Cloudflare deployed Web Application Firewall rules at 03:02 UTC on October 21, roughly nine hours ahead of the public release.
Coordinated Disclosure Collapses Under Pressure
The standard coordinated disclosure process broke down before the patches landed. According to the PHP Foundation, CVE identifiers began circulating two days early, a researcher mistakenly published a video showing a proof of concept, and Chainguard unilaterally broke the embargo by publishing built container images containing the fix. Chainguard’s published policy, updated a month prior, allows the company to shorten disclosure timelines when a vulnerability is discovered to be under active exploitation.
The consequence was immediate. The PHP Foundation noted that “any attacker could now study the fix in binary form while every other PHP user was still waiting for the release.” Step-by-step exploitation instructions leaked on social media, prompting some operators to take drastic action. On the forum r/selfhosted, a commenter described shutting down all websites by turning off Apache rather than wait five to six hours for the hotfix. The Dutch national cyber security centre and the Dutch House of Representatives also took their own websites offline as a precaution.
Hosting Complexity Creates Blind Spots
Exposure varies significantly by how PHP is served, and many administrators struggled simply to determine if they were vulnerable. Apache mod_php carries confirmed remote code execution for both vulnerabilities, validated over HTTP with default PHP input and memory limits. For PHP-FPM, the session lifecycle case was validated, but the advisory states that no complete FPM exploit has been demonstrated for the out-of-memory bug. FrankenPHP is described as likely susceptible based on source analysis alone.
Commenters on technical forums discovered PHP running in unexpected places: behind OPNsense firewalls, OpenMediaVault network-attached storage, Nextcloud instances, and Coolify platform deployments. One commenter noted that for quite a bit of homelab and embedded equipment, the software supply chain is opaque enough that administrators do not know what underlying language version is running. This diversity of hosting environments—from shared hosting and container orchestration to embedded appliances—complicates the rollout of a single patch.
A Turning Point for Software Supply Chains
The php2shell incident draws immediate comparisons to Heartbleed in 2014 and Log4Shell in 2021. Heartbleed exposed the fragility of shared cryptographic infrastructure. Log4Shell revealed how deeply embedded dependencies create widespread exposure that organizations struggle to identify. Wiz Research believes php2shell marks a similar turning point for the AI era, illustrating how artificial intelligence can change the practical exploitability of longstanding code.
The practical upshot is that the “update immediately” directive is easier said than done for legacy systems. PHP began in 1993 as a set of CGI tools for a personal homepage and grew organically without a formal specification for years. That history left a codebase where memory-safety issues can persist across decades of versions. The cross-industry effort that formed around this disclosure—spanning cloud providers, security firms, and the PHP Foundation—had to protect customers, find variants, deploy detections, and verify patches simultaneously. For the 70 percent of the web running on PHP, the race between patching and exploitation is now a permanent feature of the landscape.
Popular Web Platforms Powering the Ecosystem
Because the core engine vulnerabilities affect the underlying infrastructure rather than individual site code, widespread platforms built on top of the scripting language face immediate exposure. Wiz Research noted that the language serves as a backbone for numerous major web projects across the internet, including Drupal, WordPress, Joomla, and MediaWiki, the software that runs Wikipedia.
The scripting language itself was originally created in 1993 by Danish-Canadian programmer Rasmus Lerdorf. Initially released in 1995 as a set of Common Gateway Interface programs in C for maintaining a personal homepage, it grew organically over decades without a formal specification or standard, evolving into the reference implementation produced today by the PHP Group and powered by the Zend Engine.
Sources
- PHP
- PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog
- PHP Patches Two Critical RCE Flaws That Were Already Under Attack
Photo: The National Archives (UK) (CC BY 3.0)
