AnswersPublished24 sources
What happened during the October 2026 PHP2Shell security crisis, including the AI-assisted discovery of CVE-2026-109618 and CVE-2026-109619 by Calif and Wiz using GPT-5.6 Sol, Atlas and Gemini 4 Argon; the flaws’ unauthenticated remote-code-execution risk, 9.2 CVSS scores, roughl
PHP2Shell prompted emergency PHP security releases on October 21, 2026, after early disclosure disrupted the planned October 22 release; the two flaws could allow unauthenticated remote code execution. [6][13] The available evidence supports an urgent patching crisis, but does not establish that it PHP2Shell prompte...
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- PHP2Shell prompted emergency PHP security releases on October 21, 2026, after early disclosure disrupted the planned October 22 release; the two flaws could allow unauthenticated remote code execution. [6][13] The available evidence supports an urgent patching crisis, but does not establish that it
- PHP2Shell prompted emergency PHP security releases on October 21, 2026, after early disclosure disrupted the planned October 22 release; the two flaws could allow unauthenticated remote code execution. [6][13] The available evidence supports an urgent patching crisis, but does no
- ## Discovery and technical risk
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What happened during the October 2026 PHP2Shell security crisis, including the AI assisted discovery of CVE 2026 109618 and CVE 2026 109619. Article summary: PHP2Shell prompted emergency PHP security releases on October 21, 2026, after early disclosure disrupted the planned October 22 release; the two flaws could allow unauthenticated remote code execution.. Topic tags: general web, openai, prompt engineering, ai, code. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fake numb
PHP2Shell prompted emergency PHP security releases on October 21, 2026, after early disclosure disrupted the planned October 22 release; the two flaws could allow unauthenticated remote code execution. 6
13 The available evidence supports an urgent patching crisis, but does not establish that it caused widespread successful breaches.
Discovery and technical risk
- AI-assisted discovery: Reports describe Calif discovering the flaws in August through OpenAI’s “Patch the Planet” initiative, with Wiz independently finding them; secondary accounts name GPT-5.6 Sol and Gemini 4 Argon.
4
5
6 Insufficient evidence in the supplied excerpts establishes Atlas’s precise role or which system discovered each flaw.
- The vulnerabilities: CVE-2026-109618 concerns out-of-memory corruption, while CVE-2026-109619 concerns stale global state; both can lead to remote code execution.
15 Sansec’s advisory rates both CVSS v4.0 9.2.
14
- Affected versions: Coverage identifies PHP 5.4–8.5, although Wiz’s database describes the scope more broadly as “PHP 5 onward.”
3
7 That supports a long-standing problem, but the excerpts do not independently establish the exact roughly 14-year history.
- Emergency fixes: PHP announced fixed releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35, urging immediate upgrades for installations serving web requests.
Timeline and response
- October 20–21: The vulnerabilities became public on October 20, and patches followed October 21 rather than the originally scheduled October 22.
- Government and provider guidance: The NSA advised inventorying PHP-dependent services and prioritizing vendor patches; CISA urged immediate patching, while Google, AWS and Microsoft published customer guidance.
1
8 The evidence supports a broad response, but not a complete country-by-country account.
- Service disruption: The earlier Wikipedia result reports websites temporarily going offline to apply fixes.
- October 23 follow-on warning: PHP warned about an unlikely RCE path associated with unusual session settings, identified by Sonatype as CVE-2026-115560, and recommended
session.upload_progress.enabled=0until the next regular bugfix release.9
16 PHP’s guidance says applications that never change the serialization handler at runtime can keep the feature enabled.
Exposure and exploitation: important distinctions
- Exposure estimates: TechTarget reported PHP underpinning an estimated 70% of the web and Palo Alto Networks identifying more than 22.6 million exposed instances potentially vulnerable to PHP2Shell.
- Pre-disclosure activity: Infosecurity Magazine reported an exploitation attempt four days before disclosure.
- Mass exploitation: Sansec revised its assessment on October 22, saying mass exploitation was less likely than it had expected on release day.
Claims that remain unverified
- Insufficient evidence establishes the PHP Foundation’s exact “structural failure” statement, the resource constraints behind its handling of a warning identified in 2024, or the full remediation history.
- Insufficient evidence establishes OpenAI’s PHP version checker or the claimed $1 billion Daybreak subsidy pledge.
- The evidence supports AI-assisted discovery, but not a measured conclusion about whether AI benefited attackers more than defenders.
- Concurrent incidents: An education-hosted news summary describes Imperva’s “Node2Shell” demonstration, in which crafted Brotli data executed attacker-supplied code on an official Node.js 24.22.0 Linux arm64 image.
2 A separate incident roundup reports compromised eMudhra certificate-authority keys and includes LiteLLM in its coverage, but the supplied excerpts do not provide enough detail to reconstruct the LiteLLM incident or verify the eMudhra scope.
10
The clearest supported operational message was to inventory PHP deployments and urgently apply the relevant fixes—not to assume that every exposed instance had already been breached. 1
6
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "What happened during the October 2026 PHP2Shell security crisis, including the AI-assisted discovery of CVE-2026-109618 and CVE-2026-109619 by Calif and Wiz using GPT-5.6 Sol, Atlas and Gemini 4 Argon; the flaws’ unauthenticated remote-code-execution risk, 9.2 CVSS scores, roughl"?
PHP2Shell prompted emergency PHP security releases on October 21, 2026, after early disclosure disrupted the planned October 22 release; the two flaws could allow unauthenticated remote code execution. [6][13] The available evidence supports an urgent patching crisis, but does not establish that it
What are the key points to validate first?
PHP2Shell prompted emergency PHP security releases on October 21, 2026, after early disclosure disrupted the planned October 22 release; the two flaws could allow unauthenticated remote code execution. [6][13] The available evidence supports an urgent patching crisis, but does not establish that it PHP2Shell prompted emergency PHP security releases on October 21, 2026, after early disclosure disrupted the planned October 22 release; the two flaws could allow unauthenticated remote code execution. [6][13] The available evidence supports an urgent patching crisis, but does no
What should I do next in practice?
## Discovery and technical risk
Sources
cynet.comPHP2Shell Vulnerability Update (CVE-2026-109618 & CVE-2026-109619)