AnswersPublished25 sources
PHP2Shell: What the Critical PHP Flaws Mean and How They Were Found
PHP2Shell comprises two critical PHP flaws that can enable remote code execution; both were rated 9.2 under CVSS 4.0 and patched on October 21, 2026. Calif used OpenAI’s GPT 5.6 Sol to find a critical flaw, while Wiz independently reported both vulnerabilities using AI assisted research.
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- PHP2Shell comprises two critical PHP flaws that can enable remote code execution; both were rated 9.2 under CVSS 4.0 and patched on October 21, 2026.
- Calif used OpenAI’s GPT 5.6 Sol to find a critical flaw, while Wiz independently reported both vulnerabilities using AI assisted research.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What does the October 24, 2026 report on the AI-discovered PHP2Shell vulnerabilities reveal about CVE-2026-109618 and CVE-2026-109619, their. Article summary: The available evidence describes PHP2Shell as two critical PHP vulnerabilities enabling remote code execution, with CVSS 4.0 ratings of 9.2, discovered through AI-assisted security research and addressed with emergency p. Topic tags: general, general web, news. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fake numbers
PHP2Shell is the name given to two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. Both received a CVSS 4.0 score of 9.2 and can allow remote code execution, making a PHP server a potential target even without an attacker logging in. PHP released emergency fixes on October 21, 2026. 8
9
10
The incident also drew attention to AI-assisted security research: Calif used OpenAI’s GPT-5.6 Sol to identify a critical flaw, and Wiz independently discovered and reported both vulnerabilities. But reports of scanning or attempted exploitation are not the same as confirmed server compromises. 20
29
34
What the two PHP2Shell flaws can do
The vulnerabilities affect PHP itself, rather than a specific website platform or plugin. One flaw, CVE-2026-109618, involves PHP’s handling of an out-of-memory condition while request data is only partly initialized. CVE-2026-109619 involves stale internal state persisting after the memory behind it has been freed. Both issues can lead to remote code execution. 10
26
The reported CVSS 4.0 score for each flaw is 9.2, a critical rating. The risk is serious because an attacker may be able to run code on an affected server remotely and without authentication. 9
10
How AI-assisted research contributed
Calif identified a critical flaw with OpenAI’s GPT-5.6 Sol as part of the Patch the Planet initiative. Wiz independently discovered and reported both vulnerabilities; reporting says its research used Wiz Atlas alongside Gemini 4 Argon and GPT-5.6 Sol. 20
29
Accounts differ on the precise early timeline: one report says Calif found the flaws on August 1, while another says researchers reported the first flaw to PHP on August 11. Both describe discovery and coordinated work with maintainers before the October disclosure. 20
30
That distinction matters: AI helped researchers identify vulnerabilities, but the available reports do not establish that agentic AI carried out the subsequent attacks.
Emergency patches and disruption
PHP released fixes on October 21 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Those version numbers apply to upstream PHP releases; Linux distributions may backport fixes while keeping different package version numbers, so administrators should check their distribution’s security advisory as well as the version string. 8
27
The disclosure prompted some website operators to take systems offline while assessing risk; reports said government websites in Europe and elsewhere went offline on October 21. 21 A separate account says leaked vulnerability details contributed to PHP moving its planned release forward by a day.
22
33
For organizations running PHP, the practical priority is to confirm that the PHP instance serving web traffic has the vendor’s fix, apply the appropriate update and follow any provider-specific restart or verification instructions. If a hosting provider manages the server, ask it to confirm the patched status rather than relying only on a website’s visible behavior. 8
24
Exploit attempts are not proof of successful attacks
Cloudflare and Patchstack reportedly saw probing activity before PHP’s October 21 patch. A later security report described millions of attack attempts, while the BBC reported no known successful exploits as of October 22. These accounts support caution, but they do not establish that the reported attempts resulted in confirmed compromises. 2
3
34
The evidence therefore supports a measured conclusion: PHP2Shell was severe, drew rapid attacker attention and required urgent patching, but activity counts should not be presented as a count of successful intrusions. The cited reporting does not provide a reliable estimate of how many vulnerable websites were exposed or confirm agentic-AI attacks.
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "PHP2Shell: What the Critical PHP Flaws Mean and How They Were Found"?
PHP2Shell comprises two critical PHP flaws that can enable remote code execution; both were rated 9.2 under CVSS 4.0 and patched on October 21, 2026.
What are the key points to validate first?
PHP2Shell comprises two critical PHP flaws that can enable remote code execution; both were rated 9.2 under CVSS 4.0 and patched on October 21, 2026. Calif used OpenAI’s GPT 5.6 Sol to find a critical flaw, while Wiz independently reported both vulnerabilities using AI assisted research.
Sources
wppoland.comPHP2Shell: is my WordPress site at risk and what to do - WPPoland
expresscomputer.inPHP2Shell: Security vendors race to contain a critical vulnerability as exploitation attempts spread
nivector.comPHP2Shell: the two critical PHP flaws that pushed governments offline
internazionale.itGovernment websites go dark after AI-discovered flaw ...