PHP2Shell: AI-found PHP RCE bugs, patch your server today
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical unauthenticated RCE bugs AI models found first. Check your PHP version and host today.
PHP just shipped an emergency fix for two critical remote code execution bugs, and AI models found them before most humans did. The flaws, nicknamed PHP2Shell, let an unauthenticated attacker run code on a vulnerable server. PHP runs WordPress, WooCommerce, Magento, and a large share of the small-business web. If your site has a .php file anywhere in it, this critical PHP vulnerability is your problem today, not next sprint.
What actually happened
The PHP project's October 21 security releases fix two bugs:
- CVE-2026-109618: out-of-memory handling can interrupt PHP while request data is only partly set up, which can lead to remote code execution.
- CVE-2026-109619: state from one request can survive after its memory is freed and be reused by a later request on the same worker.
PHP rated both CVSS v4.0 9.2 and says the risk is highest on mod_php, where an exploit has been demonstrated. The fixed versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The project's own wording: there are no complete mitigations, and updating is the only safe choice. PHP 8.1 and older get no official releases, only minimal source backports.
Fortune reports that red-teaming firm Calif found the first issue on August 1 with OpenAI's GPT-5.6 Sol, and Google-owned Wiz found the bugs independently using Gemini 4 Argon and other tools. OpenAI then led a disclosure coalition with Wiz, Cloudflare, and the PHP maintainers. Fortune also reports that Cloudflare saw early attacks, and that Palo Alto Networks counted about 22.6 million potentially vulnerable instances.
Why the PHP vulnerability matters for your business
AI made this exploit cheap. The same models that found the bug can help attackers weaponize the patch diff. Defenders got two months of quiet coordination. Attackers got the public diff this morning. The gap between disclosure and mass scanning is now hours.
Your host may not patch for you. Managed WordPress hosts usually roll PHP updates fast. A $5 VPS, an old cPanel box, or a Docker image pinned to php:8.2-apache does not update itself. Somebody has to run the upgrade and restart PHP.
Old versions are the real risk. If a plugin locked you to PHP 7.4 or 8.1 years ago, you are now outside the official fix path. That is the moment to pay down the debt, not to wait.
Key takeaways
- Two PHP bugs (CVE-2026-109618, CVE-2026-109619) allow unauthenticated remote code execution
- Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released October 21
- PHP says there are no complete mitigations; mod_php setups carry the most risk
- AI models from OpenAI and Google helped find the bugs, and Cloudflare reports early attacks
- Run
php -von every server, or ask your host for the version and patch date in writing - Sites on PHP 8.1 or older need an upgrade plan now
Not sure what PHP your sites run? We inventory every server, container, and side site, then patch and harden them, or move them to a stack that updates on schedule. Ask us to check your PHP exposure, or see how we maintain production systems.
Sources: PHP security releases, October 21, 2026, Fortune.
- #security
- #php
- #wordpress
- #woocommerce
- #patching
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
Stripe Atlas in MCP: an AI agent can start your company filing
Stripe Atlas now works through the Stripe MCP server, so an AI agent can prep a Delaware LLC or C corp application. Signing, payment, and choices stay with you.
Read itOpenAI 12-hour prompt caching: 2.5x writes, do the math
OpenAI's Responses API adds 12-hour prompt caching for agents. Cache writes cost 2.5x input, reads 0.1x. Here's the break-even math before you flip the TTL.
Read it