)
Last updated: October 23, 2026
What is PHP2Shell, and why is everyone linking it to AI hacking? PHP2Shell is the name for two critical flaws in the core PHP engine, disclosed on October 21, 2026. They can let an unauthenticated attacker run code on a web server. Researchers used frontier AI models to find the bugs and build working exploits. That makes PHP2Shell a high-profile case of AI-assisted exploitation, even though attacker use of AI is not confirmed.
TL;DR: Key Takeaways
- PHP2Shell covers CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2, in PHP itself rather than in any app (CERT-EU).
- Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, published on October 21, 2026 (PHP Foundation).
- Wiz says the bugs affect versions back to PHP 5.4, and that frontier models made the exploit chain practical (Wiz).
- Amazon saw an exploit attempt on October 17, 4 days before disclosure, but did not attribute it to AI (The Hacker News).
- OpenAI released a free PHP version checker as 2 Codex skills; it reads version data and sends no exploit probes (GitHub).
At a glance: PHP2Shell in numbers
Quick Answer
Is PHP2Shell an example of AI hacking?
Partly. AI was used by defenders: Wiz and Calif used frontier models, including OpenAI's GPT-5.6 Sol, to find the flaws, and Wiz built working exploits. No source confirms that attackers used AI to exploit PHP2Shell. The accurate term is AI-assisted exploitation research, plus a warning that the same capability shortens the time attackers need.
| Item | Detail | Source |
|---|---|---|
| CVE IDs | CVE-2026-109618, CVE-2026-109619 | CERT-EU |
| Severity | CVSS 9.2 each | CERT-EU |
| Fixed versions | 8.5.12, 8.4.27, 8.3.36, 8.2.35 | PHP Foundation |
| Oldest affected branch | PHP 5.4 | Wiz |
| Share of websites on PHP | 70% | Wiz |
| Public disclosure | October 21, 2026 | Wiz |
| AI models named by Wiz | Wiz Atlas, Gemini 4 Argon, GPT-5.6 Sol | Wiz |
| Confirmed attacker AI use | Not reported | All sources reviewed |
)
What the two PHP flaws actually do
Both bugs sit in how PHP handles fatal errors, especially out-of-memory errors, while it processes a request. According to CERT-EU (2026), CVE-2026-109618 corrupts memory when an out-of-memory error interrupts PHP before internal data is fully initialized. CVE-2026-109619 leaves stale global state that a later request on the same worker can reuse.
According to Wiz (2026), exploitation does not depend on application code, so even a simple ""Hello World"" page on an affected version can be vulnerable. Wiz demonstrated pre-authentication remote code execution on WordPress, Drupal and Joomla.
Wiz also showed that attackers can read PHP process memory without full RCE. That memory may hold passwords, tokens, API keys and certificates.
| Bug | What goes wrong | Demonstrated impact |
|---|---|---|
| CVE-2026-109618 | Out-of-memory error leaves partially initialized data | Pre-auth RCE, remote memory disclosure |
| CVE-2026-109619 | Fatal error leaves stale state for the next request | Pre-auth RCE on Drupal and WordPress |
How AI was used: AI-assisted exploitation by defenders
The AI link is strong on the research side. According to OpenAI (2026), Calif identified a critical flaw using GPT-5.6 Sol as part of OpenAI's Patch the Planet initiative. Wiz independently found both vulnerabilities.
The vulnerable code had existed for more than a decade, but turning it into a working exploit required chaining several bugs. Each target needed adjustments for its memory layout. Wiz says frontier models helped it develop and adapt working exploits across multiple applications in hours.
According to Wiz, with frontier models and the right tools, a single researcher finished in a week what would previously have taken a world-class team months.
According to OpenAI (2026), the incident shows how AI can uncover flaws with internet-scale impact, but the same capabilities can help attackers rapidly develop exploits. OpenAI adds that, to its knowledge, frontier AI found these bugs before attackers did.
What we know about attackers and AI so far
We found no source that confirms attackers used AI to exploit PHP2Shell. The term ""agent hijacking"" also does not fit here: nobody reported an AI agent being taken over. The sources do show fast, broad exploitation after the leak.
According to The Hacker News (2026), Amazon's threat intelligence team detected an attempt against its MadPot honeypot on October 17. It came from a commercial anonymization network, and Amazon said it remained unclear how the actor got exploit information. Disclosure was planned for October 22 but moved up a day after the CVE IDs leaked.
According to BBC (2026), Cloudflare CEO Matthew Prince reported thousands of attempts in the 10 hours before the announcement, rising to millions afterward.
Amazon CISO CJ Moses said AI-assisted analysis makes it cheaper to turn a patch diff or advisory into a working exploit. That is a structural claim about the trend, not evidence about a specific PHP2Shell attacker.
Verified context: confirmed AI-driven attacks
Other recent cases do confirm offensive AI use. According to NorForge (2026), more than 20 exposed panels of the Cairn agent framework were likely tied to malicious operations. One cluster ran over 1,100 attack projects, and NorForge estimated an average success rate of about 10%.
According to Mint (2026), India's CERT-In issued a critical advisory on AI agents as attack vectors. It said agentic tools shrank the time from initial access to impact from days to a few hours. PHP2Shell is not yet a confirmed case of this.
What OpenAI's PHP2Shell checker does
OpenAI published a PHP version checker with its disclosure post: a GitHub repository, openai/php2shell-checker, with two Codex skills. Use phpcheck-url when you only have a URL, and phpcheck-server when you have server access.
In URL mode it reads the Server and X-Powered-By headers with a HEAD request. It does not follow redirects, does not inspect response bodies and does not send exploit probes. It returns OK, POTENTIALLY VULNERABLE or UNKNOWN.
OpenAI is explicit about the limits. An OK result only means the advertised version meets an upstream fixed release. Headers cannot show whether a distribution backported the fix, and hidden headers return UNKNOWN. The server skill is the stronger check: it compares the package serving the site with vendor advisories and checks that workers restarted.
| Mode | Input | What it checks | Main limit |
|---|---|---|---|
| phpcheck-url | URL or hostname | Advertised version in HTTP headers | Hidden headers and backports |
| phpcheck-server | Server access | Package serving the site, vendor advisory | Needs shell access |
How to patch, verify and hunt
Patching is the only complete fix, and updating WordPress or plugins does not help. Follow this order:
- Inventory. Find every PHP runtime, including containers and products that embed PHP.
- Patch. Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or apply your vendor's backport.
- Verify. Confirm the running workers use the fixed build, not just the installed package.
- Isolate. If you cannot patch, CERT-EU advises isolating internet-facing apps until a fix is verified.
- Hunt. Look for memory-limit errors after unusual multipart requests, malformed PHPSESSID cookies and PHP processes launching shells.
- Rotate. Treat secrets on unpatched, exposed servers as potentially leaked, given the memory disclosure risk.
How we compared
We read the BBC, Wiz and The Hacker News reports, then the primary disclosures from OpenAI, the PHP Foundation and CERT-EU. We reviewed OpenAI's checker files directly. AI attack context comes from NorForge and CERT-In coverage.
Security and governance: risks of AI-speed exploitation
Wiz and Amazon both describe AI lowering the cost of turning bugs into exploits. For enterprises, that has three consequences.
First, unpatched PHP servers that hold model API keys could leak them through memory disclosure. Second, AI agents used for scanning and remediation need least privilege and logging, as CERT-In recommends for in-house agents. Third, attackers already run autonomous agent frameworks, as the Cairn case shows.
NeuralTrust does not replace patching PHP; it secures the AI layer around it. We recommend starting with the Agent Gateway (TrustGate), which gives you one control point for agent and model traffic and ships 200+ pre-built MCP servers. Agent Runtime Security (TrustGuard) adds runtime protection for agents in production. Agent Posture Management (TrustLens) helps you see the agents you run. AI Red Teaming (TrustTest) tests your AI apps before attackers do. The Runtime Security Mesh deploys in your own infrastructure or on-premises, with managed hosting in the EU or US.
Which should you choose?
| Your situation | First action | Supporting step |
|---|---|---|
| You run PHP on public servers | Patch to a fixed release today | Verify with phpcheck-server |
| You only have a URL to test | Run phpcheck-url | Treat UNKNOWN as unchecked |
| You cannot patch quickly | Isolate the app | Hunt for exploitation signs |
| You run AI apps on exposed hosts | Rotate model API keys | Route model traffic through a gateway |
| You use AI agents for remediation | Apply least privilege and logging | Red team the agents regularly |
Conclusion
PHP2Shell is a turning point because AI helped researchers turn decade-old PHP bugs into working exploits within a week. The sources support calling this AI-assisted exploitation by defenders, with a clear warning that attackers gain the same speed. They do not yet confirm attacker AI use for PHP2Shell. Patch PHP now, verify the running build, rotate exposed secrets and govern the AI agents you deploy, because AI-speed attacks are already real elsewhere.
Secure AI Agents Against AI-Speed Attacks with NeuralTrust
Put policy, runtime protection and red teaming around every AI agent and app you run.
)
Related Comparisons
- Offensive vs Defensive AI Security
- Hugging Face Got AI-Hacked Twice
- Agent Security 101
- Claude Code RCE
FAQs about PHP2Shell
1. What is PHP2Shell?
PHP2Shell is the name researchers gave to a family of memory-safety flaws in core PHP. They are tracked as CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. Under the right conditions, an unauthenticated attacker can execute code on the server or read sensitive process memory. The flaws are in PHP itself, not in WordPress, Drupal or other applications.
2. Which PHP versions fix PHP2Shell?
The PHP project released fixes on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older branches are end of life and receive no official releases. For older branches, use a vendor backport or the PHP team's minimal source backports for 7.4, 8.0 and 8.1, or upgrade.
3. Did hackers use AI to exploit PHP2Shell?
No source we reviewed confirms it. Researchers at Wiz and Calif used frontier AI models to find the bugs, and Wiz used them to build exploits. Amazon detected an early exploit attempt but said it was unclear how the actor obtained the details. Amazon's CISO warned that AI-assisted analysis makes turning patches into exploits cheaper, which is a broader trend.
4. What does OpenAI's PHP2Shell checker do?
It is a pair of Codex skills in the openai/php2shell-checker repository. The URL skill reads the PHP version advertised in HTTP headers. The server skill checks the package serving your site against vendor advisories. It returns OK, POTENTIALLY VULNERABLE or UNKNOWN and sends no exploit probes. An OK result does not verify the installation itself.
5. Does updating WordPress fix PHP2Shell?
No. The vulnerable code is in the PHP runtime, so updating WordPress, plugins or themes does not fix it. You must update PHP itself. If a hosting provider manages your site, ask whether the October 21 PHP security fixes are applied and whether the web workers were restarted after the update.
6. How can I tell if my server was attacked?
Wiz suggests looking for unusual multipart requests followed by memory-limit errors, repeated HTTP 500 responses, malformed PHPSESSID cookies and unexplained worker churn. The FBI, as reported by The Hacker News, advises watching for PHP processes that launch command shells or download files. The UK NCSC also told organizations to check for attacker backdoors.
About the Author
Roger Howroyd is Head of Global SEO and AI at NeuralTrust, where he leads the company's search strategy across SEO, AEO, GEO, and LLM optimization. He specializes in AI-powered search, content strategy, and SEM. Connect on LinkedIn.
NeuralTrust is the leading platform for securing and scaling AI agents. Named a Pioneer in the Gartner Emerging Market Quadrant for AI Application Security 2026, recognized across four Gartner Hype Cycle reports in 2026, and featured in the Gartner Market Guide for Guardian Agents 2026, the Gartner Market Guide for AI Gateways 2025 and the KuppingerCole Leadership Compass for Generative AI Defense 2025. Headquartered in Barcelona with offices in London and New York. ISO 27001 certified.
Sources
- Wiz Research, PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet, October 21, 2026.
- OpenAI, Patch the Planet: global response coordination as agents uncover critical vulnerabilities, October 21, 2026.
- OpenAI, php2shell-checker (GitHub repository), accessed October 23, 2026.
- The PHP Foundation, Today's PHP Security Release, and How We're Strengthening PHP Security, October 21, 2026.
- CERT-EU, Critical Vulnerabilities in PHP (Advisory 2026-018), October 21, 2026.
- BBC News, What is PHP and why did it spark a global cyber-security scramble?, October 22, 2026.
- The Hacker News, Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed, October 22, 2026.
- NorForge, Inside Cairn: Open Windows into massive AI-Driven Cyber Operations, October 19, 2026.
- Mint (PTI), CERT-In issues critical alert after autonomous AI agents access live systems of Indian orgs, October 16, 2026.
)
)
)
)