PHP2Shell: How AI-Driven Discovery Exposed Critical RCE Flaws in 70% of the Web

Seed story: "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet" (wiz.io) · search original Written from facts verified across 3 report(s) — original explainer, not a copy or translation. Sources at the end.

The discovery of PHP2Shell, a critical remote code execution flaw affecting roughly 70% of the global web, marks a pivotal shift in software security where frontier AI models have enabled the automated identification of deep, legacy memory-safety bugs. With unauthenticated attackers now capable of stealing credentials from major platforms like WordPress and Drupal, developers face an urgent imperative to patch PHP versions dating back to 5.4, as cloud providers have already reported millions of exploitation attempts within days of the vulnerability's disclosure.

The PHP2Shell Vulnerabilities: What Shipped and What Broke

The PHP2Shell campaign centers on two critical flaws, CVE-2026-109618 and CVE-2026-109619, which carry a maximum severity rating of CVSS 9.2. These memory-safety bugs in core PHP allow unauthenticated attackers to bypass standard access controls entirely. The impact is severe, enabling remote code execution or the direct reading of sensitive process memory.

Specifically, the vulnerabilities expose high-value assets within the server environment, including:

Stored passwords
Authentication tokens
API keys

Because these flaws exist in versions dating back to PHP 5.4, the attack surface is vast. The discovery was coordinated by researchers from Wiz, OpenAI, and Calif, who utilized frontier AI models to develop the necessary exploits. This combination of legacy code and advanced tooling created a critical security gap that required immediate attention from the global development community.

The Scale of Impact: Why 70% of the Internet Was at Risk

The sheer scale of this exposure is staggering because PHP underpins the majority of the web. With approximately 70% of websites globally relying on the language, the attack surface is effectively the entire internet. This dominance extends to major content management systems like WordPress, Drupal, and Joomla, as well as high-traffic sites such as Wikipedia’s MediaWiki. When a core component of such a ubiquitous stack fails, the ripple effect is immediate and global.

The severity is compounded by the nature of the exploit. These are not obscure, niche bugs; they are pre-authentication remote code execution flaws. This means attackers do not need valid credentials to compromise a server. They can directly execute arbitrary code or read sensitive process memory, potentially exposing:

Authentication tokens and API keys
User passwords
Critical internal data

For developers, this represents a fundamental shift in threat modeling. The barrier to entry for attackers has dropped to zero, making legacy codebases an immediate liability rather than a manageable risk.

The AI Advantage: Shifting from Manual Audits to Automated Discovery

The discovery of PHP2Shell marks a pivotal shift in cybersecurity, moving beyond traditional manual audits to automated, AI-driven discovery. Researchers from Wiz, OpenAI, and Calif leveraged frontier AI models to identify and exploit legacy code flaws that had persisted undetected for years. This collaboration demonstrated that machine intelligence can systematically uncover complex memory-safety issues that human teams often miss due to the sheer volume of legacy codebases.

For developers, this transition implies a fundamental change in how vulnerabilities are found and addressed. Key aspects of this new paradigm include:

Automated identification of deep-seated flaws in core languages.
Rapid development of exploits to validate theoretical risks.
A reduced reliance on periodic, manual security reviews.

By using AI to navigate complex code structures, these teams were able to pinpoint critical weaknesses in PHP versions dating back to 5.4. This approach suggests that future security workflows will increasingly depend on continuous, automated scanning rather than reactive, human-led audits, forcing organizations to integrate AI tools directly into their development and maintenance pipelines.

Technical Breakdown: Exploiting Legacy Memory Safety

At the core of PHP2Shell lie memory-safety flaws that have persisted since PHP 5.4, specifically tracked as CVE-2026-109618 and CVE-2026-109619. These defects allow unauthenticated attackers to bypass standard security controls entirely, granting them the ability to execute arbitrary remote code or read sensitive process memory. This access exposes critical assets such as passwords, authentication tokens, and API keys directly within production environments.

The technical mechanics are particularly alarming for legacy systems:

Pre-authentication remote code execution against major platforms like WordPress, Drupal, and Joomla.
Direct exposure of in-process secrets without requiring valid user credentials.
Exploitation vectors that remain viable across decades of PHP versions.

For developers, this highlights the critical risk of maintaining outdated runtime versions. Even if application code is secure, the underlying engine’s memory management can still provide a direct path to system compromise, necessitating immediate attention to core dependencies.

Immediate Response: Patching, Monitoring, and Global Advisories

The immediate aftermath of the PHP2Shell disclosure was defined by a race against time. PHP released a critical patch on October 21, 2026, addressing memory-safety flaws present in versions dating back to PHP 5.4. This urgent update was necessary to stop unauthenticated attackers from executing remote code or stealing sensitive data like API keys.

Simultaneously, the global security community mobilized to mitigate the threat:

The US National Security Agency and Europe’s cybersecurity agency issued advisories urging immediate action.
Cloudflare reported observing millions of exploit attempts within days of the announcement.
Researchers from Wiz, OpenAI, and Calif coordinated the disclosure to ensure safe patching.

For developers, this response highlights the new reality of incident management. With AI-driven discovery accelerating the timeline from finding to exploitation, relying on standard patch cycles is no longer sufficient. Teams must now prioritize rapid deployment of security updates and continuous monitoring to protect legacy systems before automated attacks can scale.

Implications for Developers: Securing Legacy Codebases in the AI Era

The discovery of PHP2Shell marks a pivotal shift in software security, moving the threat landscape from manual audits to AI-driven discovery. With vulnerabilities present in PHP versions dating back to 5.4, developers must recognize that legacy codebases are now primary targets for automated exploitation. The fact that researchers used frontier AI models to develop exploits against WordPress, Drupal, and Joomla underscores that traditional security review cycles are no longer sufficient.

To prepare for this new reality, teams should adopt proactive patching strategies and integrate AI-assisted vulnerability scanning into their CI/CD pipelines. Key actions include:

Auditing all PHP dependencies for versions prior to the October 21, 2026, patch.
Implementing automated dependency updates to reduce the window of exposure.
Monitoring for anomalous traffic patterns, as Cloudflare reported millions of exploit attempts within days.

Ultimately, securing legacy systems requires treating AI not just as a development tool, but as a sophisticated adversary that can identify and exploit memory-safety flaws at scale.

FAQ

What is PHP2Shell and how severe is the vulnerability?

PHP2Shell refers to critical memory-safety vulnerabilities in core PHP, tracked as CVE-2026-109618 and CVE-2026-109619, with a maximum CVSS score of 9.2. These flaws allow unauthenticated attackers to execute remote code or read sensitive process memory, including passwords and API keys.

Which PHP versions are affected and when was the patch released?

The vulnerabilities affect PHP versions dating back to 5.4, impacting approximately 70% of websites globally. PHP released a patch to fix these issues on October 21, 2026.

How were these vulnerabilities discovered and what is the current threat level?

Researchers from Wiz, OpenAI, and Calif discovered the flaws using frontier AI models to develop exploits, demonstrating pre-authentication RCE against platforms like WordPress and Drupal. Cloudflare has reported millions of exploitation attempts since the announcement, prompting immediate patching advice from the US NSA and Europe’s cybersecurity agency.