On October 21, the PHP project released four security versions at once: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both scored 9.2 under CVSS v4.0. An unauthenticated remote attacker can exploit them, and the worst outcome is remote code execution. In its advisory, the project says there is no complete temporary mitigation and that upgrading is the only thorough fix.
The flaws were found by cloud security company Wiz, which has named the incident PHP2Shell. During the research, Wiz's team used its own Wiz Atlas platform, along with Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol.
The problem sits in the engine itself
The two CVEs cover four underlying defects: a use-after-free in the upload progress deserializer, a remote read of process memory, a use-after-free in the fatal-error backtrace, and a type confusion in OPcache. The common root lies in how PHP handles fatal errors, especially those caused by memory exhaustion.
When a request terminates abnormally, corrupted data can remain in internal state. If the same worker process then handles the next request, it reuses that stale state, leading to memory leaks or memory corruption. Even without executing any code, an attacker can read passwords, tokens and API keys out of process memory.
The flaws are in the PHP engine, and have nothing to do with how securely the application layer is written. Wiz demonstrated exploitation against the latest container images of WordPress, Drupal and Joomla, and even a page that outputs nothing but Hello World can be hit. The memory leak works even if the application has never called session_start(). The affected range stretches back to PHP 5.4, and every version released over the past decade hits at least one of the problems.
Where AI did the heavy lifting
Wiz's timeline runs as follows: the first flaw was found on August 19 and reported to the PHP security team on August 24; PHP confirmed it and began preparing a coordinated fix on September 21; the disclosure went public on October 21. Nearly two months passed between report and patch, most of it spent on fixing and coordination.
According to Wiz, Argon took part in discovering the flaws, writing exploits, detecting attacks and verifying patches. The large models helped researchers adapt exploit code to different PHP versions, configurations and memory layouts, and when an attempt failed, they analyzed why and iterated. In Wiz's own words:
"Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit."
Wiz says a single researcher finished in one week what once took top teams months. OpenAI also published a post on this coordinated disclosure. Public reports mention that OpenAI additionally released a Codex skill to help websites check whether they are affected, though exactly which scenarios it covers cannot be verified item by item at this point.
Trouble for older sites in China
A large number of small and mid-sized websites, corporate sites and forums in China run on PHP, often in environments installed with one click through a hosting control panel, and it is not unusual for the version to be stuck on 7.x. According to the official release list, this patch covers only four branches, 8.2 through 8.5. The 7.x line reached end of support long ago and cannot get an official fix, and 8.2 itself is maintained only until December 31 this year.
For sites that have not yet upgraded, Wiz lists several signs to check for: an unusual multipart request followed immediately by a memory-limit error, repeated HTTP 500 responses, an abnormally large or malformed PHPSESSID cookie, and PHP worker processes restarting abnormally and often. Cloudflare, Fastly, Google and other vendors have already rolled out protective rules, so sites behind a CDN may be partly shielded, but the official conclusion has not changed: the job is done only once the patch is applied.
Sources: PHP official security advisory, Wiz research blog, CocoLoop, OpenAI security advisory; fixed version numbers, CVE IDs, CVSS v4.0 scores and the affected version range were checked.