The PHP2Shell Vulnerability Took AI a Week to Find and Ten Weeks to Fix
On October 21 the PHP project shipped fixes for two critical flaws that let an attacker run code on a PHP server, a day early because the CVE IDs had leaked.[1] Wiz Research named the pair PHP2Shell and wrote that AI uncovered them.[2] Coverage took the same line: AI found a hole in the language under most of the web.
That part is true. It is also the least scarce thing in the story. At least three outside teams reported the same root cause, the maintainers were already wading through a pile of AI-era reports, and someone tried the attack before the fix existed. What decided who was exposed had been settled years earlier, in upgrade decisions.
What is PHP2Shell?
PHP2Shell is two remote code execution flaws in the PHP engine, CVE-2026-109618 and CVE-2026-109619, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Wiz says every PHP version released in the last decade is affected by at least one of them, going back to 5.4. If you run PHP, upgrade first.
The PHP Foundation's own word for it is "imperative."[1] Amazon's advice for anyone who cannot patch today is to consider blocking multipart file uploads and to review web server logs for suspicious activity.[3] Everything below is about why the week went the way it did, and none of it changes that order of operations.
Did AI find PHP2Shell?
Yes, several times over. Calif reported the root cause on August 11 during an audit in OpenAI's Patch the Planet program, OpenAI reported the same root cause independently, and Wiz found it on August 19 using Gemini 4 Argon and GPT-5.6 Sol. The finding was real work, and it was not rare.[1]
Earlier still, in 2024, while fixing an audit finding, a Foundation-contracted developer "found the first signs of the OOM problem," the memory bug behind the first CVE.[1] OpenAI added further attack paths on September 18. Wiz says one of its researchers "completed in a week what previously would have taken a world-class team months of work."[2]
That matches the lab. An October study ran 24 model setups against a production codebase and found that "no single configuration covers all observed findings," while 14.3% of 265 confirmed root causes were found by exactly one model.[4] Different finders overlap without matching, so a serious bug in popular code tends to get found by several of them.
How fast does a known bug become an attack?
Minutes, when the bug is in public view. In August, Anil Madhavapeddy, a Cambridge researcher and maintainer of OCaml's web library cohttp, opened a public pull request fixing a path-traversal bug. His own server was being probed for that bug class within about ten minutes, and his agent had built a working exploit in under one.[5]
Within about ten minutes (!) this website was fielding probes for percent-encoded traversal sequences, indicating that automated watchers are keeping an eye on public repositories. If it took me just a minute to create my own exploit locally, then ten minutes actually seems quite long for an automated attack window to start!
He had pointed DeepSeek V4 Pro at the code first, and it "independently turned up several related issues."[5] None of this week's coverage cites his note, and it explains the week better than any of it. Once people know roughly where a bug lives, a model can do the rest of the search.
PHP2Shell ran that experiment at scale. The CVE IDs reached forums on October 20, posted by a PHP user who compiles from source and had been told there was no embargo.[6] No technical details leaked, and the Foundation moved the release forward a day anyway.[1]
Attackers were already there
Amazon had already seen an exploitation attempt in its honeypot data dated October 17.[3] Cloudflare's chief executive, Matthew Prince, reported thousands of attempts across its network in the 10 hours before the announcement and millions afterward.[7] The Foundation's director told Reuters it had no evidence of successful exploitation before disclosure.[8]
How usable the public exploits are is disputed. Elias Taylor argued the circulating demo exploits do "not work against a vanilla PHP instance," and that people are "being deluded by their LLMs telling them they have an exploit when they don't."[9] He still tells readers to patch.
Claims about the bug got cheap as fast as finding it did, and checking them stayed slow.
Where did the time actually go?
Into the queue and the fix. The PHP Foundation says AI-assisted research means its security team "receives far more reports than before." Since July 1 it published 15 CVEs and worked through more than 100 reports that were invalid, duplicates or not reproducible, with a person making every call.[1]
The team doing that is small. Elizabeth Barron, the Foundation's executive director, told Reuters: "We have one full-time staff member (that's me) and 14 mostly part-time contractors."[8] She also said the project now gets nearly twice as many proposed code changes as a year ago, while the number of contributors has not doubled.
The fix itself was the slow part. The flaw sat in a long-standing design decision inside the engine, and the Foundation is plain about what tools can't do: "decide on the right fix for a long-standing design decision in the engine, weigh the compatibility trade-offs, and review the patch."[1]
Ten weeks from first report to release is the cost of that work, done by a handful of people.
Is coordinated disclosure still worth it?
Yes, and the people with the attack data say so. Coordinated disclosure means reporting privately, letting maintainers ship a fix, then publishing. Amazon still calls it the right model. What PHP2Shell changed is how long the silence can be counted on when several parties hold the same bug.
An embargo protects defenders only until someone else finds the same bug.
Madhavapeddy goes further and argues embargoes "no longer buy us time."[5] Either way, the useful window is short, and it was short this time for ordinary reasons: a well-meaning forum post, a deleted video, and patched builds a distributor published six hours early, by the Foundation's account.[1]
What should a team running PHP do now?
Treat the runtime version as a security decision, not a maintenance chore. Fixes shipped only for the four supported branches, while Wiz says vulnerable versions go back a decade.[2] A team on an older branch had nothing to deploy this week, only a migration under pressure.
This is the September argument from the other side. Two firms measured the same AI security patches and got very different pass rates because the definition of done decided whether a patch passed. Here the models did not decide who was exposed. The deploy path did.
None of what follows is new, and all of it is worth more this month:
- Inventory: know every place each PHP version runs, including the forgotten internal tools.
- Supported branches: keep production on a version that still gets security releases.
- Same-day deploys: a runtime patch should ship the day it lands, not next quarter.
- Logs from first attack: search back from October 17, Amazon's earliest date, not from the announcement.
For companies that depend on PHP, the Foundation's numbers point at where help goes furthest. A person who can say "duplicate" or "not reproducible" quickly is worth more to the project than another scanner. Discovery is the part AI now does for attackers and defenders alike, and the code AI writes has not been getting more secure on its own.
Finding a serious bug is now something several teams can do in a week. Getting the fix into every place the code runs is still slow, human work, and that is the part that decides who gets hurt.
References
- ^1.The PHP Foundation, “Today's PHP Security Release, and How We're Strengthening PHP Security” (October 21, 2026)
- ^2.Wiz Research, “PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet” (October 21, 2026)
- ^3.CJ Moses, Amazon Threat Intelligence, “Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot” (October 21, 2026)
- ^4.Curmi and Ganni Galea (arXiv preprint), “How Much Does the Harness Matter, and for Whom? A Multi-Model Study of Context in LLM-Driven Vulnerability Discovery” (October 2026)
- ^5.Anil Madhavapeddy, “Just a rumour of a bug is enough to find a security exploit these days” (August 22, 2026)
- ^
- ^7.The Register, “Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure” (October 22, 2026)
- ^8.Toby Sterling, Reuters (syndicated by KFGO), “PHP Foundation 'under-funded' with one full-time staff member, director says” (October 23, 2026)
- ^
Frequently asked
What is PHP2Shell?›PHP2Shell is the name Wiz Research gave to two critical remote code execution flaws in the PHP engine, CVE-2026-109618 and CVE-2026-109619, fixed on October 21, 2026 in all four supported PHP branches.
Did AI find the PHP2Shell vulnerabilities?›AI-assisted researchers found them, more than once. Calif reported the root cause on August 11 during an audit in OpenAI's Patch the Planet program, OpenAI reported the same root cause independently, and Wiz found it on August 19 with Google and OpenAI models.
What is coordinated vulnerability disclosure?›It is the practice of reporting a flaw privately to the maintainers, giving them time to build and ship a fix, and publishing details only when the fix is available.
Is responsible disclosure still worth it if AI can find the same bug?›Yes. Amazon's threat intelligence team, which saw the early attempt, still calls coordinated disclosure the right model, while noting that an embargo protects defenders only until someone else finds the same bug.
What should I do if I run an unsupported PHP version?›Fixes shipped only for the supported branches, so an older version has no patch to apply.
How do maintainers cope with AI-generated vulnerability reports?›With a small team. The PHP Foundation says AI-assisted research means its security team receives far more reports than before.
Let’s build it together.
We turn clever prototypes into production systems people can rely on. If you’re building with agents and want a hand making it real, leave your email and we’ll be in touch.