On October 21, the PHP project shipped emergency releases for two flaws in the language’s core, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to Laravel Forge’s advisory. Security firm Wiz, one of the groups that found the bugs, rated their severity at 9.2 and said PHP powers about 70 percent of the world’s websites.
The attacks came fast. Cloudflare saw tens of thousands of exploitation attempts within 45 minutes and hundreds of thousands within two hours, chief executive Matthew Prince told Fortune. Amazon Web Services told the magazine the flaw was being broadly exploited.
Most coverage has focused on the fact that AI found the bugs. That matters, but it is not the main lesson. Finding the flaws took weeks. Exploiting them took minutes. Patching them will take months, and for a large share of the web it may never happen.
How AI found a decade-old bug
Calif, an AI security firm working with OpenAI’s “Patch the Planet” program, found the first issue on August 1 using OpenAI’s GPT-5.6 Sol model, Fortune reported. Wiz found it independently on August 19 using research agents built on Google Gemini and OpenAI models. Fortune also reported that a limited version of the problem had been spotted in 2024 and never fully fixed.
Wiz’s write-up explains why PHP2Shell is unusual. The bugs are in PHP itself, not in any one application, so exploitation does not depend on a mistake in the site’s own code. Wiz said every PHP version back to 5.4 is affected by at least one of the flaws, and that even a basic “Hello World” application can be vulnerable. The company said it confirmed remote code execution against WordPress and Drupal before reporting the bugs to PHP on August 24.
Wiz’s view is that the vulnerable code was always there. What AI changed was how quickly someone could understand the weakness and build a working exploit. That cuts both ways. The same capability that let defenders find PHP2Shell will let attackers find the next one.
Wiz announced the research on X:
🚨 BREAKING: @Wiz_io Research uncovers #PHP2SHELL, a decade-old PHP Core vulnerability reaching CVSS 9.2 severity impacting 70% of the Internet. pic.twitter.com/B7yEQuhnoS
— Wiz (@wiz_io) October 21, 2026
The patch gap
Under coordinated disclosure, a vulnerability is fixed in private and then published along with the patch. That model assumes defenders have time to install the patch before attackers can turn the published fix into an exploit. PHP2Shell shows how thin that margin has become. Cloudflare’s numbers describe attacks arriving within the first hour. Palo Alto Networks’ Unit 42 identified 22.6 million potentially vulnerable instances in an initial scan, according to Fortune.
The FBI’s cyber division went further than most agencies would. It encouraged any organization that cannot patch immediately to take its sites offline temporarily, CBS News reported. The PHP Foundation’s advice was simpler: “If you run PHP, it is imperative that you update now.”
Updating is easy if you are on a supported version and control your own server. Many site owners are in neither position. PHP 8.1 and earlier are past end of life and will not receive an official fix, Laravel Forge told its customers. Those sites have two options: move to a supported version, which can break older plugins and themes, or depend on a Linux distribution or hosting company to backport the fix. Forge also warned that its own automatic security updates do not patch PHP, so customers have to update each server themselves.
The sites most likely to be on old, unpatched PHP are also the least likely to have anyone watching security advisories: a small business site built years ago, a club’s WordPress install, a forgotten marketing page. They were never anyone’s priority, and PHP2Shell makes them easy targets.
The case for calm
There is a reasonable argument that the alarm is ahead of the damage. Wiz itself cautioned that differences in PHP versions, configurations and application behavior can break the assumptions its exploit relies on, and that the exploit may need substantial changes for each target. An attempt is not a successful attack. A security researcher told CBS that running a vulnerable site does not mean it has been breached.
The process also mostly worked. AI tools found a decade-old flaw, the finders reported it privately, infrastructure companies such as Cloudflare and Akamai helped with mitigations, and a fix shipped about two months after the first report to PHP. Without the AI-assisted research, attackers might have found the bug first.
Both things can be true. Disclosure worked as designed. But the design assumed slower attackers. When AI can turn a published patch into a working exploit in minutes, the real deadline is the moment the fix goes public. Most of the web’s PHP servers are run by people who did not know that deadline existed.
What site owners should do
If you run a PHP site, check the version your server is actually running, not the one your hosting plan advertises. Anything older than 8.2.35, 8.3.36, 8.4.27 or 8.5.12 needs attention. If you are on 8.1 or older, ask your host directly whether it has backported the fix, and plan the upgrade you have probably been putting off. On managed WordPress hosting, a support ticket asking for written confirmation of the patched PHP version is worth more than any plugin.
Related reading: Hackers reached school employees’ Social Security numbers through a vendor’s vendor; 153 million driver’s licenses leaked from a company that only needed to check your age; A gang hacked the FBI over a four-month-old warning.
