AI Publications

The discovery of two serious security flaws in PHP, one of the world’s most widely used programming languages, highlights a new reality: AI is transforming the speed at which software vulnerabilities can be discovered. And that capability could become both our strongest defense and a powerful weapon for cybercriminals.

1. A Global Cybersecurity Alert

On October 21, 2026, the maintainers of PHP released emergency security updates to address two critical vulnerabilities that could allow attackers to take control of certain web servers without knowing any passwords or having authorized access.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have collectively been named PHP2Shell and received a severity score of 9.2 out of 10.

Their discovery triggered an international response involving cybersecurity researchers, technology companies, infrastructure providers, and government agencies. The reason for such widespread concern is straightforward: PHP is one of the foundational technologies powering the Internet. It is used by millions of websites and applications, ranging from small blogs to e-commerce platforms, public services, and enterprise systems.

According to estimates cited by Wiz Research, PHP is used by approximately 70% of websites. This figure illustrates the importance of the language, not the percentage of websites that are vulnerable or have been compromised.

But one aspect makes this incident particularly relevant to the future of technology: AI played a decisive role in investigating and demonstrating these vulnerabilities. PHP2Shell could represent a turning point in the relationship between AI and cybersecurity.

2. What Is PHP, and Why Is It So Important?

To understand the seriousness of this incident, we first need to understand what PHP is. When we visit a website, we usually think we are interacting directly with a page hosted somewhere on the Internet. In reality, many websites rely on servers that process our requests, query databases, and generate the information displayed on our screens. PHP is one of the programming languages that makes these operations possible.

Imagine visiting an e-commerce website to buy a computer. When you select a product, the application must check its availability, calculate the price, identify your account, and prepare the checkout process.

In an application developed with PHP, many of these operations may be performed on the server using this programming language. Your browser sends a request, the server executes the relevant code, and the result is returned to your screen. PHP is used by well-known platforms such as WordPress, Drupal, Joomla, and MediaWiki, as well as countless enterprise applications.

What makes PHP2Shell particularly concerning is that the problem does not lie within a specific application, but within the PHP engine itself. In other words, the vulnerability affects the underlying technology responsible for executing those applications.

We can compare this to discovering a defect in a car engine. It does not matter whether the manufacturer has designed the bodywork, brakes, or navigation system correctly. If there is a serious defect in an engine shared across different models, every vehicle using that engine could potentially be affected.

Something similar happens with PHP2Shell: an application developed according to sound security practices may still be vulnerable because it relies on an affected version of PHP.

This does not mean that every PHP installation can be exploited in the same way. The actual risk depends on the software version, server configuration, and the technical conditions required for an attack.

3. What Exactly Are the Vulnerabilities?

Both vulnerabilities originate from a fundamental aspect of how computers operate: memory management. When a program runs, it needs to temporarily use part of the computer’s memory to store information and perform operations. That memory must be allocated, used, and released correctly. If a program makes mistakes during this process, security vulnerabilities can emerge.

First vulnerability: Memory corruption

The vulnerability identified as CVE-2026-109618 concerns how PHP handles situations in which a process reaches its permitted memory limit.

To understand this, imagine a restaurant where every waiter has a notebook to record customer orders. When an order arrives, the waiter starts writing it down. But if the notebook runs out of space before the order is complete, the waiter should cancel the operation and properly discard the incomplete information. Now imagine that the waiter leaves an order half-written and the system later treats it as if it were complete. Mistakes could occur when preparing and delivering meals.

Something conceptually similar can happen in PHP. When certain operations exhaust the available memory, the program may interrupt execution while leaving internal data structures only partially initialized. If those structures are subsequently treated as valid, memory errors may occur.

Researchers demonstrated that, under specific conditions, an attacker could deliberately trigger these situations and exploit them to make the server execute unauthorized instructions.

Second vulnerability: Reusing memory that has already been released

The second vulnerability, CVE-2026-109619, is associated with a problem known as use-after-free.

Let’s return to the restaurant example. Imagine that a waiter finishes a shift and hands back the notebook. However, the system still retains a reference indicating that the notebook belongs to that waiter. Later, another employee uses the same notebook to record different information. If the system attempts to retrieve the first waiter’s information using the outdated reference, it may end up reading or interpreting information that no longer belongs to that person.

In programming, this happens when software attempts to use a region of memory that has already been released. In PHP, certain internal references could survive the processing of one request and be accidentally reused during a subsequent request.

Researchers demonstrated that this situation could cause serious errors and, in certain configurations, enable the execution of malicious code.

What does remote code execution actually mean?

Cybersecurity professionals use the term Remote Code Execution (RCE) to describe a situation in which an attacker can make a computer or server execute instructions it should not accept.

Think of an office building. Normally, visitors can enter the reception area, but they need authorization to access restricted sections. An RCE vulnerability would be comparable to discovering that a particular sequence of actions at reception could activate internal building functions without the necessary authorization.

In the case of PHP2Shell, an attacker may be able to exploit the flaw remotely over the Internet, under specific conditions, without authenticating. A successful exploit could allow the attacker to access confidential information, modify files, install malicious software, or use the compromised server as an entry point into other systems.

The extent of the compromise would depend on the permissions assigned to the PHP process and the security controls in place. Executing code through PHP does not automatically mean gaining full administrative control over the entire infrastructure.

4. The Role of AI: From Finding Bugs to Demonstrating Attacks

This is probably the most interesting aspect of the incident. For decades, discovering complex software vulnerabilities has been an activity largely reserved for highly specialized researchers.

Security experts analyzed millions of lines of code, examined how different components interacted, and searched for exceptional conditions capable of producing unexpected behavior. This work could require weeks or months of investigation.

AI is beginning to transform that process. Advanced AI models can help analyze large amounts of source code, identify suspicious patterns, formulate hypotheses about potential flaws, and assist in building tests to determine whether a vulnerability can actually be exploited. PHP2Shell provides a concrete example of this evolution.

A vulnerability whose earliest warning signs date back to 2024

According to the PHP Foundation, a security audit conducted in 2024 had already identified indications of the memory-exhaustion problem. Developers understood that potentially dangerous behavior existed, but they had not demonstrated a concrete path to remote code execution. Fixing the issue was not straightforward either.

PHP is used by countless applications and extensions. Modifying its internal memory-management mechanisms could introduce compatibility issues or create new operational problems. For months, different solutions were considered without reaching a definitive decision.

The PHP Foundation itself acknowledged that the delay reflected organizational problems and insufficient specialized resources.

AI-assisted research changes the situation

In 2026, several research teams began using advanced artificial intelligence tools to examine PHP’s security. The participants included Calif, OpenAI, and Wiz Research.

The PHP Foundation confirmed that, on August 11, Calif reported a remote code execution path related to the problem first identified in 2024. OpenAI independently reported the same underlying technical issue that day. Wiz and OpenAI subsequently contributed additional attack vectors.

OpenAI explained that, as part of its Patch the Planet initiative, Calif used GPT-5.6 Sol to help discover a critical vulnerability. Wiz, meanwhile, used its own AI-assisted research tools.

AI also helped defensive teams validate reports and connect apparently different vulnerabilities that shared a common root cause. However, an important distinction is necessary: the discovery and remediation process resulted from collaboration between human researchers, AI tools, and engineering teams.

This was not a case of an AI system independently discovering and solving the entire problem. Its decisive contribution was accelerating the investigation and helping demonstrate the true severity of flaws that previously had not been conclusively exploited.

5. The Race Against Time: Discovery, Leaks, and Emergency Patches

Once the severity of the vulnerabilities had been demonstrated, a race against time began. Cybersecurity follows a practice known as coordinated vulnerability disclosure.

When researchers discover a serious vulnerability, they normally inform the software maintainers confidentially. The goal is to allow developers to prepare a fix before publishing the technical details. This gives users an opportunity to update their systems before attackers have enough information to exploit the flaw.

In the case of PHP2Shell, the process encountered complications. On October 20, the vulnerability identifiers began circulating publicly, ahead of the originally scheduled disclosure date. The PHP Foundation decided to bring forward the release of the security patches from October 22 to October 21. A technical proof of concept was also disclosed prematurely, while software images incorporating the fixes became available ahead of schedule.

These developments increased the risk that third parties could reconstruct the attacks before all users had an opportunity to update their servers. The corrected PHP versions were ultimately released on October 21.

The response extended well beyond the language’s maintainers. Cloudflare announced that it had deployed protections through its web application firewall before public disclosure, working in coordination with other participants. Cybersecurity agencies began issuing urgent recommendations, while organizations adopted preventive measures to protect their services.

The episode illustrates how response speed has become a critical factor in cybersecurity.

6. Have Real-World Attacks Occurred?

It is important to distinguish between three situations that are often confused.

• First, the existence of a vulnerability. This means a flaw has been identified that could potentially be exploited.

• Second, the demonstration of an attack. This means researchers have successfully reproduced exploitation in a testing environment or against a vulnerable application.

• Third, an actual compromise. This means an attacker has successfully exploited the vulnerability against a real operational system.

In PHP2Shell, the first two situations have been confirmed. Attempts to exploit the vulnerabilities outside research laboratories have also been detected. Amazon Threat Intelligence reported that its detection systems had identified an attempted PHP2Shell-related exploit on October 17, four days before public disclosure.

However, detecting an attempt does not, by itself, demonstrate that a real system was successfully compromised. It would therefore be incorrect to claim that 70% of the Internet has been hacked or that millions of servers have been successfully taken over. The 70% figure reflects PHP’s widespread adoption, not the actual scale of successful attacks.

What has been demonstrated is that the vulnerabilities are serious, exploitation methods exist, and system administrators need to apply security fixes urgently.

7. What Are the Risks for Businesses, Banks, and Government Agencies?

The potential consequences of PHP2Shell extend well beyond a website becoming temporarily unavailable. Consider three scenarios.

An e-commerce platform

An online retailer uses PHP to manage customer accounts, retrieve product information, and communicate with a database. If an attacker succeeds in executing code on the server, they could attempt to access information normally available only to the application. Depending on the system architecture and permissions, this might include customer information, technical credentials, or configuration data.

A financial institution

Imagine a bank operating a corporate portal or internal application built on a vulnerable version of PHP. Even if the portal has no direct access to core banking systems, a compromise could provide an attacker with an initial foothold. From there, the attacker might attempt to obtain credentials, identify connected systems, or move toward more sensitive parts of the infrastructure.

Whether those attempts succeed would depend on network segmentation, identity controls, and internal security measures.

A government agency

A public institution may use PHP applications to manage appointments, online forms, or administrative procedures.

When a critical vulnerability is discovered, security teams must decide whether to keep services running while preparing updates or temporarily disconnect them to reduce exposure. In some cases, a preventive shutdown may be the most prudent option.

The common factor is that a vulnerability in a widely used technology component can quickly become a business continuity, data protection, and operational risk issue.

8. How Can PHP2Shell Be Fixed?

On October 21, the PHP Foundation released security updates for the PHP branches receiving the relevant fixes.

The corrected versions are:

• PHP 8.5 8.5.12

• PHP 8.4 8.4.27

• PHP 8.3 8.3.36

• PHP 8.2 8.2.35

  
  

Organizations should install these versions or later updates containing the same security fixes.

Older installations, particularly PHP 8.1 and earlier, require special attention because they no longer receive official security maintenance from the main PHP project. In these cases, organizations need to migrate to supported versions or verify whether their distribution vendor provides specific security patches.

It is also important to restart PHP processes after updating and review security logs for evidence of possible exploitation attempts. Perimeter security systems can reduce exposure, but they should not be considered a permanent substitute for software updates.

CERT-EU’s recommendation is clear: apply the patches immediately and, where this is not possible, consider temporarily isolating Internet-facing services.

9. The Bigger Question: Is AI Changing the Balance Between Attackers and Defenders?

Beyond its immediate consequences, PHP2Shell raises a much deeper strategic question. What happens when AI enables vulnerabilities to be discovered much faster than organizations can fix them?

Until recently, advanced security research depended heavily on the availability of specialists capable of understanding extraordinarily complex systems. AI does not eliminate that requirement, but it can significantly increase the productivity of those specialists. This has both positive and negative implications.

The opportunity: More proactive cybersecurity

From a defensive perspective, AI can help discover vulnerabilities before malicious actors find them.

Imagine a company relying on millions of lines of code to operate its systems. Traditionally, thoroughly reviewing that software would be an extremely expensive undertaking. Specialized AI agents can assist in examining code, identifying potentially vulnerable components, generating tests, and prioritizing issues that require human attention.

This creates the possibility of moving toward a more preventive approach to security, in which organizations identify and fix problems before they become incidents.

PHP2Shell demonstrates the value of collaboration between AI systems and human researchers.

The risk: Attackers can also use AI

But there is another side to the equation. The same capabilities that allow researchers to identify vulnerabilities could also make cybercriminals more effective.

AI can help reduce the time required to analyze software, study known vulnerabilities, or adapt attack techniques. One of the most concerning consequences is the potential reduction in the time between the public disclosure of a vulnerability and the emergence of exploitation attempts.

Until now, some organizations have had days or weeks to evaluate a security update and deploy it. In an environment of AI-assisted security research, that window could become significantly shorter.

This does not mean that all attacks will become automated or that anyone will be able to compromise complex systems simply by using a language model. Vulnerability exploitation still depends on specific technical conditions and, in many cases, requires specialized expertise. However, the cost and time involved in certain research activities could decline substantially.

A new technological arms race

We may be entering a period in which both defenders and attackers use increasingly powerful tools to discover vulnerabilities. The advantage will not depend exclusively on who has the most capable AI models. It will also depend on who can integrate those tools into effective security processes.

Organizations will need to improve their ability to identify the software they rely on, rapidly assess their exposure, and deploy fixes without compromising operational continuity. Response speed could become both a competitive advantage and a critical element of technological resilience.

10. An Additional Lesson: The Security of Open-Source Software

PHP2Shell also highlights another structural problem. A significant part of the world’s digital infrastructure depends on open-source projects maintained by relatively small communities of developers. PHP is one of those projects.

The PHP Foundation acknowledged that the difficulties in fixing the problem first identified in 2024 were not exclusively technical. They also reflected a shortage of specialized resources and organizational challenges in making complex decisions.

This raises an important question. If millions of businesses, public institutions, and digital services depend on a particular technology, who should finance its maintenance and security?

The responsibility cannot rest solely on volunteer developers. Major technology companies, infrastructure providers, governments, and organizations that depend on these projects all have a direct interest in ensuring their long-term sustainability.

AI may help discover more vulnerabilities, but it may also increase the pressure on the teams responsible for analyzing and fixing them. Finding bugs faster does not solve the problem if there is insufficient capacity to repair them.

11. Conclusion: PHP2Shell Is a Warning About the Future of Cybersecurity

PHP2Shell represents much more than two critical vulnerabilities in a programming language. It illustrates how AI is beginning to transform one of the most complex activities in software engineering: discovering deep security flaws in widely used systems.

A problem whose earliest warning signs had been identified in 2024 could be investigated more thoroughly in 2026 through a combination of human expertise and advanced AI tools.

The result was the demonstration of vulnerabilities capable of enabling remote code execution and an urgent international response to protect affected systems. But the incident also offers several broader lessons:

• The first is that AI can become an extraordinarily powerful tool for improving software security.

• The second is that attackers could exploit those same capabilities, accelerating the emergence of new threats.

• The third is that organizations will need to evolve from security models based primarily on periodic reviews toward much more continuous, automated systems capable of responding rapidly.

• And the fourth is that Internet security also depends on investing in the people and organizations responsible for maintaining its foundational technologies.

  
  

The great paradox of PHP2Shell is that AI can help us discover vulnerabilities before they are exploited, but it may also make the time available to defend ourselves increasingly short.

The real challenge will not simply be developing AI models capable of finding more bugs. It will be ensuring that our ability to fix those bugs and protect our systems advances at the same pace.

Sources and References

1. PHP Foundation (October 21, 2026). Today’s PHP Security Release, and How We’re Strengthening PHP Security.

   https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/

   
   

2. Wiz Research (October 21, 2026). PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet.

   https://www.wiz.io/blog/php2shell-php-rce

   
   

3. OpenAI (October 21, 2026). Patch the Planet: Global Response Coordination as Agents Uncover Critical Vulnerabilities.

   https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/

   
   

4. CERT-EU (October 21, 2026). Critical Vulnerabilities in PHP.

   https://www.cert.europa.eu/publications/security-advisories/2026-018

   
   

5. Amazon Web Services (October 22, 2026). Amazon Threat Intelligence Identifies PHP2Shell Exploitation Prior to Public Disclosure in MadPot.

   https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/

   
   

6. Cloudflare (October 21, 2026). Cloudflare Deploys Protections Against PHP2Shell Vulnerability.

   https://blog.cloudflare.com/php-vulnerabilities-waf-protection/