PHP rushes emergency patches as AI found php2shell exploit attempts surge

On 21 October 2026 the PHP project released PHP 8.5.12, PHP 8.4.27, PHP 8.3.36 and PHP 8.2.35 to fix two critical unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619. Both carry a CVSS v4.0 score of 9.2. The flaws affect all PHP releases from 5.4 through 8.5.11 and sit in the language runtime, not in a single application or plugin. The PHP Foundation said the bugs can allow an unauthenticated attacker to execute code under the right conditions.

Cloudflare reported on October 21 that PHP is used by almost 70% of websites and underpins WordPress and Magento. That means updating website code or plugins alone does not fix the flaws, because the bugs sit in the PHP runtime. The affected range is broad: every release from PHP 5.4 onward is in scope, while PHP 8.1 and earlier are end of life and will not receive fixes from the PHP project.

Google Cloud reported on October 21 that Wiz Research used a mix of models, with Gemini 4 Argon helping find the bug, develop the exploit and validate the patch. Google Cloud CISO Chris Betz and Raluca Ada Popa, head of Gemini Security at Google DeepMind, said Gemini 4 Argon made an invaluable contribution to finding the vulnerability, exploit development, attack detection and validation of the patch. The PHP Foundation described AI assisted audits by Calif, OpenAI and Wiz that turned a decade old memory bug into a working exploit.

Cloudflare reported on October 21 that it turned on default WAF protection for free and paid plans at 03:02 UTC, about nine hours before public disclosure. By then exploit attempts were already underway, and attackers were mutating payloads to evade rules by tracking match volumes. The result was an emergency patch cycle with millions of attempts, government shutdowns and a race to redeploy PHP across cloud and on premises systems.

Key Facts

Palo Alto Networks Unit 42 reported on October 21 that both CVE-2026-109618 and CVE-2026-109619 are remote code execution vulnerabilities rated 9.2 under CVSS 4.0. CVE-2026-109618 involves handling out of memory errors via longjmp() that leaves request memory uninitialized because of improper control flow management, allowing attackers to use out of memory triggers for reliable RCE. CVE-2026-109619 involves longjmp() fatal error handling that leaves global memory pointing to freed memory regions; later requests can read or branch on those regions and execute arbitrary code.

The PHP Foundation reported on October 21 that in 2024 PHP had its first external security audit in years, funded by the Sovereign Tech Agency and run through OSTIF by Quarkslab. While fixing an issue, a core developer found the first signs of the out of memory problem. In 2026 the Foundation joined OpenAI Patch the Planet programme, and Calif began auditing PHP on 30 July 2026. On 11 August researcher Ryan A at Calif reported unconditional RCE with the same root cause. OpenAI independently reported the same root cause, and Wiz followed on 24 August.

Exposure is large. Palo Alto Networks Unit 42 reported on October 21 that Cortex Xpanse had identified more than 22.6 million exposed instances potentially vulnerable to the two CVEs based on its telemetry. Unit 42 said it had seen proof of concept for the vulnerabilities and that at least one European government had taken its website offline as a precaution. Palo Alto Networks deployed Threat ID 543004 for Advanced Threat Prevention Plus with Frontier Virtual Patching from 10:21 p.m. PT on 20 October 2026, ahead of the public release.

Cloudflare reported on October 21 that Calif.io, Wiz, OpenAI and Quarkslab disclosed the two vulnerabilities, known as php2shell. Cloudflare developed WAF protections from early October 2026, about nine hours ahead of public disclosure, and starting on 21 October at 03:02 UTC customers using free or paid WAF were protected by default. It introduced full transaction detection, which combines request and response signals in the same HTTP transaction and can block a matching origin response before it reaches the requester. Seven Generic Rules for Anomalous Execution shipped for free plans (ruleset 77454fe2d30c4220b5701f6fdfb893ba) and paid plans (ruleset efb7b8c949ac4650a09736fc376e9aee), plus a response phase rule called Default block for High confidence Signatures (afffe22785674c80a31875c848d2242a).

Analysis

The first judgement is about speed. What this really means is that frontier AI models have compressed the distance between a latent memory bug and a working exploit. The PHP Foundation described a decade old memory bug that became a working exploit after AI assisted audits by Calif, OpenAI and Wiz. Google Cloud credited Gemini 4 Argon with finding the vulnerability, developing the exploit, detecting attacks and validating the patch. That is not a marginal productivity gain. It is a change in the economics of vulnerability research, because the same models that help defenders audit code can help attackers find the conditions that make a bug reachable.

The bigger picture here is that the web depends on a runtime that most organisations do not inventory as a separate security layer. Cloudflare reported that PHP is used by almost 70% of websites and underpins WordPress and Magento. A website team can patch a plugin in hours and still leave the interpreter exposed. Unit 42 counted more than 22.6 million exposed instances potentially vulnerable. The affected range from PHP 5.4 through 8.5.11 includes old deployments that may sit behind load balancers, containers, content management systems and managed hosting panels. Patching the application without patching the runtime leaves the core flaw in place.

The vendor response shows both the value and the limits of virtual patching. Cloudflare turned on default WAF protection at 03:02 UTC on 21 October, about nine hours before disclosure, and shipped seven rules for free and paid plans. Palo Alto Networks deployed Threat ID 543004 from 10:21 p.m. PT on 20 October, ahead of the public release. Google Cloud urged customers to move to PHP 8.2 or newer and redeploy, and said Cloud Armor managed rules cover the flaws, with File Upload and RFI categories recommended. Those measures are defense in depth. They are not a substitute for the fixed PHP versions, and Cloudflare itself stressed that customers must still patch.

Coordination also broke down. The PHP Foundation reported that on 20 October around 15:00 UTC the CVE IDs began circulating with a wrong release time and a wrong CVSS of 10.0, so the project moved the release from 22 October 14:00 UTC to 21 October 14:00 UTC. On 21 October at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally published built images containing the fix, breaking the embargo. The leak did not create the underlying bug, but it shortened the window between public knowledge and exploitation. In a case where Cloudflare saw thousands of attempts in the 10 hours before disclosure, tens of thousands within 45 minutes, hundreds of thousands within two hours and millions later, hours matter.

Why It Matters

The operational impact reached beyond ordinary website owners. ABC News reported on October 23 that millions of hacking attempts had been made since the vulnerabilities were discovered, and that governments and major websites rushed to patch. The Australian Signals Directorate was among agencies worldwide issuing urgent patch warnings. Emergency shutdowns of banking, airline, rail, tax and government services from Tokyo to Helsinki marked one of the most dramatic tests of the decades old programming tools that keep the web running. At least one European government took its website offline as a precaution, according to Unit 42.

ABC News reported on October 23 that Cloudflare chief executive Matthew Prince said in a post on X that in the 10 hours before public announcement Cloudflare saw thousands of attempts to exploit the flaw, that the number jumped to tens of thousands in the 45 minutes after announcement, hundreds of thousands within two hours and millions now. Microsoft chief executive Satya Nadella, speaking at an event in Germany, said he had not seen anything like this in a long, long time and called it a long day and night for IT and security staff. Several Asian governments ordered inspections. China industry ministry urged organisations to upgrade to the latest secure PHP version and to change accounts, passwords and keys where necessary. South Korea raised its private sector cybersecurity alert level and activated emergency response measures.

The deeper risk is that AI assisted vulnerability discovery will not stop with PHP. The PHP Foundation said the 2024 audit by Quarkslab, funded by the Sovereign Tech Agency and run through OSTIF, helped surface the first signs of the out of memory problem. The 2026 work with OpenAI Patch the Planet, Calif and Wiz then turned that signal into a coordinated security release. Open source projects with small maintainer teams now face model driven bug hunting from both sides. The same capability that finds a flaw can generate variants, bypasses and exploit payloads. That is why the PHP case matters beyond one language: it is a preview of a maintenance model in which AI finds bugs faster than many projects can triage, fix and ship them.

Next Up

The immediate priority is verification, not just notification. Google Cloud reported on October 21 that vulnerable versions are all PHP releases from 5.4 through 8.5.11 and patched versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP project is not releasing fixes for PHP 8.1 or earlier, which are end of life. Google urged customers to move to PHP 8.2 or newer and redeploy. App Engine standard runtimes on 8.2 and later patch automatically. App Engine flexible and custom container images require redeploys. Cloud Run services without automatic base image updates must be rebuilt. Google also advised creating a rule to stop oversized request bodies that could trigger out of memory conditions.

Defenders should expect continued payload mutation and retrospective review. Cloudflare reported that attackers were already mutating payloads to evade the rules by tracking match volumes, and it called WAF rules defense in depth. Palo Alto Networks said its brief was updated through 21 October as the vendor advisory and guidance changed. The PHP Foundation said it is strengthening PHP security after the release. The next phase will include audits of legacy deployments, checks for PHP 8.1 and older, validation that containers and base images were rebuilt, and monitoring for exploitation attempts that target the runtime before application code runs. The millions of attempts recorded after disclosure show that the window for quiet patching has closed.