PHP2Shell: The Major PHP Vulnerability Uncovered by AI
On October 21, 2026, cybersecurity marked a historic turning point. Wiz Research and the PHP development team publicly disclosed a critical set of vulnerabilities dubbed PHP2Shell. Identified under CVE-2026-109618 and CVE-2026-109619, these flaws carry a near-maximum severity score of 9.2. They allow remote attackers to execute arbitrary code without any authentication.
The potential reach of this threat is massive: up to 70% of websites worldwide could be affected, covering every version of PHP released over the past decade (dating back to PHP 5.4).
A Critical Flaw Hidden for 14 Years
According to statements by Greg Brockman (OpenAI), the vulnerable code had been lying dormant inside PHP core for 14 years. Although a limited variant was noticed in 2024 during an audit by Quarkslab, it was not deemed critical at the time, leaving the root cause unpatched.
This revelation highlights how foundational open-source components powering the web can harbor high-risk vulnerabilities undiscovered for over a decade.
In La Minute IA by Syrine on Express FM on October 26, 2026, Wassim Ben Larbi and Syrine discussed this news as part of their daily segment. Following the on-air broadcast, MEDIANET provides further details on the topic.
Artificial Intelligence at the Core of the Discovery
The true paradigm shift in the PHP2Shell case lies in the heavy involvement of generative AI models. Wiz Research leveraged cutting-edge systems—specifically Gemini 4 Argon and GPT-5.6 Sol—under OpenAI's Patch the Planet initiative.
Unprecedented Acceleration: A single security researcher using AI accomplished in one week what typically takes months for a top-tier team of specialists.
Human-AI Synergy: Researchers at Calif and Wiz used AI to form hypotheses and rapidly iterate validations. While AI did not work entirely on its own, it acted as a massive force multiplier.
Timeline of Events: From August to the October Leak
August 14, 2026: Calif submits a Proof of Concept (PoC) to the PHP security team, who confirm the vulnerability the following day.
August 19–20, 2026: Wiz discovers the initial flaw and confirms Remote Code Execution (RCE) on Drupal, followed shortly by WordPress.
October 14, 2026: The domain php2shell.com is registered by an anonymous third party a week prior to public disclosure.
October 21, 2026: A leak on Hacker News prompts the PHP team to accelerate the official release of security patches.
Emergency Patches and Active Exploitation
Immediate action is required from system administrators and site maintainers. The secure versions to deploy immediately are:
PHP 8.2.35
PHP 8.3.36
PHP 8.4.27
PHP 8.5.12
Reports from Cloudflare and watchTowr's honeypots confirm that active exploitation attempts began prior to the official patch release. Consequently, several public institutions, including government portals in Canada, took services offline as a precautionary measure.
Why PHP2Shell Is a Defining Moment for Cybersecurity
Wiz compares the impact of PHP2Shell to landmark vulnerabilities like Heartbleed (2014) and Log4Shell (2021). Ami Luttwak, co-founder of Wiz, noted that this is likely the most severe vulnerability ever discovered with the assistance of AI.
However, this breakthrough exposes a double-edged sword. Cybercriminals now have access to identical AI tools, allowing them to reverse-engineer security patches in minutes and automate scanning for unpatched servers worldwide.
