PHP patches critical AI-discovered PHP2Shell vulnerabilities affecting millions of sites

PHP maintainers have released emergency fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Both are rated 9.2 out of 10 in severity and could allow remote code execution on vulnerable web servers. The flaws affect PHP itself, which powers approximately 70% of websites worldwide, including major platforms like WordPress, Drupal, and Joomla. While not every PHP-powered website is necessarily vulnerable, the potential impact is widespread. The issues involve memory safety problems related to out-of-memory handling and internal state management between requests.

Successful exploitation could allow attackers to execute unauthorized commands, steal sensitive information, compromise applications, or take control of affected servers. Researchers say the vulnerable code dates back more than a decade, with an estimated 1.3 million internet-connected hosts potentially exposed. PHP released patched versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21. Exposure depends on the PHP version and server configuration, including deployments using PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. PHP 8.1 and earlier are no longer officially supported, although some vendors may provide backported fixes.

OpenAI also reported that AI-assisted security research helped identify the vulnerabilities, develop working exploits, and verify patches as part of a coordinated disclosure process. Administrators are advised to identify affected PHP installations, prepare backups and maintenance windows, and apply the official security updates as soon as possible.