AI Found PHP2Shell, and Attackers Tried It Before the Patch
PHP2Shell is the name for two memory-safety bugs, CVE-2026-109618 and CVE-2026-109619, that enable unauthenticated remote code execution and memory disclosure on PHP versions back to 5.4. Wiz Research found them in August with AI assistance, and patches shipped on 21 October for every supported branch. Amazon's honeypot network recorded exploitation attempts four days before disclosure, and researchers saw in-the-wild use within hours of the fix.
On this page
The bugs, and why almost everything is exposed
PHP powers roughly 70 percent of all websites, and PHP2Shell is the name now attached to two memory-safety bugs in the runtime itself: CVE-2026-109618, a use-after-free in the upload-progress unserializer, and CVE-2026-109619, a use-after-free in fatal-error backtrace handling paired with an OPcache type confusion. Both score 9.2 on CVSS and both enable unauthenticated attacks. Wiz Research demonstrated pre-authentication remote code execution on WordPress, Drupal and Joomla, and showed the first bug can also leak process memory, with freed heap contents URL-encoded into a PHPSESSID cookie, exposing passwords, tokens and API keys even when an application never calls session_start.
The scope is what makes this one land differently. Because the flaws sit in memory management and error handling, paths the PHP Foundation says nearly every request touches, exploitation requires no application bug at all: Wiz notes that even a simple Hello World application on an affected runtime is exposed. Nearly every PHP release of the last decade is affected by at least one of the bugs, going back to version 5.4.
How AI shortened a years-long hunt
The history matters as much as the severity. Wiz says an out-of-memory flaw of this family was first found in 2020 and rediscovered in 2024, and both times it went nowhere as a practical attack. This August, Wiz Research working with Gemini 4 Argon, GPT-5.6 Sol and its own Atlas agent turned it into working exploits within days: the first vulnerability was found on 19 August, remote code execution on Drupal was confirmed on 20 August, and WordPress fell the next day. Per the Wiz write-up, one researcher completed in a week what previously took a world-class team months, and OpenAI was a partner in the coordinated disclosure.
The bugs were reported to the PHP security team on 24 August, acknowledged on 21 September, and patched on 21 October in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with minimal backports for the 7.4, 8.0 and 8.1 branches. The disclosure had been set for 22 October but moved up a day after a leak, and SecurityWeek reports an early proof-of-concept video accelerated the development of further PoCs.
Exploitation before the embargo lifted
The uncomfortable part is the timeline. Amazon's MadPot honeypot network recorded the first exploitation attempt on 17 October, four days before public disclosure, from an IP tied to a commercial anonymization network. More attempts followed between 02:00 and 08:00 UTC on 21 October, twelve hours before the embargo lifted at 14:00, with varied payloads and infrastructure that Amazon reads as multiple actors. By the time patches shipped, SecurityWeek says the security firm Hadrian was seeing php2shell exploited in the wild at scale, mostly through the session upload-progress path, and WatchTowr observed first attempts whose success it could not yet confirm.
AWS drew the general lesson plainly: an embargo protects defenders only until someone else finds the same bug, and AI-assisted analysis is making the gap between advisory and working exploit a matter of hours. How the details escaped before disclosure is not yet known, but an actor probing a honeypot under embargo was, in Amazon's words, conducted by a threat actor.
What operators should do
Upgrading PHP is, in both Wiz's and Amazon's words, the only complete remediation; the fixes are in the 21 October releases for every supported branch. If upgrading is not immediate, Amazon suggests assessing a block on multi-part file uploads and hunting for POST requests containing the PHP_SESSION_UPLOAD_PROGRESS string, and both firms recommend investigating logs from 17 October onward rather than from disclosure day.
The lesson for people who run their own stacks, including self-hosted AI tooling on PHP-adjacent infrastructure, is about process rather than this bug. AI systems have collapsed the cost of turning a known-but-theoretical flaw into a working exploit, so the safe window after an advisory is now shorter than the patching SLA most teams run. If a critical runtime bug is under embargo, assume someone is already using it, and patch on the hour the fix lands.