PHP2Shell (CVE-2026-109618): How AI Found a Decade-Old Bug in 70% of the Web

Posted on Oct 22 • Originally published at codingcat.dev

Original: https://codingcat.dev/post/php2shell-cve-2026-109618-ai-php-security-scramble

Every single year since 2010, someone on Hacker News or X posts a hot take declaring that PHP is dead. And then, in October 2026, frontier AI models uncovered a decade-old memory corruption flaw in the core PHP runtime engine, and suddenly 70% of the internet had to scramble into emergency patching mode.

As reported by BBC News, government portals, Wikimedia systems supporting Wikipedia, public health boards in Scotland, Edinburgh Council, the Finnish government, and even the Netherlands National Cyber Security Centre (NCSC) temporarily pulled services offline this week as a precaution against two critical vulnerabilities collectively dubbed PHP2Shell ( CVE-2026-109618 and CVE-2026-109619 ).

Both vulnerabilities carry a critical CVSS v4.0 score of 9.2 and affect every release of PHP from PHP 5.4 through PHP 8.5. Here is a technical breakdown of what happened, how AI models from OpenAI and Google Gemini accelerated the discovery, what actually breaks inside the Zend Engine, and how to verify and patch your servers right now.

Unlike application-level vulnerabilities in a specific WordPress plugin or Composer package, PHP2Shell sits directly inside the C-based PHP interpreter itself, specifically in the paths responsible for request memory management and error handling.

According to The PHP Foundation's official security retrospective, the underlying Out-of-Memory (OOM) flaw behind CVE-2026-109618 was first glimpsed in 2024 after an external security audit by Quarkslab funded by the Sovereign Tech Agency through OSTIF. While fixing one of the audit findings, a contracted core developer noticed that hitting PHP's memory limit at a very specific moment could leave internal engine structures in an inconsistent state.

"Both issues sit in parts of PHP that nearly every request touches: memory management and error handling. Their central place in PHP is what made both vulnerabilities serious, and also so hard to fix without breaking compatibility, hurting performance, or forcing changes on the large ecosystem of third-party extensions." (The PHP Foundation)

Because no one had demonstrated a concrete Remote Code Execution (RCE) exploit path in 2024, and because every candidate fix risked breaking backward compatibility or C extensions, work on a patch stalled under the PHP security team's consensus model for nearly two years.

What changed in late 2026 was not the underlying C code in PHP. What changed was the arrival of frontier AI models capable of reasoning across deep engine call graphs and synthesizing multi-step memory corruption chains:

As UNSW Sydney cybersecurity researcher Salil Kanhere told the BBC, the underlying bugs were not new; what changed was our ability to find and weaponize them at machine speed.

Following coordinated work between Calif, Wiz, OpenAI, and the PHP Foundation's Ecosystem Security Team in August and September 2026, an embargoed release was scheduled for October 21 at 14:00 UTC.

When a request hits a PHP server, the Zend Engine initializes per-request memory structures, parses incoming request variables, and sets up session and error-handling state. If an attacker crafts a request that triggers an Out-of-Memory ( OOM ) condition during a narrow initialization window, PHP invokes zend_bailout() to abort the request and clean up memory.

In unpatched versions of PHP (5.4 through 8.5), if zend_bailout() fired before specific internal pointers finished initializing, the shutdown destructor routine still treated those partially initialized structures as valid pointers. By combining CVE-2026-109618 and CVE-2026-109619, an unauthenticated remote attacker can corrupt engine memory before application authentication checks ever run.

According to Sansec Forensics' technical advisory, Calif demonstrated unauthenticated code execution against clean installations of:

Because the vulnerability lives in the PHP binary ( php-fpm, mod_php, or php-cgi ), updating WordPress plugins, Composer dependencies, or application code will not fix PHP2Shell. You must patch the underlying PHP runtime on the host or container.

While government advisories from the US NSA, UK NCSC, and Japanese Prime Minister Sanae Takaichi urged organizations to patch immediately or temporarily suspend unpatched sites, forensic researchers at Sansec, Tenable, and Bitdefender point out an important nuance:

Unlike Log4Shell or Shellshock, where a single static HTTP header could compromise almost any vulnerable server blindly, reliable PHP2Shell exploitation requires target-specific knowledge of the server's memory configuration and application state to hit the exact OOM window. Many noisy proof-of-concept scripts circulating on GitHub right now either fail against default PHP installations or rely on a separate Local File Inclusion (LFI) bug.

However, with AI-assisted offensive tooling rapidly evolving, as tracked by Recorded Future's Insikt Group and Sophos X-Ops, leaving an internet-facing PHP runtime unpatched is an unacceptable risk.

The PHP project released official patched versions for all active branches on October 21, 2026:

If you are running an End-of-Life (EOL) version of PHP (such as PHP 7.4, 8.0, or 8.1), PHP.net does not publish official binary releases, and official Docker php:8.1 images will not receive an update. However, Debian, Ubuntu, CloudLinux, and Remi's RPM repository for RHEL, AlmaLinux, and Rocky Linux have backported the source patches into their distro packages while keeping the base version number.

Run the following commands on your server to verify whether your PHP package includes the backported fix for CVE-2026-109618 and CVE-2026-109619:

# 1. Check your running PHP version php -v # 2. On Debian / Ubuntu, verify the CVE patch in the package changelog zgrep CVE-2026-109618 /usr/share/doc/php * -common /changelog.Debian.gz # 3. On RHEL / AlmaLinux / Rocky Linux, check the RPM changelog rpm -q --changelog php-common | grep CVE-2026-109618 # 4. Apply updates and restart PHP-FPM / Apache sudo apt update && sudo apt install --only-upgrade 'php*' sudo systemctl restart php8.4-fpm apache2 Enter fullscreen mode Exit fullscreen mode If you cannot patch immediately, place your site behind an edge WAF such as Cloudflare's emergency PHP2Shell WAF rules and audit your server logs for abnormal Allowed memory size of... bytes exhausted spikes paired with unexpected POST payloads.

To track ongoing updates, vendor backports, and Indicators of Compromise (IoCs), bookmark these primary advisories and technical reports: