Two serious security flaws in PHP, the language behind roughly 70 percent of websites by researchers' estimate, were disclosed on October 21 along with patches. Dubbed PHP2Shell, the vulnerabilities sat undetected for at least a decade and were uncovered with the help of AI models. Site owners are being urged to update immediately.
What the Flaws Are
Wiz Research tracked two issues, CVE-2026-109618 and CVE-2026-109619. Both sit in PHP's core engine rather than in any single application, and the most severe carries a CVSS score of up to 9.2. They can allow an unauthenticated attacker to run code remotely on a server or read sensitive memory, which could expose passwords, tokens, API keys and certificates. According to Wiz, every PHP version released in the last decade, going back to PHP 5.4, is affected by at least one of them. Wiz showed the problem against the latest WordPress, Drupal and Joomla container images.
How AI Found Them
The Wiz team used several AI tools, including OpenAI and Google models, to help with discovery, testing and patch validation. The company says a single researcher completed in a week work that would once have taken a team months. The bug was found before attackers worked out how to exploit it, but experts warn the gap is shrinking. Andrés Guerrero-Saade of SentinelOne said AI is speeding up both researchers and bad actors, and called the shortened window between detection and exploitation the crux of the problem.
Timeline
Wiz found the first flaw on August 19 and reported it to PHP on August 24. PHP acknowledged the reports on September 21 and began work on a fix. Patches and public disclosure followed on October 21, with help from the PHP security team, Calif, OpenAI, and vendors including Cloudflare, Google, AWS and Microsoft, which prepared mitigations.
Who Is Affected
Any site or platform running PHP can be exposed, including government sites and large platforms. A vulnerable site is not automatically breached. For everyday users, the risk is mainly to data held with a vulnerable online store or booking platform, such as names, email and physical addresses, and birth dates. Visiting a PHP site does not by itself compromise your device.
What to Do Now
Applying the PHP security update is the only complete fix. Check the PHP security archive on php.net for the patched release for your branch, and confirm with your hosting provider that it has updated. Where patching must wait, use WAF protections from your vendor. Watch for repeated HTTP 500 errors, unusual multipart requests followed by memory-limit errors, oversized or malformed session cookies, and unexplained PHP worker restarts. The FBI's cyber division has advised organizations that cannot patch right away to consider temporarily taking sites offline. Users should carry on as normal but stay alert to suspicious emails and messages.