Security researchers have announced the discovery of two critical vulnerabilities in the PHP programming language engine, which research firm Wiz reports forms the foundation for about 70% of websites worldwide. The two vulnerabilities were identified under the identifiers CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, and received a severity rating of 9.2 on the CVSS v4.0 scale.
Calif.io managed to discover one of the vulnerabilities using OpenAI's GPT-5.6 Sol model, while Wiz independently found both vulnerabilities using the Wiz Atlas tool in collaboration with Google's Gemini 4 Argon model and the GPT-5.6 Sol model. Cloudflare reports also indicated the participation of other security entities such as Quarkslab in uncovering these software flaws, which have existed for over a full decade in various PHP versions.
Security flaws latent for a decade
The root of the problem lies in the mechanism by which the PHP engine handles errors; when a software request crashes or runs out of available memory, the engine may leave behind references to previously freed memory (Use-After-Free). The next request processed by the same worker can treat those references as valid.
Research has proven that attackers can exploit this behavior, along with type-confusion flaws, to access sensitive data or execute malicious code remotely on popular platforms such as WordPress, Drupal, and Joomla without the need for login. Researchers confirmed that some of the affected code dates back to PHP version 5.4, and these flaws remained hidden all those years due to the difficulty of chaining multiple vulnerabilities together to create a successful attack, which was the critical role played by AI in accelerating the discovery process within a few days.
Speed of response and release of fixes
The remediation journey began after Wiz discovered the first vulnerability on August 19 and confirmed its ability to execute code on Drupal and then WordPress in the following days. The PHP security team was officially notified on August 24, and corrective versions were released on October 21 after intensive coordination involving major companies such as Cloudflare, Google Cloud, AWS, Microsoft, and Akamai.
What changes practically for developers and system administrators?
PHP has released secure versions that development teams and system administrators must update their servers to immediately: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. In the case of relying on Linux distributions or managed hosting providers, it is recommended to check with vendors to verify the application of backporting.
In addition, OpenAI has proposed a five-stage proactive framework for dealing with vulnerabilities uncovered by AI, which passes through verification, advanced testing via models, and the gradual distribution of data to distributors and service providers, reaching government agencies and critical infrastructure. The company also provided a tool to scan PHP versions locally to verify the presence of vulnerable copies, with a warning that protection tools such as Web Application Firewalls (WAF) represent a temporary layer of defense and do not in any way replace the actual updating of the code on servers.