In October 2026, two flaws in PHP2Shell itself put most of the web on notice. AI tools found them in days, attackers moved within hours, and governments took websites offline. Here is what actually happened, how the fix works, what it tells us about where AI now stands, and what Indian businesses should do this week.
Cover — PHP2Shell explained
Most security incidents are about one product. PHP2Shell was about the ground that a large share of the web stands on. PHP is the server-side language behind WordPress, Drupal, Joomla, Magento, Laravel applications and a long tail of custom portals, and W3Techs puts it at roughly seven in ten websites whose server language is known.
On 21 October 2026, the PHP project shipped emergency releases for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which together allow an unauthenticated attacker to run code on the server. The bugs were not in a plugin or a framework. They were in the PHP engine, which meant even a "Hello World" page on an affected version could be at risk.
The other reason this incident matters is how the flaws were found. Researchers used frontier AI models to discover the bugs and turn them into working exploits in days. That is a turning point for everyone who runs software, and it is the part most coverage has either exaggerated or skipped.
[AUTHOR INSERT — replace before publishing] Two or three sentences on what our team actually did during the PHP2Shell week: how many client environments we checked, what we found (for example forgotten PHP 7.x servers or unpatched hosting panels) and how long patching took. Real, anonymised detail only. This is the first-hand experience the post needs.
A note before you read on: this post is current as of 11 November 2026. Advisories are still being updated, so check your vendor's guidance and the PHP security page before acting.
What PHP2Shell Is, in Plain Terms
PHP2Shell is the name Wiz Research gave to a set of memory-safety bugs in how PHP handles a request that runs out of memory. Wiz reported four bugs, grouped under two CVEs, each scored 9.2 (critical) under CVSS 4.0.
To understand them, you need one detail about how PHP serves websites. A PHP server keeps a pool of worker processes. Each worker handles one request, cleans up, and then handles the next. That cleanup step is supposed to leave nothing behind.
The flaw was in what happens when a request hits PHP's memory limit. PHP's error handling would jump out of whatever it was doing at that instant. If it was halfway through building an internal structure, such as decoding session data or caching compiled code, some of that half-built state survived. The next request on the same worker could then use memory that no longer belonged to anything, or that an attacker had deliberately filled.
How PHP2Shell works and how the fix closes it
Two kinds of bug came out of this:
Stale pointers into freed memory (use-after-free). After an out-of-memory error, references to freed memory were left in place, for example in the session handling used during file-upload progress tracking and in the record of the last fatal error.
A memory leak to the attacker. One path let a later request read freed memory back out, returned inside a session cookie. That gives an attacker a map of the server's memory layout, which is usually the hardest part of exploiting a memory bug.
Combined, a leak plus a use-after-free gives remote code execution without logging in. Wiz demonstrated it against WordPress, Drupal and Joomla. The setups named as affected include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. In other words, almost every way PHP serves web traffic.
Wiz said every PHP release of the last decade carries at least one of the bugs, and the affected range runs back to PHP 5.4 from 2012.
How AI Found It
Two teams arrived at these flaws independently in August 2026.
Wiz Research used its own tool, Wiz Atlas, together with Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol. By Wiz's account, the first bug was found on 19 August, unauthenticated code execution on Drupal was confirmed the next day, and on WordPress the day after.
Ryan Austin of the security firm Calif found one of the flaws during an audit of PHP's source code under OpenAI's Patch the Planet programme, using GPT-5.6 Sol.
The models did more than point at suspicious code. Wiz says they helped adapt exploits to different PHP versions, configurations and memory layouts, analyse why attempts failed, and later validate the patch. Wiz's summary is that a single researcher finished in about a week what would once have taken a team months. That is Wiz's own estimate, not a controlled comparison, but it matches what other teams have reported this year.
Wiz reported the bugs to the PHP security team on 24 August. The team acknowledged them on 21 September and began a coordinated fix.
The Part That Was Not New
Here is the uncomfortable detail that surfaced afterwards. The PHP Foundation's post-mortem confirmed that a core developer had spotted the underlying out-of-memory problem in 2024. It was judged possibly exploitable, but nobody had shown a concrete attack, and the team could not agree on a fix. Every option broke compatibility with some extensions, added a denial-of-service risk, or required changes across much of the codebase.
The Foundation called the delay a structural failure of its decision-making and resourcing. The scale of that resourcing problem is striking. According to Tom's Hardware's reading of the post-mortem, the project has one full-time employee and fourteen part-time contractors maintaining software that runs most of the web.
So AI did not discover an unknown unknown. It did something arguably more important. It turned a known, theoretical weakness into a proven, working attack, quickly enough that the old "no exploit shown, so it can wait" logic stopped holding.
How It Leaked, and How Fast Attackers Moved
Coordinated disclosure depends on everyone keeping a fix private until the release date. That did not hold:
17 October: Amazon's MadPot honeypots logged an exploitation attempt four days before disclosure, suggesting someone already had details.
20 October: News of the vulnerabilities spread on Hacker News and social media, and Calif mistakenly published a proof-of-concept video. Patched builds from a downstream vendor, reported to be Chainguard, also appeared before the embargo ended, which let attackers compare old and new code to see what had changed.
21 October: PHP brought its timetable forward and published patches and advisories. Cloudflare had already pushed emergency firewall rules, made available to all customers including free ones, and honeypot operators reported attacks the same day.
26 October: The US cybersecurity agency CISA added both CVEs to its Known Exploited Vulnerabilities catalogue and gave federal agencies three days to patch.
PHP2Shell timeline from 2024 to November 2026
How Everything Was Affected
The response was unusual in its scale.
Governments took sites offline. The Netherlands' Overheid.nl portal, Finland's public-facing government web services, French Interior Ministry websites, Denmark's national school platform and some Canadian government sites were taken down as a precaution. The US NSA advised taking sites offline if they could not be updated immediately, and agencies in the UK, EU, Canada, Japan and Singapore issued similar guidance.
Major platforms paused services. The Wikimedia Foundation shut down many supporting services, and the Internet Archive briefly went offline.
India was in scope. CERT-In rated the issue critical in a vulnerability note on 21 October, describing memory corruption and improper resource control that let a remote attacker run code. Given how many Indian government, education, e-commerce and SME websites run on PHP and on shared hosting, the exposure here is large even though public reporting has not named specific Indian victims.
Vendors' own products were exposed. Palo Alto Networks said all PAN-OS and Panorama versions were affected and, at the time of reporting, had not yet shipped fixed releases. Fortinet and Cisco said they were investigating. PHP sits inside appliances, admin panels and embedded systems that nobody thinks of as "a PHP website".
The long tail is the real risk. Censys initially counted about 45.7 million vulnerable PHP installations out of 119 million it could see. By early November that had fallen to around 29 million, roughly a million patched a day. Most PHP servers do not report their version, so the true numbers are unknown. Around 73% of PHP installations were reported to be on end-of-life versions with no active support.
Attackers also combined it with other flaws. Tom's Hardware reported one campaign that chained PHP2Shell with a separate Linux kernel bug to take full control of servers.
How It Was Fixed
The PHP fix goes after the root cause rather than each symptom:
Out-of-memory errors no longer abort mid-operation. PHP now defers handling of the memory limit until it is safe to stop, so it does not leave half-built structures behind.
A hard ceiling ends the process outright. If memory use keeps climbing past a higher limit, the worker is terminated immediately instead of carrying on with damaged state.
Per-request state is reset broadly. State that must never cross from one request to the next is now cleared, closing the stale-state bug.
The memory limit itself was kept. Patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For the end-of-life branches 7.4, 8.0 and 8.1, the security team published minimal source patches without official binaries, and cPanel, CloudLinux, Ubuntu Pro, Zend and volunteer maintainers such as Ondřej Surý released backported packages.
The PHP Foundation also changed how it decides. Security decisions will no longer require unanimity, stalled cases will be escalated early, and the Foundation is asking companies that rely on PHP to fund more engineers who understand the engine's internals.
One caution on "after the patch". A self-published, AI-assisted write-up claimed that code execution was still possible on 8.5.12. As of late October, neither of its RCE claims had been confirmed or refuted. One separate denial-of-service bug from it was confirmed and fixed in PHP's development branches. Treat unverified claims as unverified, and watch the official advisories.
What This Says About How Advanced AI Has Become
PHP2Shell is the most visible example of a shift that has been building all year.
AI now finds serious bugs at scale. In April 2026, Anthropic launched Project Glasswing, giving a restricted model, Claude Mythos Preview, to a group of major technology companies and critical-software maintainers. Anthropic says the model has found thousands of high-severity vulnerabilities across every major operating system and browser, including a 27-year-old OpenBSD flaw and a 16-year-old FFmpeg bug in a line of code automated testing had exercised millions of times. One of its published findings was a heap overflow in PHP's DBA extension, reported in May and fixed in July 2026, which Anthropic notes was found by static analysis and not yet reproduced dynamically. OpenAI's Patch the Planet, launched in June, reported 1,995 issues across 68 open-source projects by 21 October, with 466 fixes accepted upstream. Both sets of figures are self-reported.
AI now writes the exploit, not just the warning. Earlier in 2026, Calif described building an audit skill with Claude from about twenty historical PHP advisories. It flagged a deserialisation bug dating back to PHP 5.1 in 2005, and the model then wrote working exploits with humans steering the strategy. PHP2Shell went further, with models helping adapt attacks across versions and memory layouts.
The gap between disclosure and attack has collapsed. If a patch can be diffed and turned into an exploit in hours, the old monthly patch cycle is too slow for internet-facing systems.
Humans still decide the outcome. Three things are worth keeping in perspective:
The decisive failure was not a lack of detection. The bug was known in 2024. The failure was a small, under-resourced team that could not reach a decision.
AI also amplified the noise. Maintainers are now receiving far more reports, not all of them real, and unverified AI-assisted claims spread quickly.
The labs restrict their strongest cyber models for the same reason. Anthropic has said it does not plan to make Mythos Preview generally available, because the same skill that finds a flaw can exploit it.
The practical conclusion is that defenders must assume attackers have the same tools. Our post on building secure AI agents covers the other side of that coin: the new risks AI introduces into your own systems.
What Indian Businesses Should Do This Week
1. Find every PHP runtime you own. Not just your main website. Check admin panels, hosting control panels, staging servers, intranet tools, old microsites and vendor appliances. Run php -v for the command-line version, and check the web runtime as well. PHP-FPM, for example, can be a different build from the CLI.
2. Patch, then restart the workers. Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your vendor's backported package. The fix only takes effect once the running PHP processes are restarted.
3. Treat end-of-life versions as an emergency. If you are on PHP 7.x or 5.x, use a vendor backport now and schedule the upgrade. This incident is the business case for it.
4. Use a WAF as a stopgap, not a fix. Firewall rules from Cloudflare and others block known attack patterns, but the maintainers have been clear that only patching fully fixes the problem.
5. Look for signs you were hit. Wiz suggests watching for unusual multipart requests followed by memory-limit errors, bursts of HTTP 500 responses, unusually large or malformed PHPSESSID cookies, and unexplained churn in PHP workers. Because the memory-disclosure bug could expose data held in server memory, consider rotating secrets on any server that was unpatched and internet-facing during the exposure window.
6. Know your reporting duties. CERT-In's directions already require certain cyber incidents to be reported within six hours. If personal data was exposed, the DPDP Rules add breach notification duties as their obligations take effect, covered in our DPDP Rules engineering playbook.
7. Fix the process, not just the server. Measure how long it took you to patch, and why. Our guides on CI/CD pipelines that work in production and zero-trust security cover how to make the next emergency patch a routine deployment, and how to limit damage when one server is compromised.
The Short Version
PHP2Shell was a pair of decade-old memory bugs in PHP's handling of out-of-memory errors. AI tools found them and built working exploits in days. A broken embargo gave attackers a head start, and governments and platforms took sites offline. The fix changes how PHP handles memory exhaustion and resets state between requests, and every supported branch now has it.
The lesson goes beyond PHP. AI has made finding and weaponising vulnerabilities dramatically faster for defenders and attackers alike. The organisations that cope best will be the ones that know exactly what they run and can patch it in hours, not weeks.
If you want help confirming your PHP exposure or tightening your patch process, our Cybersecurity & Compliance practice runs rapid exposure reviews across web, cloud and on-premise estates.
