PHP2Shell: AI Found a Pre-Auth RCE Chain in the Runtime Powering 70% of the Web

The most consequential AI security story of the year broke on October 21, and it is not about an AI system being hacked: it is about AI finding the bug. PHP2Shell is a pair of CVSS 9.2 memory-safety flaws in PHP core, CVE-2026-109618 and CVE-2026-109619, that permit unauthenticated remote code execution or memory disclosure on default configurations, with issues dating back to PHP 5.4. The PHP Foundation shipped fixed releases for 8.2.35, 8.3.36, 8.4.27, and 8.5.12 at 13:35 UTC on October 21, coordinating with Google, AWS, Microsoft, and Automattic. With PHP powering roughly 70% of websites, even a Hello World app on a vulnerable runtime is exposed.

The two bugs, briefly

CVE-2026-109618 is an out-of-memory corruption that lets an unauthenticated attacker execute code as the PHP web worker; researchers demonstrated pre-auth RCE against WordPress, Drupal, and Joomla stock images. CVE-2026-109619 is subtler and arguably worse: stale global state persisting across requests triggers a use-after-free that can disclose worker memory or execute code, and application-agnostic memory disclosure is the quiet nightmare, since passwords, tokens, API keys, and certificates can be siphoned without the noise of an RCE. The advisory includes concrete detection guidance, because these leave imperfect traces: oversized or malformed PHPSESSID cookies, multipart requests followed by memory-limit errors or 500 bursts, and unexplained worker crashes.

The AI part is the precedent

Discovery ran on frontier models from three labs at once: Wiz Atlas, Gemini 4 Argon, and GPT-5.6-Sol covered discovery, exploit development, and patch validation, with Google’s Gemini 4 singled out for particularly significant contributions to exploit development and patch validation. The work ran under OpenAI’s Patch the Planet initiative with Wiz Research and Calif, and press timelines indicate the flaws were found in August, giving a two-month coordinated-fix window. That window is exactly what coordinated disclosure assumes and rarely gets; Wired reported on October 22 that AWS analysts believe exploitation began October 17, four days before public disclosure, meaning the leak-to-patch race the industry fears is now measurable. This is the offensive equilibrium we described in the $25-per-breach agent campaign, arriving through the defensive door first: models that can audit a 30-year-old C codebase and chain two memory bugs into pre-auth RCE change both sides of the market simultaneously.

What operators must do now

Patching is the only complete fix, and the runtime, not the app, is the target: restart Apache, PHP-FPM, and long-running workers after updating, because application updates alone do nothing. The patch adds a hard memory limit that kills processes before shutdown handlers run, so the advisory warns teams to review its operational impact on jobs that relied on shutdown cleanup. Interim mitigations exist for teams that cannot patch immediately, and they are unusual: setting memory_limit = -1 (yes, unlimited) sidesteps the memory-limit attack paths, but only safely with OS-level containment like cgroup v2 memory.max; avoid RLIMIT_AS and RLIMIT_DATA, which hit the same vulnerable code. Reduce post_max_size and max_input_nesting_level, disable session.upload_progress if unused, lower pm.max_requests to recycle workers faster, and note that PHP 8.2 reaches end of life on December 31, so the 8.2.35 fix is among the last it will ever get.