PHP2Shell: The AI Found PHP Flaw That Took Websites Offline. What It Means for Your Business

Two critical bugs in PHP itself. Not in a plugin or a theme. In the language. They are tracked as CVE-2026-109618 and CVE-2026-109619. PHP's security team rated both 9.2 out of 10 on the CVSS v4 scale.

In plain words. When PHP runs out of memory in the middle of handling a request it can leave bits of that request lying around. A later request on the same server can pick those bits up and treat them as real. An attacker who understands this can run their own code on your server without logging in. They can also read memory that belongs to other visitors. That means passwords and tokens and API keys.

Wiz says every PHP version from the last ten years has at least one of the bugs. They proved a full takeover against fresh copies of WordPress and Drupal and Joomla. Even a one line Hello World page on an old PHP is open to it. PHP says the highest risk is servers running PHP as an Apache module called mod_php.

Wiz researchers found the first bug on August 19 using AI models and reported it to PHP five days later. Their write up names Gemini 4 Argon and GPT-5.6 Sol and says the models helped with discovery and exploit building and patch testing. One line from the post stuck with us. A single researcher did in a week what "previously would have taken a world-class team months".

PHP confirmed the reports on September 21 and started on a coordinated fix. The plan was a quiet release in late October. Then it leaked. PHP brought the date forward and shipped patches on October 21. The UK minister said OpenAI had briefed the National Cyber Security Centre the week before so the government could warn vendors early. Source: BBC.

So the timeline from AI finding the bug to the whole internet patching it was about nine weeks. That is fast for a flaw this deep. It is also the first time most people outside security have watched AI drive a disclosure of this size from start to finish.

Mostly people who took their own sites down on purpose to patch. Which is the right call. The BBC's live coverage listed UK government services and Canadian government sites and Germany's federal websites. In Japan the airline ANA and brewer Asahi and insurer Tokio Marine paused services. Orange in France suspended some services worldwide. Finland's state IT provider took sites down overnight.

Smaller stories tell it better. A garage owner in Chepstow could not file MOT results online for a day and went back to pen and paper. A gym chain's booking app went dark. PC gamers lost logins to Final Fantasy XIV and Pokémon HOME because the login servers run PHP. A law student lost access to her course. A university student lost his calendar and slides.

One odd detail. Sophos told the BBC that cyber crime forums went offline too. Criminals run their sites on PHP like everyone else and they did not want rivals or police walking in through the same door.

Patching was slow outside the big players. Infrawatch tracked the UK patch rate going from 3.10% at 10am to 5.34% by 3.30pm on October 22 with the global rate at 4.21%. Large hosts had already upgraded. The long tail of small sites had not.

The bar for finding deep bugs just dropped. For everyone. Haya Schulmann of Fraunhofer told Reuters that AI has reduced what it takes to "weaponise" a vulnerability. The NCSC's Ollie Whitehouse said it is "reasonable to expect that this will not be the last". We agree with both.

Here is the hopeful side. The same models that found PHP2Shell are now sold as services that test your own apps before anyone else does. We priced several of them in our Droven.io AI tools guide. Most still want a sales call. One has a free tier. A year ago this category barely existed.

And the honest side. AI finding a bug does not patch your server. Somebody still has to make the call and run the update and check the logs. If you build software with us that routine is part of the job from day one. If you want help putting it in place for what you already run then our AI development team does that too.