Loading page…
Researchers demonstrated attacks without a login on WordPress, Drupal and Joomla deployments. PHP’s widespread use signals scale, not a count of vulnerable websites.
Listen to this story
The flaws stem from PHP’s handling of fatal errors and memory exhaustion, not from bugs in individual websites: Wiz demonstrated unauthenticated remote code execution on WordPress, Drupal and Joomla, as well as access to sensitive process memory. The four bugs date back to PHP 5.4, fall under CVE-2026-109618 and CVE-2026-109619, and reached a CVSS severity score of 9.2; PHP released a patch on October 21, 2026, which Wiz calls the only complete remediation. Wiz says AI models helped make exploit development across different deployments practical in hours, making patching affected PHP versions the key defensive priority.
Memory disclosure could expose passwords, tokens and API keys even when attackers do not achieve code execution.
The Wall Street Journal cites PHP on up to 70% of websites, but that figure is not an estimate of exploitable deployments.
Wiz recommends patching; interim warning signs include malformed multipart requests, oversized PHPSESSID cookies, memory-limit errors, repeated HTTP 500s and PHP worker churn.
AI helped researchers turn longstanding PHP bugs into working server-takeover attacks—and helped them prepare a fix. PHP disclosed critical vulnerabilities on October 21, 2026, and released a patch, according to Wiz Research. The immediate stakes extend beyond finding bad code: Wiz says AI substantially reduced the work needed to make those flaws exploitable across different applications.
Wiz’s PHP2Shell disclosure describes four exploitable bugs grouped under CVE-2026-109618 and CVE-2026-109619, with severity reaching 9.2 on the CVSS vulnerability-rating scale. Researchers demonstrated remote code execution—running an attacker’s instructions on a server—without logging in, using WordPress, Drupal and Joomla deployments.
Wiz also demonstrated reading sensitive server-process memory without achieving code execution, potentially exposing passwords, tokens and API keys. The underlying bugs concern fatal errors, particularly when memory runs out. A request can end while leaving corrupted internal state that later requests or workers reuse, allowing memory disclosure or corruption.
Wiz says affected versions date back to PHP 5.4. The Wall Street Journal puts PHP’s reach at as much as 70% of websites. That usage estimate is not a count of exploitable sites: requirements differ across the bugs and deployments.
The vulnerable code had existed for more than a decade, according to Wiz. Exploiting it required linking bugs and adapting to how different deployments allocate and reuse memory. Models helped analyze failures and revise attacks through testing and debugging.
Wiz says frontier models made that process practical, helping the team develop and adapt working exploits across multiple applications in hours. It names Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol as research tools, crediting Gemini with contributions from discovery through patch validation.
The Journal credits security company Calif with discovering the issue using AI tools. Wiz says it worked with Calif, OpenAI and the PHP team on discovery, coordination and patch verification.
Before disclosure, Wiz worked with companies including AWS, Cloudflare, Microsoft and Automattic on guidance, detection and mitigations. It identifies the PHP update as the only complete remediation, addressing the underlying failure pattern and its variants.
Application logs may offer little context because the attacks operate below that layer. Until patching is complete, Wiz recommends investigating these signals:
Story updates
Organizations running PHP to serve web requests need to patch immediately, the Cybersecurity and Infrastructure Security Agency warned in an October 21, 2026 alert. Two critical flaws, collectively called PHP2Shell, let attackers run code on a server without logging in. The agency recommends taking PHP-based systems offline when an immediate update is not possible.
The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, sit in PHP's handling of multipart/form-data requests—the format browsers use for file uploads. According to AWS's mitigation guide, the dangerous processing happens before the website's own application code runs. The attack surface is therefore in the underlying PHP runtime, not just in how an application handles an uploaded file.
The two flaws fail differently. CVE-2026-109618 corrupts memory when PHP runs out of memory during a request. CVE-2026-109619 allows a request to leave stale data behind, which a later request reuses in the same worker process—the server process that handles successive requests.
That distinction matters for defenses. A web application firewall filters incoming HTTP requests. AWS says its firewall cannot see PHP worker memory or server-side configuration, and it does not parse the internal structure of multipart request bodies. Those limits leave parts of the attack beyond its view.
Patching is the only complete fix, and you should upgrade PHP as your first priority.
AWS has added a PHP2Shell_BODY rule to version 2.3 of its PHP application managed rule group, targeting request patterns associated with CVE-2026-109619. It also made that version the global default. Customers already using the default version have the rule evaluating traffic, but should check that their settings have not changed its action to counting requests rather than blocking them.
Customers pinned to an older rule-group version must change versions to receive that protection. The PHP rule group does not target CVE-2026-109618; AWS recommends a separate request-body size restriction as a partial defense against that flaw.
Size limits have a specific weakness here. Small headers inside a multipart body can expand into much larger memory structures inside PHP. That header amplification can exhaust memory while the request remains below a firewall's size cap. For applications that accept multipart uploads, AWS says firewall rules reduce risk but do not close the vulnerability.
Applications with no legitimate multipart uploads can block that request format during the patching window. Rate limits offer another partial defense by reducing repeated attempts, but cannot stop a single successful request. AWS advises testing firewall rules in Count mode, reviewing legitimate traffic matches, then switching to Block.
CISA directs organizations to install PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Finding every installation is part of the response: PHP can be bundled into other software, so its presence may not be obvious. The agency's operational guidance is:
Identify and inventory systems running any version of PHP across the organization, including installations embedded in other software.
Apply patches immediately, giving internet-facing systems priority.
Take PHP-based systems offline if they cannot be updated immediately, including installations on unsupported PHP 8.1 or earlier.
Monitor for suspicious behavior, including PHP worker processes launching shells or downloading tools.
CISA said it had not observed exploitation when it published its October 21 alert. Its recommendation was nevertheless immediate action, rather than waiting for evidence of an attack.
amazon.comNational Security Agency (NSA) and world leaders warn of security flaws found in PHP programming language Calif researchers first found this flaw using OpenAI’s GPT-5.6 Sol In Europe, Asia and on other continents, authorities have taken a number of government websites offline for the time being to protect them from newly identified security vulnerabilities in a programming language that powers the vast majority of websites online. The NSA told organizations to patch 2 critical PHP flaws, dubbed PHP2Shell, or pull unpatched servers offline. Both bugs live in PHP’s core, so every installation serving web requests is at risk, whatever site runs on top. When a request exhausts memory or hits a...
AI-assisted discovery gave defenders a head start on critical PHP flaws, OpenAI says. Turning that lead into protection took two months of coordination. On October 21, the company detailed that response and proposed a framework for future discoveries, alongside a $1 billion commitment in subsidized Daybreak access for resource-limited organizations protecting essential services.
The company’s Patch the Planet initiative supported a response led by PHP’s maintainers, who handled the fixes and release. OpenAI, Wiz, Cloudflare and other partners contributed research, technical support and preparations for disclosure. PHP is an open-source programming language used to run websites and web applications.
OpenAI credits Calif with identifying one critical flaw using GPT-5.6 Sol, while Wiz independently discovered and reported both vulnerabilities. The company says that, to its knowledge, frontier AI found the flaws before attackers did. That is its assessment of the discovery timeline, not a guarantee that attackers never knew about them.
PHP’s own security advisory illustrates the stakes. One flaw lets an out-of-memory error leave request memory in an invalid state. Researchers validated remote code execution—running an attacker’s instructions on a server—without a login against Apache’s mod_php configuration. Exploit reliability depends on the PHP build, extensions and server setup.
For that vulnerability, the advisory lists patched releases as PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. It says updating to a release containing the patch is the only complete mitigation. OpenAI has shared a PHP version checker and plans an accompanying Codex skill to help operators identify potentially vulnerable versions and determine applicable updates.
Even limited details can reveal a vulnerability, so we weigh the risk of sharing them against the protection they enable.
The proposed framework is not a requirement to assemble a global coalition for every bug. OpenAI says some findings can be handled directly between researchers and maintainers. Others need a wider response because they affect many products, or because distributors and providers need time to prepare protections. It describes five stages:
Validate the flaw and test a fix, including using frontier models to look for ways around the patch.
Loading discussion...
Give affected organizations advance information so they can adapt fixes, test mitigations or prepare detection measures.
Coordinate with government partners to help guidance reach critical infrastructure and other essential services.
Bring in additional distributors, providers and operators as fixes and disclosure plans stabilize.
Publish guidance once a patch is available, then support deployment and checks that the fix is running.
Maintainers would decide whom to involve before disclosure. The criteria include an organization’s protective role, the time it needs to act and its ability to handle sensitive information. Participants would receive only what their protective work requires. The timeline would be reassessed if exploitation, leaks, a revealing public patch or stalled repairs increased users’ risk.
OpenAI says small maintainer teams need help sorting duplicate reports, assessing impact and testing repairs across supported releases. Its support includes funding, model access and engineering help; open-source projects can apply to Patch the Planet for hands-on assistance. The $1 billion commitment is specifically subsidized Daybreak access through Daybreak for Frontline Defenders.
The framework remains a proposal. OpenAI is asking the security community how long disclosure windows should last, who needs early notice, and when broader notification is worth the leak risk. It also wants independent security experts to challenge the approach and identify gaps.
Join the conversation
Explain whether limiting misuse would justify limiting access for independent defenders.
Be the first to share a perspective or an experience.
Reader comments
Newest comments first. Replies stay oldest first.