AI Found the PHP Zero-Day First. Now What?
---
title: "AI Found the PHP Zero-Day First. Now What?"
published: true
description: "GPT-5.6 Sol and Gemini 4 Argon found PHP2Shell weeks before disclosure. AI vuln discovery is production-ready for both sides."
tags: security, php, ai, cybersecurity
canonical_url: computeleap.com
cover_image: computeleap.com
---
AI Found the PHP Zero-Day First. Now What?
On October 21, 2026, the PHP project shipped emergency patches for two critical remote code execution vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — collectively named PHP2Shell. With a CVSS v4.0 score of 9.2, they affect every PHP version released in the last decade, back to PHP 5.4, touching an estimated 70% of the web. WordPress, Drupal, Joomla — all vulnerable by default.
> 📖 Read the full version with charts and embedded sources on ComputeLeap →
But the real story isn't the bugs themselves. It's who found them first: AI models, working under OpenAI's "Patch the Planet" initiative, discovered PHP2Shell weeks before public disclosure. Security firm Calif used GPT-5.6 Sol to identify the flaws in August. Independently, Wiz Research used Gemini 4 Argon, GPT-5.6 Sol, and its own Wiz Atlas tool to reach the same conclusion. For the first time in a major internet-scale vulnerability, AI-assisted discovery beat the attackers to the punch — or did it?
View discussion on Hacker News →
The Vulnerabilities: Memory Corruption Meets Stale State
PHP2Shell comprises four bugs grouped under two CVEs:
CVE-2026-109618 (OOM Corruption): When PHP runs out of memory at precisely the wrong moment during request setup, internal data structures are left half-initialized. Cleanup code trusts this corrupted state, opening a use-after-free. Researchers demonstrated unauthenticated remote code execution against Apache mod_php with default settings.
CVE-2026-109619 (Stale Global State): A fatal error leaves internal pointers alive across request boundaries. A subsequent request served by the same PHP worker can hijack these dangling pointers, enabling another use-after-free. A related memory-disclosure variant leaks passwords, API keys, and certificates from other requests through a PHPSESSID cookie — even without session_start().
> ⚠️ The bugs are in PHP's core engine, not in any application. Even a "Hello World" script on an affected version is vulnerable. Updating WordPress, Drupal, or your framework alone does not fix this — you must patch PHP itself.
The attack surface is severe: pre-authentication RCE was demonstrated against the latest WordPress, Drupal, and Joomla container images. A proof-of-concept exploit — aptly named php2shell — appeared on GitHub within hours and has amassed over 900 stars. The barrier to exploitation is effectively zero for anyone with the PoC.
How AI Found It: The Patch the Planet Timeline
OpenAI launched Patch the Planet in June 2026 as part of its Daybreak cybersecurity initiative. Built with Trail of Bits and partners HackerOne and Calif, the program pairs AI-assisted vulnerability research with human expert review. By October, it had reviewed 50 codebases and merged 160 patches upstream.
Here's how the PHP2Shell discovery unfolded:
2024: A PHP core developer first noticed the out-of-memory error pattern during an OSTIF/Quarkslab audit funded by the Sovereign Tech Agency. No exploit was found. The fix stalled — the PHP Foundation later called this "a structural failure" in their consensus-based security process.
July 30, 2026: At the PHP Foundation's request, Calif researchers began auditing PHP's source code using OpenAI's GPT-5.6 Sol through Patch the Planet.
August 1, 2026: Calif's Ryan Austin identified the first exploitable vulnerability. The AI model didn't just find the bug — it helped develop working exploit chains across multiple PHP versions and deployment configurations.
August 19, 2026: Wiz Research independently discovered the same vulnerabilities using Gemini 4 Argon, GPT-5.6 Sol, and Wiz Atlas. Within two days, they confirmed unauthenticated RCE against Drupal and WordPress.
August 24, 2026: Both teams reported to the PHP security team. OpenAI learned of Wiz's parallel work through the PHP Foundation and coordinated a unified response.
September 21, 2026: PHP acknowledged the reports and began coordinated fixes.
{% youtube lfEtbrz4-zY %}
The Defender's Window — Or Was It?
OpenAI frames the PHP2Shell episode as a "Defender's Window": advanced AI models found the flaws before attackers could exploit them, giving the community time to prepare patches, WAF rules, and mitigations. The coordinated response involved the PHP Foundation, Cloudflare, AWS, Akamai, Google, Microsoft, Vercel, Quarkslab, and multiple government agencies — from the NSA and FBI to Japan's prime minister's office and the EU's CERT.
Cloudflare deployed temporary WAF rules before the scheduled October 21 patch. The PHP Foundation added OpenAI's Daybreak Red to validate reports and reproduction environments.
It looked like the system worked. Except for one problem.
> ⚠️ The Contrarian Corner: Amazon's MadPot honeypot recorded PHP2Shell exploitation attempts on October 17 — four days before public disclosure. The attempt came from a commercial anonymization network. AWS says it's "unclear how the actor obtained exploit information while the vulnerability was under embargo." The defender's window may have been breached before it officially opened.
This isn't the only leak. CVE details leaked on October 20 with incorrect timing and CVSS scoring. Calif accidentally published a proof-of-concept video. Chainguard released patched container images roughly six hours before the coordinated release, giving attackers a binary diff to reverse-engineer.
View discussion on Hacker News →
The result: Cloudflare reported "tens of thousands" of exploit attempts within 45 minutes of the news spreading, "hundreds of thousands" within two hours, and millions by evening. AWS confirmed the vulnerability was "broadly exploited in the wild." The Netherlands and Finland took government websites offline as a precaution. Archive.org went temporarily dark.
The Real Inflection Point: AI on Both Sides of the Fence
PHP2Shell matters beyond the immediate scramble because it demonstrates that AI vulnerability discovery is now production-grade. Not a benchmark score. Not a controlled evaluation. Production.
Consider the numbers:
- 66,000 CVEs projected for 2026, up from 48,000 in 2025. The Forum of Incident Response and Security Teams (FIRST) attributes the surge primarily to AI tools finding flaws.
- Negative seven-day mean time-to-exploit. Mandiant's incident response data shows exploitation now starts, on average, a week before a patch exists.
- Anthropic's Project Glasswing reportedly uncovered over 10,000 high-or-critical vulnerabilities in its first months using Claude Mythos Preview.
- OpenAI's GPT-5.6-Cyber scores 95% on advanced cyber request completion, compared to 1.5% for the base GPT-5.6 Sol model.
- At Pwn2Own Berlin 2026, researchers armed with AI tools uncovered 47 unique zero-day vulnerabilities across browsers, AI databases, coding agents, and enterprise applications.
{% youtube aT_3zsvYofc %}
The dual-use dilemma is not theoretical. As OpenAI itself acknowledged: "The same capabilities can also help attackers rapidly develop offensive tools and exploits." Bruce Schneier described this as a dual-use paradox — defenders hold an advantage only while comparable capability stays out of adversaries' hands.
And the evidence suggests it hasn't stayed out. Google's Threat Intelligence Group reported in May 2026 what it described as the first publicly documented use of an AI-generated zero-day exploit — a 2FA bypass with tell-tale AI fingerprints (hallucinated CVSS scores, educational docstrings, textbook-format Python). They disrupted it before mass exploitation, but the capability threshold had been crossed.
The Community Reaction
The security community's response has been a mix of urgency and uncomfortable recognition.
View discussion on Hacker News →
On Hacker News, the Wiz disclosure post and the PHP Foundation's response both hit the front page. The discussion centered on the coordination complexity — getting patches into PHP distributions, Docker images, and managed hosting platforms simultaneously while an embargo was leaking. Multiple threads flagged that end-of-life PHP branches (7.4, 8.0, 8.1) have no official binary releases, leaving millions of servers dependent on distribution backports.
View discussion on Reddit →
On Reddit's r/technology, the Cloudflare exploitation data — 1.6K upvotes, 96 comments — drove home the scale. Comments ranged from "every shared host running cPanel just became an incident" to debates about whether the PHP Foundation's consensus-based security process is fit for the AI era.
> ℹ️ watchTowr was the first external party to publicly confirm the vulnerabilities were real, publishing their analysis on October 20 before the embargo officially lifted. Their assessment: "no configuration-only workaround fully closes the issue."
The Wiz team's podcast deep-dive with researchers Sagi Tzadik and Thai Duong (Calif) is worth the listen — it covers how AI agents handled the version-specific exploit adaptation that would have taken human researchers months in a lab.
View on Latent Space →
The Arms Race in Numbers
The broader context makes PHP2Shell's significance clear. This isn't the first AI-assisted vulnerability discovery — it's the one that broke through to mainstream awareness.
Google's Big Sleep project found an exploitable SQLite flaw (CVE-2025-6965) before it reached an official release in late 2025. In April 2026, Anthropic's Project Glasswing reportedly uncovered over 10,000 high-or-critical vulnerabilities using Claude Mythos Preview. In May, Google's Threat Intelligence Group documented the first in-the-wild AI-generated zero-day exploit — a 2FA bypass with telltale LLM fingerprints in its code. In June, autonomous security startup depthfirst found 21 previously unknown FFmpeg vulnerabilities for roughly $1,000 in compute.
OpenAI has released increasingly permissive models for security research. GPT-5.5-Cyber launched in June 2026 with Patch the Planet. GPT-5.6-Cyber followed in August with "reduced safeguards for exploit development" — completing 95% of advanced cyber requests versus 1.5% for the base model. Trusted partners including CrowdStrike, Cloudflare, Palo Alto Networks, and IBM received access through Daybreak Red.
The numbers tell the story of a capability curve going vertical. But capability without process is just a faster way to find bugs nobody patches.
{% youtube pLaZFgpAFUU %}
What This Means for You
If you're a builder, a security lead, or anyone running infrastructure, PHP2Shell crystallizes a new operational reality:
1. Patch timelines are now measured in hours, not days.
AWS's recommendation is blunt: "Measure patch and mitigation timelines for critical internet-facing vulnerabilities in hours." The Oct 17 exploitation — four days before disclosure — means your window starts before you even know there's a window.
2. WAF-first, patch-second is the new order of operations.
Cloudflare's pre-disclosure WAF deployment saved countless sites. If your stack doesn't include a WAF that can receive emergency rules from vendor threat intelligence, you're structurally behind.
3. AI-speed disclosure changes severity triage.
When an AI model finds a bug, the disclosure-to-exploit timeline compresses. Treat AI-assisted advisories as inherently higher urgency. A traditional 90-day disclosure window assumes human-speed discovery on the attacker side. That assumption is dead.
4. End-of-life software is now an active emergency.
PHP 7.4 through 8.1 have no official binary patches. With a public PoC sporting 900+ GitHub stars, running EOL PHP on the public internet is the equivalent of leaving your front door open with a sign that says "free stuff inside."
5. Monitor the pre-disclosure window.
Amazon's MadPot IOCs date to October 17. If you haven't checked your PHP logs back to mid-October, do it now. The indicators: unusual multipart requests followed by memory-limit errors, malformed PHPSESSID cookies, unexplained PHP worker churn, and suspicious files in web roots.
> 💡 Immediate action checklist: Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Restart all PHP workers after updating. Deploy WAF rules targeting multipart upload exploits. Hunt for IOCs backdated to October 17. Audit for EOL PHP instances and isolate or upgrade. Set session.upload_progress.enabled=0 as a temporary stopgap (this does NOT close all paths).
The Bigger Picture
PHP2Shell is not an isolated incident. It's the clearest signal yet that we've entered an era where AI finds bugs faster than humans can fix them. The Cloud Security Alliance puts it starkly: in Anthropic's Project Glasswing, fewer than 1% of the vulnerabilities Mythos found were actually patched. The bottleneck isn't discovery. It's remediation.
OpenAI's Patch the Planet is one attempt to close that gap — pairing AI discovery with human-led patching at scale. Trail of Bits engineers review every finding. Calif and HackerOne handle triage and coordinated disclosure. It's the right architecture: AI finds, humans verify, humans fix. As of October, the program has reviewed 50 codebases and merged 160 patches upstream — a meaningful start, but a drop in the bucket against 66,000 projected CVEs.
But the PHP Foundation's own post-mortem reveals the fragility. A two-year delay between first noticing the OOM pattern and shipping a fix. A consensus-based security team that couldn't agree on trade-offs. A coordinated disclosure that leaked from three directions simultaneously. The new Ecosystem Security Team, formed in May 2026, is a step forward — but it took a CVSS 9.2 internet emergency to force the structural change.
View discussion on Hacker News →
The defender's toolbox got a major upgrade with AI-assisted discovery. The defender's process didn't keep pace. As Wiz put it: "It marks an AI inflection point." The question is whether the organizations that depend on PHP — which is to say, most of the internet — can operate at inflection-point speed.
If your organization's security posture still assumes human-speed vulnerability discovery on both sides, PHP2Shell is the wake-up call. The attackers have AI too. And as the October 17 exploitation shows, they may already be ahead.
For more on supply-chain security in the AI era, see our coverage of the LiteLLM supply chain attack and OpenAI's API dependency risks.
Originally published at ComputeLeap
Mentions
Proof-of-Concept (PoC) exploit for php2shell (CVE-2026-109618 / CVE-2026-109619), demonstrating remote code execution in vulnerable PHP environments. For security research and educational purposes only. eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
An interesting case is the repo by eness (eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC): First, it contained what appears to be a reimplementation of J4ck3LSyN's research. Since then, that has been replaced with an (unattributed) copy of 9bie's exploit. The rest of the […]
CVE-2026-109619: CVE-2026-109619: Remote Code Execution in PHP Core via Stale Global State Memory Corruption (PHP2Shell) CVE-2026-109619: Remote Code Execution in PHP Core via Stale Global State Memory Corruption (PHP2Shell) > Vulnerability ID: CVE-2026-109619 > CVSS Score: 9.2 > Published: 2026-10-21 CVE-2026-109619 (PHP2Shell) is a critical Use-After-Free vulnerability in the core PHP engine caused by improper global state cleanup during out-of-memory exception handling across persistent worker requests. TL;DR Unauthenticated remote code execution vulnerability in persistent PHP worker processes caused by stale global pointers retained after out-of-memory longjmp bailouts. --- ⚠️ Exploit Status: POC Technical Details - CWE ID: CWE-416 - Attack Vector: Network - CVSS v4.0: 9.2 (Critical) - EPSS Score: 5.76% (93.05th percentile) - Impact: Remote Code Execution - Exploit Status: Proof of Concept Available - KEV Status: Not Listed Affected Systems - PHP-FPM worker pools - Apache mod_php web server modules - Persistent PHP CGI / FastCGI worker processes - PHP: 8.2.0 - 8.2.34 (Fixed in: 8.2.35) - PHP: 8.3.0 - 8.3.35 (Fixed in: 8.3.36) - PHP: 8.4.0 - 8.4.26 (Fixed in: 8.4.27) - PHP: 8.5.0 - 8.5.11 (Fixed in: 8.5.12) Code Analysis Commit: 31c0ea7 Fix stale global state retention during bailout exception handling and implement fallible allocations. Exploit Details - GitHub (eness): Proof of concept exploit script for CVE-2026-109618 and CVE-2026-109619 - GitHub (ikow): Proof of concept demonstration repository - GitHub (Assetnote): Scanner tool for detecting vulnerable PHP deployments Mitigation Strategies - Upgrade PHP engine to a fixed release version immediately - Enforce maximum request body size limits in web server frontends - Disable session upload progress tracking if not required - Configure aggressive worker process recycling limits in PHP-FPM Remediation Steps: 1. Identify all deployed PHP instances using package managers or runtime version checks 2. Update PHP 8.2 environments to version 8.2.35 or higher 3. Update PHP 8.3 environments to version 8.3.36 or higher 4. Update PHP 8.4 environments to version 8.4.27 or higher 5. Update PHP 8.5 environments to version 8.5.12 or higher 6. Restart PHP-FPM worker pools and web server daemons to load patched runtimes References - PHP Security Advisory GHSA-6wmf-4rv5-p3rp - PHP Security Advisory GHSA-w8hw-w9fx-j79w - PHP Release Announcement 2026-10-21 - Official Security Patch Commit - Wiz Blog Analysis: PHP2Shell - Wiz Vulnerability Database Entry - OSS-Security Discussion 2026/10/21/16 - OSS-Security Discussion 2026/10/21/17 - OSS-Security Discussion 2026/10/21/23 - OSS-Security Discussion 2026/10/21/7 - OSS-Security Discussion 2026/10/22/14 - OSS-Security Discussion 2026/10/22/15 - OSS-Security Discussion 2026/10/22/16 - OSS-Security Discussion 2026/10/22/19 - OSS-Security Discussion 2026/10/22/2 - OSS-Security Discussion 2026/10/22/20 - Public PoC Repository - eness - Public PoC Repository - ikow - PHP2Shell Scanner Tool --- Read the full report for CVE-2026-109619 on our website for more details including interactive diagrams and full exploit analysis.
AI Found the PHP Zero-Day First. Now What? --- title: "AI Found the PHP Zero-Day First. Now What?" published: true description: "GPT-5.6 Sol and Gemini 4 Argon found PHP2Shell weeks before disclosure. AI vuln discovery is production-ready for both sides." tags: security, php, ai, cybersecurity canonical_url: computeleap.com cover_image: computeleap.com --- AI Found the PHP Zero-Day First. Now What? On October 21, 2026, the PHP project shipped emergency patches for two critical remote code execution vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — collectively named PHP2Shell. With a CVSS v4.0 score of 9.2, they affect every PHP version released in the last decade, back to PHP 5.4, touching an estimated 70% of the web. WordPress, Drupal, Joomla — all vulnerable by default. > 📖 Read the full version with charts and embedded sources on ComputeLeap → But the real story isn't the bugs themselves. It's who found them first: AI models, working under OpenAI's "Patch the Planet" initiative, discovered PHP2Shell weeks before public disclosure. Security firm Calif used GPT-5.6 Sol to identify the flaws in August. Independently, Wiz Research used Gemini 4 Argon, GPT-5.6 Sol, and its own Wiz Atlas tool to reach the same conclusion. For the first time in a major internet-scale vulnerability, AI-assisted discovery beat the attackers to the punch — or did it?  View discussion on Hacker News → The Vulnerabilities: Memory Corruption Meets Stale State PHP2Shell comprises four bugs grouped under two CVEs: CVE-2026-109618 (OOM Corruption): When PHP runs out of memory at precisely the wrong moment during request setup, internal data structures are left half-initialized. Cleanup code trusts this corrupted state, opening a use-after-free. Researchers demonstrated unauthenticated remote code execution against Apache mod_php with default settings. CVE-2026-109619 (Stale Global State): A fatal error leaves internal pointers alive across request boundaries. A subsequent request served by the same PHP worker can hijack these dangling pointers, enabling another use-after-free. A related memory-disclosure variant leaks passwords, API keys, and certificates from other requests through a PHPSESSID cookie — even without session_start(). > ⚠️ The bugs are in PHP's core engine, not in any application. Even a "Hello World" script on an affected version is vulnerable. Updating WordPress, Drupal, or your framework alone does not fix this — you must patch PHP itself. The attack surface is severe: pre-authentication RCE was demonstrated against the latest WordPress, Drupal, and Joomla container images. A proof-of-concept exploit — aptly named php2shell — appeared on GitHub within hours and has amassed over 900 stars. The barrier to exploitation is effectively zero for anyone with the PoC. How AI Found It: The Patch the Planet Timeline OpenAI launched Patch the Planet in June 2026 as part of its Daybreak cybersecurity initiative. Built with Trail of Bits and partners HackerOne and Calif, the program pairs AI-assisted vulnerability research with human expert review. By October, it had reviewed 50 codebases and merged 160 patches upstream. Here's how the PHP2Shell discovery unfolded: 2024: A PHP core developer first noticed the out-of-memory error pattern during an OSTIF/Quarkslab audit funded by the Sovereign Tech Agency. No exploit was found. The fix stalled — the PHP Foundation later called this "a structural failure" in their consensus-based security process. July 30, 2026: At the PHP Foundation's request, Calif researchers began auditing PHP's source code using OpenAI's GPT-5.6 Sol through Patch the Planet. August 1, 2026: Calif's Ryan Austin identified the first exploitable vulnerability. The AI model didn't just find the bug — it helped develop working exploit chains across multiple PHP versions and deployment configurations. August 19, 2026: Wiz Research independently discovered the same vulnerabilities using Gemini 4 Argon, GPT-5.6 Sol, and Wiz Atlas. Within two days, they confirmed unauthenticated RCE against Drupal and WordPress. August 24, 2026: Both teams reported to the PHP security team. OpenAI learned of Wiz's parallel work through the PHP Foundation and coordinated a unified response. September 21, 2026: PHP acknowledged the reports and began coordinated fixes. {% youtube lfEtbrz4-zY %} The Defender's Window — Or Was It? OpenAI frames the PHP2Shell episode as a "Defender's Window": advanced AI models found the flaws before attackers could exploit them, giving the community time to prepare patches, WAF rules, and mitigations. The coordinated response involved the PHP Foundation, Cloudflare, AWS, Akamai, Google, Microsoft, Vercel, Quarkslab, and multiple government agencies — from the NSA and FBI to Japan's prime minister's office and the EU's CERT. Cloudflare deployed temporary WAF rules before the scheduled October 21 patch. The PHP Foundation added OpenAI's Daybreak Red to validate reports and reproduction environments. It looked like the system worked. Except for one problem. > ⚠️ The Contrarian Corner: Amazon's MadPot honeypot recorded PHP2Shell exploitation attempts on October 17 — four days before public disclosure. The attempt came from a commercial anonymization network. AWS says it's "unclear how the actor obtained exploit information while the vulnerability was under embargo." The defender's window may have been breached before it officially opened. This isn't the only leak. CVE details leaked on October 20 with incorrect timing and CVSS scoring. Calif accidentally published a proof-of-concept video. Chainguard released patched container images roughly six hours before the coordinated release, giving attackers a binary diff to reverse-engineer.  View discussion on Hacker News → The result: Cloudflare reported "tens of thousands" of exploit attempts within 45 minutes of the news spreading, "hundreds of thousands" within two hours, and millions by evening. AWS confirmed the vulnerability was "broadly exploited in the wild." The Netherlands and Finland took government websites offline as a precaution. Archive.org went temporarily dark. The Real Inflection Point: AI on Both Sides of the Fence PHP2Shell matters beyond the immediate scramble because it demonstrates that AI vulnerability discovery is now production-grade. Not a benchmark score. Not a controlled evaluation. Production. Consider the numbers: - 66,000 CVEs projected for 2026, up from 48,000 in 2025. The Forum of Incident Response and Security Teams (FIRST) attributes the surge primarily to AI tools finding flaws. - Negative seven-day mean time-to-exploit. Mandiant's incident response data shows exploitation now starts, on average, a week before a patch exists. - Anthropic's Project Glasswing reportedly uncovered over 10,000 high-or-critical vulnerabilities in its first months using Claude Mythos Preview. - OpenAI's GPT-5.6-Cyber scores 95% on advanced cyber request completion, compared to 1.5% for the base GPT-5.6 Sol model. - At Pwn2Own Berlin 2026, researchers armed with AI tools uncovered 47 unique zero-day vulnerabilities across browsers, AI databases, coding agents, and enterprise applications. {% youtube aT_3zsvYofc %} The dual-use dilemma is not theoretical. As OpenAI itself acknowledged: "The same capabilities can also help attackers rapidly develop offensive tools and exploits." Bruce Schneier described this as a dual-use paradox — defenders hold an advantage only while comparable capability stays out of adversaries' hands. And the evidence suggests it hasn't stayed out. Google's Threat Intelligence Group reported in May 2026 what it described as the first publicly documented use of an AI-generated zero-day exploit — a 2FA bypass with tell-tale AI fingerprints (hallucinated CVSS scores, educational docstrings, textbook-format Python). They disrupted it before mass exploitation, but the capability threshold had been crossed. The Community Reaction The security community's response has been a mix of urgency and uncomfortable recognition.  View discussion on Hacker News → On Hacker News, the Wiz disclosure post and the PHP Foundation's response both hit the front page. The discussion centered on the coordination complexity — getting patches into PHP distributions, Docker images, and managed hosting platforms simultaneously while an embargo was leaking. Multiple threads flagged that end-of-life PHP branches (7.4, 8.0, 8.1) have no official binary releases, leaving millions of servers dependent on distribution backports.  View discussion on Reddit → On Reddit's r/technology, the Cloudflare exploitation data — 1.6K upvotes, 96 comments — drove home the scale. Comments ranged from "every shared host running cPanel just became an incident" to debates about whether the PHP Foundation's consensus-based security process is fit for the AI era. > ℹ️ watchTowr was the first external party to publicly confirm the vulnerabilities were real, publishing their analysis on October 20 before the embargo officially lifted. Their assessment: "no configuration-only workaround fully closes the issue." The Wiz team's podcast deep-dive with researchers Sagi Tzadik and Thai Duong (Calif) is worth the listen — it covers how AI agents handled the version-specific exploit adaptation that would have taken human researchers months in a lab.  View on Latent Space → The Arms Race in Numbers The broader context makes PHP2Shell's significance clear. This isn't the first AI-assisted vulnerability discovery — it's the one that broke through to mainstream awareness. Google's Big Sleep project found an exploitable SQLite flaw (CVE-2025-6965) before it reached an official release in late 2025. In April 2026, Anthropic's Project Glasswing reportedly uncovered over 10,000 high-or-critical vulnerabilities using Claude Mythos Preview. In May, Google's Threat Intelligence Group documented the first in-the-wild AI-generated zero-day exploit — a 2FA bypass with telltale LLM fingerprints in its code. In June, autonomous security startup depthfirst found 21 previously unknown FFmpeg vulnerabilities for roughly $1,000 in compute. OpenAI has released increasingly permissive models for security research. GPT-5.5-Cyber launched in June 2026 with Patch the Planet. GPT-5.6-Cyber followed in August with "reduced safeguards for exploit development" — completing 95% of advanced cyber requests versus 1.5% for the base model. Trusted partners including CrowdStrike, Cloudflare, Palo Alto Networks, and IBM received access through Daybreak Red. The numbers tell the story of a capability curve going vertical. But capability without process is just a faster way to find bugs nobody patches. {% youtube pLaZFgpAFUU %} What This Means for You If you're a builder, a security lead, or anyone running infrastructure, PHP2Shell crystallizes a new operational reality: 1. Patch timelines are now measured in hours, not days. AWS's recommendation is blunt: "Measure patch and mitigation timelines for critical internet-facing vulnerabilities in hours." The Oct 17 exploitation — four days before disclosure — means your window starts before you even know there's a window. 2. WAF-first, patch-second is the new order of operations. Cloudflare's pre-disclosure WAF deployment saved countless sites. If your stack doesn't include a WAF that can receive emergency rules from vendor threat intelligence, you're structurally behind. 3. AI-speed disclosure changes severity triage. When an AI model finds a bug, the disclosure-to-exploit timeline compresses. Treat AI-assisted advisories as inherently higher urgency. A traditional 90-day disclosure window assumes human-speed discovery on the attacker side. That assumption is dead. 4. End-of-life software is now an active emergency. PHP 7.4 through 8.1 have no official binary patches. With a public PoC sporting 900+ GitHub stars, running EOL PHP on the public internet is the equivalent of leaving your front door open with a sign that says "free stuff inside." 5. Monitor the pre-disclosure window. Amazon's MadPot IOCs date to October 17. If you haven't checked your PHP logs back to mid-October, do it now. The indicators: unusual multipart requests followed by memory-limit errors, malformed PHPSESSID cookies, unexplained PHP worker churn, and suspicious files in web roots. > 💡 Immediate action checklist: Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Restart all PHP workers after updating. Deploy WAF rules targeting multipart upload exploits. Hunt for IOCs backdated to October 17. Audit for EOL PHP instances and isolate or upgrade. Set session.upload_progress.enabled=0 as a temporary stopgap (this does NOT close all paths). The Bigger Picture PHP2Shell is not an isolated incident. It's the clearest signal yet that we've entered an era where AI finds bugs faster than humans can fix them. The Cloud Security Alliance puts it starkly: in Anthropic's Project Glasswing, fewer than 1% of the vulnerabilities Mythos found were actually patched. The bottleneck isn't discovery. It's remediation. OpenAI's Patch the Planet is one attempt to close that gap — pairing AI discovery with human-led patching at scale. Trail of Bits engineers review every finding. Calif and HackerOne handle triage and coordinated disclosure. It's the right architecture: AI finds, humans verify, humans fix. As of October, the program has reviewed 50 codebases and merged 160 patches upstream — a meaningful start, but a drop in the bucket against 66,000 projected CVEs. But the PHP Foundation's own post-mortem reveals the fragility. A two-year delay between first noticing the OOM pattern and shipping a fix. A consensus-based security team that couldn't agree on trade-offs. A coordinated disclosure that leaked from three directions simultaneously. The new Ecosystem Security Team, formed in May 2026, is a step forward — but it took a CVSS 9.2 internet emergency to force the structural change.  View discussion on Hacker News → The defender's toolbox got a major upgrade with AI-assisted discovery. The defender's process didn't keep pace. As Wiz put it: "It marks an AI inflection point." The question is whether the organizations that depend on PHP — which is to say, most of the internet — can operate at inflection-point speed. If your organization's security posture still assumes human-speed vulnerability discovery on both sides, PHP2Shell is the wake-up call. The attackers have AI too. And as the October 17 exploitation shows, they may already be ahead. For more on supply-chain security in the AI era, see our coverage of the LiteLLM supply chain attack and OpenAI's API dependency risks. Originally published at ComputeLeap
For anyone curious about how an actual POC might work for the recent #PHP vulnerabilities, here is a full report along with POC written in Python. #php2shell eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
For anyone curious about how an actual POC might work for the recent #PHP vulnerabilities, here is a full report along with POC written in Python. #php2shell eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
⚠️⚠️ CVE-2026-109618 (CVSS 9.2) + CVE-2026-109619 (CVSS 9.2): "PHP2Shell" — unauthenticated RCE in the PHP runtime itself 🔗FOFA Link: en.fofa.info 🎯229M+ Results are found on en.fofa.info in the past year. FOFA Query: app="php" PoC: eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC 🔖Refer: thehackernews.com #OSINT #FOFA #CyberSecurity #Vulnerability
I am so annoyed… I am trying to verify the claims of this article with my friend Claude but daddy Dario won’t let me because “cyber”. I pointed it at this article and a PoC [1] I found on DuckDuckGo. We live in a stupid world. I can’t run it right now so I am trying to figure out if it’s serious. [1] eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC
🚨Alert🚨CVE-2026-109618 & CVE-2026-109619 (CVSS v4.0: 9.2): Two Pre-Auth Remote Code Execution (RCE) Flaws in the PHP Core Leaked Online Ahead of Coordinated Disclosure. 🔥PoC :eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC 📊 145M+ Services are found on the hunter.how yearly. 🔗Hunter Link:hunter.how HUNTER : product.name="PHP" 📰Refer:cve.tools tenable.com sansec.io thehackernews.com #hunterhow #infosec #infosecurity #OSINT #Vulnerability
@levelsio Already out now eness/php2shell-CVE-2026-109618-CVE-2026-109619-PoC