Picture this. Almost 70% of websites run on one programming language, and on October 21 its maintainers shipped an emergency fix for two critical holes in it. The php2shell vulnerability (really two flaws traveling together) is the security story of the week. The twist? An AI model helped find it.
So if you run a website, manage one, or pay someone who does, give this five minutes. Here’s what happened, how AI fits in, and what you should actually do about it.
So what actually broke?
PHP is the language behind a huge chunk of the web. Cloudflare, citing W3Techs data, says almost 70% of websites use it. WordPress runs on it. So does this blog.
The two flaws carry the IDs CVE-2026-109618 and CVE-2026-109619, and each one scores 9.2 out of 10 on the CVSS scale. That’s the industry’s standard way of rating how dangerous a bug is, and 9.2 sits firmly in “drop everything” territory.
Here’s the scary bit. The bugs live in the PHP runtime itself, the engine that runs the code. That means an attacker doesn’t need an account, and it doesn’t matter how carefully you built your own site. According to The Hacker News, the flaws reach nearly every PHP version back to 5.4. On setups using Apache’s mod_php, a demonstrated exploit needs just one unauthenticated request.
One of the flaws can also leak memory from the server. That memory might hold passwords, tokens, API keys and certificates from other people’s requests. Not great.
Where does the AI come in?
This is the part everyone’s talking about. OpenAI says security firm Calif “identified a critical flaw using GPT-5.6 Sol as part of our Patch the Planet initiative.” In other words, Calif’s team used an AI model to spot one of the two flaws.
But let’s keep it honest. Wiz Research also found and reported both flaws on its own, and OpenAI’s Codex Security team worked on them too, per The Hacker News. OpenAI also claims that “to our knowledge, frontier AI found these vulnerabilities before attackers did.” It’s a bold claim, and as PPC Land points out, OpenAI’s account doesn’t include any outside verification.
AI helped on the other side of the job, too. Researchers say AI models helped turn the flaws into working exploits. One researcher reportedly did in about a week what would otherwise have taken a team months. Calif adds a reality check, though. It argues today’s models still can’t reliably build exploits like these from old, obscure code without human help.
And the bug itself? It’s old. The vulnerable code had sat in PHP for over ten years, and Calif traced its roots back to PHP research from 2004.
Why the php2shell vulnerability turned into a mess
Disclosure didn’t go to plan. On October 20, a post on the Hacker News forum leaked that both flaws would go public on October 22. So PHP moved its release up a day. That same evening, Calif accidentally posted a video of a working proof of concept.
Cloudflare switched on default firewall rules for its customers at 03:02 UTC on October 21, before the official fix even existed. PHP then published the fixed releases that afternoon. About 20 minutes later, security firm watchTowr reported active exploitation attempts against both flaws. Cloudflare CTO Dane Knecht put it bluntly: “We are seeing early attacks emerging and are updating mitigations as new vectors show up.”
Some organizations didn’t wait around. BambooHR took its service offline in the US, Canada and Ireland as a precaution. In the Netherlands, government services like DigiD and MijnOverheid went dark too, along with the national cyber security center. Still, no source has confirmed a successful break-in at a specific server yet.
Okay, what should you actually do?
Here’s the bit people get wrong. Updating WordPress, Laravel or your plugins won’t fix this, because the bugs sit in the PHP runtime. As Cloudflare’s write-up puts it: “These flaws are in the PHP runtime, so updating website code or a plugin(s) alone does not fix these vulnerabilities.”
The first fixed versions are:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
If you’re on PHP 8.1 or older, the PHP project no longer ships updates for you, so it’s time to move up. After updating, restart Apache, PHP-FPM and any long-running PHP workers. And if a hosting company manages your server, ask them directly whether they’ve applied the fix. Don’t assume.
One more thing. On October 23, PHP flagged a third flaw, CVE-2026-115560, that affects even fully patched releases like 8.5.12. A fix should arrive in PHP’s next regular release, according to Cloudflare. So keep an eye out, because this story isn’t over yet.
Why this probably won’t be the last one
Honestly, the AI angle is good news and a warning at the same time. It’s good news because defenders found these holes first, at least according to OpenAI. Yet it’s a warning too, since the same tools work for attackers. We’ve already written about how AI agent hacking just got cheap, and php2shell shows the flip side of that coin.
OpenAI says it expects “similar findings to increase sharply in the coming months.” Meanwhile, the PHP Foundation admitted that a core developer spotted signs of the memory flaw during an outside audit in 2024. Work then stalled for months. The Foundation called that delay “a structural failure” and says it’s changed how it makes security decisions.
So the bottleneck has shifted. Finding bugs keeps getting faster, while fixing them is still the slow part. That’s a headache for every small team running old code, and we’d bet plenty of small businesses in our region fit that description. If large language models are doing real work now, bug hunting is clearly one of those jobs.
So, is the php2shell vulnerability an AI win?
Kind of. The php2shell vulnerability shows AI can help dig up serious, decade-old bugs hiding in code that most of the web depends on. But it also shows how messy things get once a bug like this goes public, with leaks, early attacks and services going offline.
Our take: AI bug hunting is here, and it’s only going to speed up. The winners will be the teams that can patch in hours instead of weeks. Fast patching used to be a nice extra. Now it’s basic hygiene, like locking your front door at night. So here’s a question for your developer or host today: if another php2shell drops next month, how fast could you update?