PHP2Shell: AI Found the Bug First. Patch Before Attackers Catch Up
PHP2Shell is a pair of critical PHP vulnerabilities disclosed on 21 October 2026 that allow unauthenticated remote code execution. If your product runs on PHP, WordPress, Laravel or shared hosting, patch today. The bigger story is that AI found the bug first, and vulnerability discovery is getting cheap.
Key takeaways
- CVE-2026-109618 and CVE-2026-109619, known as php2shell, allow unauthenticated remote code execution in PHP.
- Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Patch first, then verify that every runtime and container actually moved.
- CISA says teams that cannot update immediately, or that run PHP 8.1 or earlier, should take PHP systems offline until patched.
- Calif found the flaw using GPT-5.6 Sol under OpenAI's Patch the Planet initiative, and Wiz independently reported both issues.
- AI makes discovery cheaper, so the bottleneck moves to patching. A routine beats a heroic all-nighter.
PHP2Shell is a pair of critical PHP vulnerabilities disclosed on 21 October 2026 that allow unauthenticated remote code execution. If your product runs on PHP, including through WordPress, Laravel or shared hosting, treat this as a same-day patch job. The larger lesson is that AI found the bug before attackers did, and vulnerability discovery is now cheap enough that every small team needs a patch routine.
TL;DR
- CVE-2026-109618 and CVE-2026-109619 allow unauthenticated remote code execution in PHP.
- Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- If you cannot patch immediately, CISA says take PHP systems offline and consider a WAF as a stopgap.
- Calif found the flaw with GPT-5.6 Sol under OpenAI's Patch the Planet initiative; Wiz independently reported both issues.
- Discovery is getting cheap. Coping requires an inventory, a patch process and a rollback plan.
Disclosure: ZeroRaised publishes this analysis and is a launch site for bootstrapped products. Facts come from the linked sources as checked on 26 Oct 2026; ZeroRaised has no commercial relationship with the companies named.
Unauthenticated remote code execution is a flaw that lets an attacker run commands on a server without logging in, which usually means full control of the machine.
What is PHP2Shell?#
CISA describes CVE-2026-109618 and CVE-2026-109619, known as "php2shell", as vulnerabilities that allow unauthenticated remote code execution in PHP (CISA). That is about as serious as a web vulnerability gets: no login, no privileged account, just a request that can lead to code running on the server.
CISA says the flaws affect all PHP installations serving web requests, including Apache with mod_php, which PHP considers the highest risk, plus PHP-FPM, php-cgi, FrankenPHP and LiteSpeed (CISA). This is not one plugin or one framework. It is the runtime much of the web sits on.
Which versions fix it?#
The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (CISA). Patch to one of those branches, then confirm the running process actually changed. A common failure is updating a package on the host while a container image or a second PHP handler keeps serving the old binary.
CISA also notes that PHP is often a component of other software (CISA). The vulnerable PHP may sit inside a CMS, a forum, a billing tool, a helpdesk or an old admin app nobody remembers owning.
What to do today if you run PHP#
Patch first. If you cannot update immediately, or you run PHP 8.1 or an earlier unsupported version, CISA says to take PHP-based systems offline until they are patched (CISA). For a small business that may mean taking a checkout down. The alternative is running known vulnerable code on the internet.
CISA says a web application firewall may provide some protection in the meantime, and that teams should monitor for PHP worker processes launching shells or downloading tools (CISA). A WAF is a stopgap. Assume it can be bypassed and keep patching.
As of publication, CISA said it had not observed successful exploitation, in an alert last revised on 23 October 2026 (CISA). That is not a reason to wait. AIMap's weekly roundup reported that AWS saw exploit attempts on 17 October, four days before disclosure, while the PHP Foundation said it knew of no successful remote code execution; the same roundup says around 70% of websites run PHP (AIMap). Treat those as reported claims, not confirmed incidents.
Why AI finding the bug first changes the maths#
OpenAI says Calif identified a critical flaw using GPT-5.6 Sol as part of its Patch the Planet initiative, that Wiz independently discovered and reported both issues, and that PHP's maintainers led the fixes and release, with the coalition working over the past two months (OpenAI). That is a good outcome: found and fixed before a mass exploit.
OpenAI's framing is pointed. It says "we consider this one of the most impactful security issues in recent memory" and "To our knowledge, frontier AI found these vulnerabilities before attackers did" (OpenAI). It expects "similar findings to increase sharply in the coming months", and it committed $1 billion in subsidised Daybreak access for organisations with limited security resources (OpenAI).
The implication is simple. If finding bugs becomes cheap for defenders, it also becomes cheap for attackers. The scarce resource is no longer discovery. It is knowing what you run, patching it quickly and proving the patch landed. OpenAI shared a PHP version checker as a Codex skill (OpenAI); use it if it fits, but verify the output against your own inventory.
Build a patch routine before the next one#
Handle this with a routine.
- Inventory your PHP. List every runtime, container, host, CMS install and vendor tool that runs PHP, including the ones behind a proxy or an internal login.
- Watch the sources that matter. Follow CISA alerts, the PHP Foundation and your framework's security feed. The PHP Foundation published its own note on the release and on strengthening PHP security (PHP Foundation).
- Stage, test, deploy, verify. Test the fixed version against your app, confirm the running version on every node, and keep a rollback path.
- Have an offline plan. Decide in advance what you will shut down if patching fails. A payment page, an admin panel and a marketing site carry different risks.
- Monitor for the signature. CISA's advice to watch for PHP worker processes launching shells or downloading tools is a concrete detection for your logs (CISA).
- Rotate secrets if you suspect compromise. Our API key rotation guide covers the mechanics. The vibe-coded app security checklist is a useful baseline for teams that shipped fast and skipped hardening. It is not a substitute for patching a critical runtime flaw, but it catches obvious gaps.
What this means for bootstrapped founders#
- You own the patch calendar even when a host owns the server. Managed hosting helps, but confirm the version.
- Know where PHP hides. WordPress, Laravel, forums, billing tools and old admin apps all count.
- Budget time for patching as a recurring cost, not a one-off emergency. How to launch an AI app covers the build side.
- Use a WAF as a bridge, never as the destination.
- Do not assume small means invisible. Automated scanning does not care about headcount.
The Claude Duet analysis makes the point from the other direction. An agent with production access inherits the security of everything it can touch, so the patch routine is part of the product.
Where ZeroRaised fits#
ZeroRaised is a launch and discovery site for bootstrapped products with no institutional VC or accelerator equity. If you have shipped a product and want a clear page that explains what it does, who made it and how to try it, submit your product. The pricing page explains the options, and joining the ZeroRaised newsletter is the easiest way to keep up with what other makers ship.
A listing does not promise traffic. It gives buyers one accurate public description of the product.
Sources#
Frequently asked questions
What is PHP2Shell?
PHP2Shell is the name for CVE-2026-109618 and CVE-2026-109619, two critical PHP vulnerabilities that allow unauthenticated remote code execution. CISA says they affect all PHP installations serving web requests.
Which PHP versions fix it?
The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to CISA. Teams on PHP 8.1 or earlier are on unsupported versions and CISA says those systems should be taken offline until patched.
What if I cannot patch immediately?
CISA advises taking PHP-based systems offline until they are patched. It says a web application firewall may provide some protection in the meantime, and that teams should monitor for PHP worker processes launching shells or downloading tools.
Was PHP2Shell exploited in the wild?
CISA said it had not observed successful exploitation as of publication, in an alert last revised on 23 October 2026. AIMap's weekly roundup reported that AWS saw exploit attempts on 17 October, four days before disclosure, while the PHP Foundation said it knew of no successful remote code execution.
Does this affect WordPress and Laravel sites?
They run on PHP, so the vulnerable layer is the PHP runtime underneath them. CISA notes that PHP is often a component of other software, which is why the patch has to reach the runtime and not just the application code.