PHP patches critical PHP2Shell flaws exposed through AI-assisted research

PHP released emergency security updates on October 21 for two critical vulnerabilities collectively called PHP2Shell, following investigations involving Calif, OpenAI and Wiz. The fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both CVE-2026-109618 and CVE-2026-109619 carry a CVSS 4.0 severity score of 9.2. Under the required conditions, an attacker can execute code without authentication; researchers also demonstrated disclosure of sensitive process memory.

Both advisories list earlier releases within those four branches as affected. Researchers traced affected code back to PHP 5.4, making this a runtime problem spanning generations of applications. PHP’s warning covers web deployments including Apache mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. A vulnerable runtime can expose an application whose own code is otherwise secure, but the available attack paths depend on the deployment and request lifecycle.

CVE-2026-109618 concerns what happens when memory runs out. PHP previously used a nonlocal jump to abandon processing, potentially interrupting an operation before its internal request data was fully initialized. Cleanup could then read that unfinished data as though it were valid, causing memory corruption. This is an error-handling and initialization failure. The patch replaces that abrupt exit with a controlled response at a safe execution point, plus immediate process termination at a higher memory threshold.

CVE-2026-109619 concerns internal state that outlives the request owning its memory. A fatal error, or certain shutdown diagnostics, can leave a persistent worker holding a reference to freed storage. Another request reaching that same worker may use the stale value before ordinary initialization clears it. The advisory describes confirmed cases involving PHP 8.5 fatal-error backtraces and session upload progress. Exploitation requires both an operation that leaves state behind and a later operation that consumes it.

Apache mod_php has the highest assessed risk: a demonstrated attack can reach vulnerable processing before any application code executes. PHP-FPM exits a worker when request startup fails, blocking that particular sequence. However, the stale-state advisory confirms an application-dependent FPM path after successful startup, when an interrupted operation leaves state for a later request. The severity metrics identify high attack complexity and additional execution conditions, alongside no required privileges or user interaction.

OpenAI said Calif identified a critical flaw with GPT-5.6 Sol through its Patch the Planet initiative. The PHP Foundation records an August 11 report from Calif researcher Ryan A and an independent report of the same root cause from OpenAI that day. Calif’s account says the researcher’s knowledge of PHP’s vulnerability history helped direct the investigation; the initial discovery did not depend on an unpublished model or a special testing harness.

Wiz independently investigated and reported the vulnerabilities, submitting findings on August 24. Its team used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, crediting Argon with substantial work on discovery, detection and patch validation. Wiz demonstrated attacks against test deployments of WordPress, Drupal and Joomla, plus separate memory disclosure. It described repeated testing and adaptation to different memory layouts, rather than a single exploit that automatically works against every PHP installation.

PHP’s maintainers led the fixes and release. The Foundation said signs of the memory-exhaustion problem had emerged while addressing findings from a 2024 Quarkslab audit organized through OSTIF. Compatibility, performance and extension-related trade-offs had delayed a solution. OpenAI contributed research support and coordination with infrastructure providers, while the Foundation funded engineers working on remediation. The new reports established practical impact for a problem whose earlier exploitation possibilities had remained unproven.

Disclosure accelerated after CVE identifiers began circulating on October 20. The Foundation moved the coordinated release from October 22 at 14:00 UTC to October 21 at 14:00 UTC. It said distributors still needed time to finish packages. Calif then mistakenly posted a demonstration video, later removed, that revealed limited additional details. The fixes and technical advisories are now public.

Cloudflare said default protections reached customers using its free or paid WAF at 03:02 UTC on October 21, and reported attack traffic with attempts to vary payloads. Separately, the Foundation said it had found no functional exploits among the circulating proofs of concept it inspected by disclosure time. These observations do not establish a confirmed count of compromised servers. Cloudflare still called for PHP patching, and PHP states that configuration changes and filtering provide only partial protection.

Distributions and long-term-support vendors received patches in advance and may deliver backported packages. PHP 8.1 and older remain outside ordinary upstream security support, although the project supplied minimal source backports for 7.4, 8.0 and 8.1 because of the severity. Those exceptional source patches do not turn the older branches into supported releases. For hosted applications, remediation therefore depends on the PHP runtime provided by the operator, not merely an update to a content management system.