The security flaw that shook the internet this month — known as PHP2Shell — was not just another critical vulnerability discovered in fundamental software. It revealed something unsettling: artificial intelligence is transforming the cycle of vulnerability discovery and exploitation into something radically faster, and PHP2Shell has become the canonical case of this new paradigm.
On October 21, 2026, the PHP project published emergency fixes for two remote code execution (RCE) bugs, each rated CVSS 9.2. What makes this case singular is not the severity of the flaws — which would already sustain articles throughout the week — but the fact that the three groups that discovered them (Calif, OpenAI, and Wiz) all used AI models as an integral part of the process. AI was not an accessory: it was the tool that turned fragmented clues identified in previous human audits into functional proofs-of-concept.
How PHP2Shell Works
The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, reside in the core of PHP's request processing engine. Both exploit the same underlying problem: when a request ends abnormally, PHP can leave its memory state in a corrupted condition that subsequent requests can take advantage of.
CVE-2026-109618 is a heap use-after-free flaw during out-of-memory error handling. When PHP encounters an out-of-memory error, it uses `longjmp()` to exit the current context and abort processing. In some contexts, request memory is temporarily accessible before it is fully initialized. If any allocation fails at that point, PHP does not properly account for the early exit and leaves request memory in an invalid state.
CVE-2026-109619 is even more insidious. It exploits global variables — such as error, session, object, and extension state — that are retained by the worker but point to memory belonging to a request. If a producer leaves request-owned state behind, and a consumer acts on it in a later request handled by the same worker, a use-after-free attack materializes.
PHP validated full remote code execution against Apache mod_php for both flaws. For CVE-2026-109619 specifically, execution was validated against mod_php on PHP 8.5 with the `fatal_error_backtraces` setting enabled, and against both mod_php and PHP-FPM through the session upload progress feature, which is enabled by default.
The History No One Saw: The 2024 Audit
What made PHP2Shell particularly disturbing was what the PHP Foundation revealed in a detailed statement on October 22: one of the vulnerabilities (CVE-2026-109618) had already been identified during PHP's first external security audit in several years, conducted in 2024. The issue was detected, discussed, and then... shelved.
"The PHP security team, operating on consensus, struggled to choose between these options and feared the repercussions of shipping the wrong choice," the foundation explained. "Combined with the lack of a known path to remote code execution and the small team of core developers with the necessary deep knowledge of the engine, occupied with many responsibilities, this decision process caused fix work to stall and restart repeatedly over months."
Engineers debated between backward compatibility breaks, new denial-of-service potential, or the need to change many third-party extensions that seemed impossible to coordinate. The decision not to act was made in the name of stability — and proved to be one of the costliest errors in open-source software history.
AI as Amplifier
The three groups that finally solved the puzzle were Calif, OpenAI, and Wiz. Calif was first to identify the vulnerabilities and create exploits in early August 2026 — partially using frontier AI tools as part of OpenAI's Patch the Planet program, but also with specialized human knowledge of PHP, its dynamics, and weaknesses. Researchers at OpenAI and Wiz (Google's security subsidiary) independently discovered PHP2Shell flaws using AI tools.
The crucial difference between this discovery and previous audits is AI's ability to trace complex dependency chains across millions of lines of C code — something that exhausts human analysts even when the clues are staring at them. The AI did not need to "guess" the bug: it needed to connect them.
Jake Williams, vice president of research and development at Hunter Strategy and a former NSA hacker, noted that "we will definitely see more of these long-life bugs that are in every version of software for the last decade or whatever." But he also observed: "To be honest, I am not really worried. People have been looking with AI for over a year, and it required a highly skilled team to find this one."
Why This Matters for the Internet
PHP runs approximately 80% of the entire internet — from small websites to corporate and government platforms. The CISA issued a known-exploited-vulnerability alert, and hundreds of websites were taken offline by organizations and governments on October 21, including the Dutch water authority Rijkswaterstaat.
According to VirusTotal estimates, more than 5.1 million PHP hosts are exposed online, with about 3.8 million having at least one port open. Censys detected over 4 million hosts and 67 million web properties running PHP.
The most alarming aspect, however, is the timeline: according to Amazon Web Services, hackers began exploiting PHP2Shell on October 17 — four days before the fixes were published. Vulnerability details leaked before public disclosure, and proof-of-concept code was already circulating.
The Future of AI-Assisted Exploits
PHP2Shell is not an isolated event — it is a symptom of a structural shift. As AI tools become more accessible, the cost to transform theoretical vulnerabilities into functional exploits drops dramatically. This benefits both the defensive and offensive sides: security researchers can discover and fix problems faster, but criminals can exploit the same technology to find and attack flaws with less expertise.
The PHP Foundation announced it is strengthening its security processes — including regular audits and improved security triage. But the question is not whether more bugs like this will exist (they always will), but whether the human security team will be able to respond faster than offensive AI finds them.
PHP2Shell shows that in 2026, the greatest risk of a critical vulnerability is not that it exists — it's that AI discovers how to exploit it before someone can fix it.
Sources: WIRED, The Record (Recorded Future), BleepingComputer
✓ Independent sources cross-checked and verified before publishing
