Global scramble as critical AI-discovered 'PHP2Shell' flaws expose 70% of the web

Global government agencies, corporate networks, and online services scrambled offline on Thursday, October 22, as system administrators rushed to deploy emergency fixes for two critical, artificial-intelligence-discovered security vulnerabilities in PHP, the server-side scripting language powering roughly 70 percent of the internet.

What are 'PHP2Shell' vulnerabilities and how were they uncovered?

Designated as CVE-2026-109618 and CVE-2026-109619, the flaws—collectively dubbed "PHP2Shell"—allow unauthenticated remote attackers to execute arbitrary code and seize total administrative control over vulnerable web servers without requiring credentials.

Rated at a critical severity score of 9.2 out of 10, the bugs stem from deep-seated memory-management errors: an out-of-memory corruption flaw where request cleanup processes partially initialized structures as valid data, and a stale global state flaw where deallocated memory survives across worker execution lifecycles.

According to cloud security firm Wiz Research, the findings represent "among the most severe vulnerabilities discovered in PHP, and arguably in software history". The vulnerable code paths trace back more than a decade to PHP version 5.4, leaving tens of millions of production web deployments and content management platforms such as WordPress, Drupal, and Joomla potentially exposed.

The discovery marks a watershed moment in automated vulnerability research. Calif security researcher Ryan Austin initially uncovered the flaws in August using OpenAI’s GPT-5.6 Sol as part of the "Patch the Planet" code-auditing project. Weeks later, Wiz independently surfaced the same bugs using its Wiz Atlas platform alongside Google's Gemini 4 Argon and GPT-5.6 Sol.

The findings demonstrate the growing ability of frontier AI architectures to audit massive codebases systematically and identify obscure structural flaws that eluded human developers and security researchers for decades.

How did leak occur and which systems have been disrupted?

A coordinated, confidential vulnerability release organized by the PHP Foundation, major cloud providers, and leading Content Delivery Networks (CDNs) broke down prematurely when operational details were leaked to Hacker News on Tuesday, sparking an emergency remediation race. Volker Dusch, a security engineer at the PHP Foundation, described the incident as the most severe crisis PHP has encountered in over a decade, comparing the potential blast radius to the 2014 "Heartbleed" and 2021 "Log4Shell" exploits. Web infrastructure provider Cloudflare acted swiftly to roll out automated web application firewall (WAF) mitigations roughly nine hours ahead of the public disclosure after honeypot sensors detected threat actors probing the vulnerability.

The operational fallout was felt immediately across public and private infrastructure. Australia’s national cyber agency confirmed that its official portal, cyber.gov.au, was temporarily taken offline for emergency remediation, while public-sector domains across the United Kingdom, the Netherlands, and Finland also went dark. The disruption impacted broader private-sector platforms as well, including Wikimedia's developer portal Phabricator, transit management portals, enterprise insurance systems, and mobile backends such as the Pokémon Sleep application.

What emergency mitigations and patching steps are required?

The PHP development team released emergency updates across supported branches, issuing versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to close the execution vectors. However, widespread legacy deployments running unsupported releases—including PHP 8.1 and earlier—do not receive upstream security fixes, leaving millions of servers reliant on downstream Linux distribution backports or urgent software migrations.

Cybersecurity authorities worldwide—including the U.S. National Security Agency (NSA), CERT-EU, and India’s CERT-In—have issued urgent directives instructing administrators to apply official patches immediately, implement temporary runtime mitigations (such as adjusting memory boundaries and disabling upload progress sessions), or sever unpatched web servers from the public internet entirely until remediation is complete.

According to reporting by The Wall Street Journal and BleepingComputer, incident response teams continue to monitor internet backbones for automated botnet campaigns attempting to exploit lingering unpatched servers.