AI turns a 22-year-old PHP flaw into a live threat to 70% of the web
Two vulnerabilities in PHP, the language running roughly 70% of the world's websites, carry a critical severity score of 9.2 out of 10 and can be exploited without any login credentials, according to the researchers who validated them. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively called PHP2Shell, sit in the PHP engine itself rather than in any plugin or theme, so a fully updated WordPress, Drupal or Joomla site can still be exposed if its server runs an unpatched PHP version.
The weakness is not new. German security researcher Stefan Esser raised concerns about PHP's internal memory handling in July 2004, and later researchers flagged related problems in 2020 and 2024, with only partial fixes. What kept the flaws largely theoretical was the difficulty of exploiting them: a reliable attack demanded months of specialist work on PHP's memory management. That barrier fell in August 2026, when researchers at Wiz, OpenAI and Calif used AI systems to turn the weaknesses into working exploits in hours, demonstrating attacks against the major content management systems.
Disclosure on 21 October triggered emergency measures. Government systems in several European countries were shut down as a precaution and the Wikimedia Foundation moved to protect its infrastructure, while Amazon Web Services reported suspicious activity dating back to 17 October, four days before the flaws became public. Attempted exploitation does not prove a server was compromised, but the timing sharpened concern about how fast attackers can now move.
The PHP development team released patches the same day. Administrators need PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and PHP 8.1 and older are no longer supported and should be migrated. Security experts stress that patching is the essential fix: firewalls and monitoring reduce exposure but do not replace an updated runtime. Site owners on shared or reseller hosting must confirm with their providers that the server-level PHP has been updated, review logs for unusual requests and unexpected errors, keep verified backups and apply least-privilege permissions with multifactor authentication on administrative accounts.
The episode cuts both ways for AI in security. The same tools that compressed months of vulnerability research into hours can help defenders find flaws before attackers do, but they also shorten the gap between disclosure and exploitation. Patching cycles measured in weeks or months, the researchers' findings suggest, may no longer be fast enough.
