A secret hiding inside the engine of the internet for 14 years. Two critical cracks. One AI that finally saw what thousands of human experts missed. And a 48-hour race that took government websites offline across the world.
This is the complete A-to-Z story of PHP2Shell — the most serious security emergency of 2026, and the first major vulnerability in history that AI found before the hackers could use it.
What Is PHP, and Why Does This Matter to Everyone?
PHP is the programming language that quietly runs most of the modern web. Around 70% of all websites whose technology can be identified are built on it — including WordPress, Facebook's early foundations, Wikipedia, Drupal and Joomla.
In plain words: if the internet were a city, PHP would be the electricity grid. And this week, the world learned that the grid had a hidden broken wire — one that had been sparking, unseen, since about 2012.
The Two Cracks: What Exactly Went Wrong?
Security researchers gave the pair of flaws one shared nickname: PHP2Shell. Their official codes are CVE-2026-109618 and CVE-2026-109619, and both are rated 9.2 out of 10 in severity — near the maximum possible score.
Here is what each bug does, in simple words:
The first crack (CVE-2026-109618): When a PHP server runs out of memory in the middle of handling a visitor's request, it can leave its internal notes half-written. Later, PHP mistakes those broken notes for real ones — and a smart attacker can slip their own instructions into the gap.
The second crack (CVE-2026-109619): Data belonging to one visitor's request can survive after its memory was supposed to be erased. The next visitor handled by the same worker process can trip over that leftover data — and an attacker can arrange for that "leftover" to be a weapon.
The result of either crack is the nightmare scenario of cybersecurity: unauthenticated remote code execution. Translation: a stranger, anywhere on Earth, with no account and no password, could run their own commands on your server — steal databases, read passwords and API keys straight out of the server's memory, plant backdoors, or take the whole machine over.
And here is the chilling part: researchers proved it works even against a simple "Hello World" page. The bug is not in any website's code. It is in PHP itself — which means every application on a vulnerable version was exposed, no matter how carefully it was built.
The Timeline: A 14-Year-Old Secret
~2012 (PHP 5.4): The flawed code enters PHP. It will sit there, release after release, for roughly 14 years.
2024: During a security audit, a PHP core developer spots the first sign of the out-of-memory problem. But no one can prove it can actually be exploited — experts believe it is too complex to weaponize. The fix stalls.
June 2026: OpenAI launches Patch the Planet, a program pairing frontier AI models with human security experts to hunt bugs in critical open-source software.
July 30, 2026: At the PHP Foundation's request, researchers at the security firm Calif begin auditing PHP's source code with OpenAI's GPT-5.6 Sol model.
August 1, 2026: Calif researcher Ryan Austin, working with the AI, identifies the first exploitable vulnerability — and the AI helps build working exploit chains across multiple PHP versions.
August 19, 2026: Wiz Research independently discovers the same flaws, using Google's Gemini 4 Argon, GPT-5.6 Sol and its own Wiz Atlas tool. Within two days, Wiz confirms full takeover of stock WordPress and Drupal installations — no login needed.
August–September 2026: Three separate teams — Calif, Wiz and OpenAI itself — report the flaws to the PHP security team. A coordinated fix begins in total secrecy, because everyone understands the danger: if attackers with AI tools found this first, the damage could be historic.
October 17, 2026: Amazon's threat-intelligence team detects the first known exploitation attempt against a decoy server — four days before the public knows anything.
October 20, 2026: Details leak early on Hacker News, one day before the planned announcement. The race becomes an emergency.
October 21, 2026, 14:00 UTC: PHP releases emergency fixes, and the story becomes public. The patch is enormous — roughly 200 files and more than 10,000 lines of code.
The Attack Wave: 482,342 Requests in 24 Hours
The moment the details leaked, the internet's predators moved. Security firm Imperva recorded, in just the first 24 hours after disclosure:
482,342 attack requests
122,311 separate attack sessions
21,998 websites targeted
103 countries involved
Cloudflare reported seeing early attacks the same day and rushed protective rules into even its free plan. The risk was judged highest for servers running PHP through Apache with mod_php, one of the most common setups on Earth.
Governments did not wait to find out how bad it could get. In the Netherlands, major services went offline as a precaution — including DigiD (the national digital ID system), MijnOverheid, the Dutch House of Representatives' website, Tweakers, and even the National Cyber Security Centre's own site. In Japan, services including Kodmon and Shadowverse: Worlds Beyond went into emergency maintenance, and major hosting companies moved to protect their customers.
One honest note: while the attack attempts are counted in the hundreds of thousands, the number of confirmed successful breaches is still unclear. The world was attacked at enormous scale; how many doors actually broke open is a question investigators are still answering.
"The Most Severe Vulnerability Ever Found by AI"
The human story inside this emergency is just as remarkable as the technical one.
A PHP developer had seen the first sign of this bug in 2024 — and the world's experts concluded it was practically impossible to exploit. AI proved them wrong. The models did not just point at suspicious code; they helped researchers build the exploit, test it across versions, and later validate the patch.
Wiz co-founder Ami Luttwak called PHP2Shell "the most severe AI vulnerability that was ever found" and said it was likely too complex to have been discovered without AI. Wiz estimates that a single researcher working with frontier AI models did in about a week what might once have taken a team of experts months. A senior PHP Foundation security engineer compared the severity of the flaw to Heartbleed, the legendary 2014 bug that forced a global security reckoning.
This is why PHP2Shell matters far beyond one week of patches: it is the first clear proof that AI has changed the balance of cybersecurity forever — for defenders who use it to hunt bugs, and, dangerously, for attackers racing to do the same.
Is Your Website Affected?
If your site runs PHP and has not been updated, assume yes. The flaws affect every version from PHP 5.4 through 8.5.11, including the versions inside standard WordPress, Drupal and Joomla installations. The bug lives in the PHP engine, so updating WordPress alone does not protect you — the server's PHP itself must be patched.
The fixed versions are:
PHP 8.5 → update to 8.5.12
PHP 8.4 → update to 8.4.27
PHP 8.3 → update to 8.3.36
PHP 8.2 → update to 8.2.35 (and plan your move — this branch stops receiving security fixes after December 31, 2026)
Older branches such as 8.1, 8.0 and 7.4 are end-of-life and received only minimal source backports; 7.3 and older have no fix at all. If your host still runs those, moving to a supported version is now urgent, not optional. Look at the full version number — a server on PHP 8.3.30 sits on a supported branch and is still exposed until it reaches 8.3.36.
What To Do Right Now (Step by Step)
Check your PHP version. In WordPress: Tools → Site Health → Info → Server. Anywhere else, ask your host directly which exact version you run.
Update PHP to one of the fixed versions above — through your host's control panel, your server's package updates, or your VPS tools.
Restart everything PHP touches after updating: PHP-FPM, Apache, and every long-running worker (queues, schedulers, background jobs). An updated file that is never restarted protects nothing.
If you cannot update today, PHP lists temporary measures that block the known attack paths: lock memory_limit=-1 at server level where apps cannot override it, keep post_max_size low, set session.upload_progress.enabled = 0, and on PHP 8.5 set fatal_error_backtraces = 0 — all in server configuration, followed by a full restart. PHP is explicit: these are incomplete. Updating is the only safe choice.
Sit behind Cloudflare if you can and keep its new protective rules on; keep your admin panels behind a VPN or an allowlist until you are patched.
Check for signs of trouble going back to October 17 — the first attacks predate the public announcement, so a quiet server log before October 21 is worth a second look.
Hunt for forgotten PHP hosts — old CMS installs, staging sites and appliances are exactly where attackers look first. Take unused services offline.
The Bottom Line
A bug slept inside the world's most common web language for 14 years. Human experts saw its shadow and judged it harmless. AI looked closer — and found the loaded weapon. Then, in a single leaked day, the whole planet had to patch at once.
PHP2Shell will be remembered for two things: the week the internet held its breath, and the moment everyone understood that the age of AI-versus-AI cybersecurity has truly begun. The defenders won this round because they put AI on bug-hunting duty before the criminals did.
The lesson for every website owner is simple and permanent: keep your PHP current, restart after every update, and never let "it still works" be your security policy — because somewhere out there, an AI is reading code right now, looking for the next 14-year-old secret.
Did this A-to-Z breakdown help you? Share it with one website owner today — the fastest patch is the one somebody hears about in time.#php #ai #webdev #cybersecurity #software #coding #development #engineering #inclusive #community
AI Found the Bug Hiding Since 2012: The PHP Flaw That Shook 70% of the Web Overnight
