The PHP2Shell Fixes Landed After the Window Snapped Shut

PHP shipped emergency builds on October 21 that close two remote-code bugs rated 9.2, after a forum leak blew a planned embargo. The patched releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix CVE-2026-109618 and CVE-2026-109619, the pair researchers nicknamed PHP2Shell.

OpenAI called the find a Defender’s Window: frontier models had beaten criminals to a flaw in the language Wiz says runs 70% of websites. The next 48 hours showed how fast that window shuts for everyone who still had to install a package.

PHP 8.5.12, 8.4.27 and the 9.2 Pair

PHP’s October 21 security advisory says both bugs can let a stranger run code on a server with no login. The project called updating the only safe choice. Risk is highest on Apache with mod_php, where a crafted request can fire before any site code runs. PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are in scope too.

Volker Dusch, AI Security Engineer in Residence at the PHP Foundation, likened the severity to Heartbleed, the 2014 OpenSSL mess that forced a global patch race. Wiz put the same pair next to Heartbleed and Log4Shell, and showed a separate path that reads worker memory, including passwords, tokens, API keys and certificates from other requests.

PATCHED PHP RELEASES

AWS told customers the same version map and said its own services were not hit, though anyone running those PHP builds inside an AWS product still had to move. Laravel Forge warned that its automatic security updates do not patch PHP, because Forge installs the language from a separate package repo.

Why Login Forms Do Not Stop PHP2Shell

The bugs live in PHP’s memory handling and error path, which almost every request touches. CVE-2026-109618 is remote code execution via out-of-memory corruption: if a request hits memory_limit at the wrong instant, PHP can leave half-built internal data and later treat it as valid. On mod_php, that can happen during request startup, so framework middleware, WordPress plugins and input checks never see the request. CVE-2026-109619 is remote code execution via stale global state: a fatal error can leave a worker pointing at memory from a previous request, and the next request on that worker can use it.

Calif traced the earliest path it could exploit to PHP 5.4.0, shipped in March 2012, and said the routes it found work under default settings. The firm confirmed pre-auth code execution on stock copies of the apps below, and on arbitrary PHP scripts in some setups. Wiz showed the same class of attack against current WordPress, Drupal and Joomla container images, then bundled the bugs into one exploit script it also called php2shell.

CONFIRMED PRE-AUTH TARGETS

• WordPress 7.1.2: Calif ran code with no login on a current WordPress install.
• Drupal 11.4.3: Wiz confirmed unauthenticated code execution on August 20, a day after its first find.
• Joomla 6.1.4: Calif and Wiz both used Joomla as a default-config target.
• MediaWiki 1.46.2: Wikipedia’s own engine sat on the same PHP paths.
• Store and mail stack: Magento 2.4.9, Roundcube 1.7.4, phpMyAdmin 5.2.3, Nextcloud 35.0.1, Laravel 13.11, Symfony 8.1 and WHMCS fell in Calif’s tests too.

Partial config tweaks exist. PHP lists memory_limit=-1 against the out-of-memory path, session.upload_progress.enabled=0 against the session path, and fatal_error_backtraces=0 on PHP 8.5. None of those is a complete substitute for the update, and each one has a cost, including the loss of a memory cap that normally stops a runaway script.

The 2024 Audit Left the Crack Open

The OOM problem was not a 2026 surprise. In 2024 the PHP Foundation funded its first external core audit in years, through OSTIF, with Quarkslab doing the work and the Sovereign Tech Agency paying. While fixing one of Quarkslab’s findings, a core developer contracted by the Foundation saw the first signs of the out-of-memory flaw that became CVE-2026-109618. A possible exploit was sketched. No concrete remote-code path turned up, and other bugs with clearer impact took the queue.

Fixes collided with compatibility, new denial-of-service risk, and the need to change third-party extensions. The security team works by consensus, and it could not pick a path. Work stalled and restarted for months. The Foundation later called the 2024 delay a structural failure, caused by that decision process and by a shortage of people who know the engine.

We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources.

The PHP Foundation, October 21, 2026

Calif, invited in through OpenAI’s Patch the Planet program, started an audit on July 30, 2026. Researcher Ryan Austin, also known as Ryan A, reported an unconditional remote-code path with that same 2024 root cause on August 11. OpenAI reported the same root cause the same day. Wiz, using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, found the first bug on August 19, confirmed Drupal the next day and WordPress on August 21, and reported on August 24. OpenAI sent more attack vectors on September 18. From August 11 the Foundation made the fix the top job for everyone it had on security, including weekends.

The same period flooded the project with AI-written reports. Alexandre Daubois, who joined in July to help the security team, said the group had published 15 CVEs since July 1 and had worked through more than 100 reports that were invalid, duplicates, or not reproducible. A person still makes every call and every patch.

Two Months of Coordination Meet a Forum Leak

OpenAI spent those two months assembling maintainers, researchers and security vendors, and said the wait was needed because the fix required a major change to the PHP engine. In its disclosure post it called PHP2Shell one of the most impactful security issues in recent memory, and an example of a Defender’s Window: to its knowledge, frontier AI had found the bugs before attackers.

OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.

Over the past two months, we led a coalition of maintainers, researchers,…

— OpenAI (@OpenAI) October 21, 2026

The same post admits the other edge of that window. The models that found the bugs can also help attackers build tools and exploits fast. OpenAI said these PHP flaws are among several serious issues it has already found, and that it expects similar findings to increase sharply in the coming months. It committed $1 billion in subsidized Daybreak access for under-resourced defenders, and published a five-stage plan for the next internet-scale bug.

The joint process held until two days before the original ship date. Then it did not.

THE 48 HOURS BEFORE THE PATCH

1. October 20, 2026, about 15:00 UTC: The two CVE identifiers begin circulating on forums and social media with a wrong release time and a wrong CVSS score of 10.0. The Foundation says no technical details leaked in that first burst.
2. October 20, 19:30 UTC: PHP brings its pre-announcement forward and moves the release from October 22 at 14:00 UTC to October 21 at 14:00 UTC, so distributors still packaging the fix are not left behind.
3. October 20, around 20:00 UTC: Calif mistakenly publishes a video of its proof of concept against several targets. Copies of the deleted clip spread, and the Foundation says that sped up other proof-of-concept work on October 21.
4. October 21, 03:02 UTC: Cloudflare turns on web application firewall rules for every customer, free plans included, and later says it watched attackers mutate payloads against those rules.
5. October 21, 07:41 UTC: Chainguard publishes built images that already contain the fix, more than six hours before the coordinated release. The Foundation says any attacker could then study the patch in binary form while everyone else waited.
6. October 21, 14:00 UTC: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 go out. The security team says it inspected the public proof-of-concept code after the leak and did not identify a working exploit at the moment of disclosure.

That sequence is the joke inside OpenAI’s slogan. Two months of quiet work bought a patch. A deleted Hacker News post, a video that was not supposed to ship, and one distributor jumping the clock spent the public half of the window before most site owners had a package they could install.

Calif Used a Public Model on Purpose

OpenAI’s announcement put GPT-5.6 Sol and Patch the Planet at the centre of the story. A community note under that post pointed readers back to Calif for the first find and the first exploit work. The Foundation’s own credits list Calif first, then Wiz, then OpenAI’s Codex Security team, with Amy Burnett named on the OpenAI side.

Austin’s write-up is cooler still. He said the team did not expect a critical hit, because other labs had already run AI audits on PHP. A few days in, after questions aimed at Stefan Esser’s 2004 memory-limit research, they surfaced the first out-of-memory fatal and the first of three interrupt points that became a WordPress remote-code chain. Esser’s 2004 bug is an earlier member of that class, not these two CVEs. Calif said it used no special harness or exclusive models for the initial discovery, only models anyone could call, plus a long memory of how PHP used to break.

No model is simply capable of unearthing “all bugs” with simple prompts. At least for now.

Calif Research, php2shell write-up

Wiz told a louder AI story. It said a single researcher with frontier models finished in a week work that would once have taken a top team months, because the models could retune the exploit across PHP versions, configs and memory layouts. Raluca Ada Popa, head of Gemini Security at Google DeepMind, said Gemini 4 Argon helped find the bug, build the exploit, detect attacks and check the patch. Both things can be true at once: the models lowered the cost of proving an old design flaw was reachable, and a human still had to point them at the right decade of PHP history.

Pinboard Went Dark With Laravel Cloud

Governments did not wait for a clean rollout. CERT-EU and Britain’s NCSC told organisations to take systems offline where they could not patch at once. The US National Security Agency issued its own alert. In Japan, Prime Minister Sanae Takaichi asked site owners to get ready for the 14:00 UTC builds and said pausing a site was a valid way to cut risk if the update could not land fast.

Operators followed that advice with the lights. Pinboard, the GrapheneOS forum and OBS pulled parts of their sites down. Laravel halted Cloud deployments while it rebuilt on patched images. WordPress told owners to update the runtime and noted that PHP versions before 8.2 no longer receive security fixes from the PHP project. This was the second time in months that AI-found flaws in web software forced a mass update, after the WordPress bugs that were mass-exploited in July.

WHO PULLED TRAFFIC

• Bookmarking and forums: Pinboard and the GrapheneOS forum took pieces of their sites offline rather than wait on a package.
• Creator tools: OBS, the streaming suite, did the same for parts of its web stack.
• Hosting: Laravel Cloud stopped new deployments until patched images were ready.
• Edge cover: Cloudflare turned WAF rules on at 03:02 UTC for free and paid customers, about nine hours before disclosure, and said customers still had to patch.

PHP changes are live. Start patching. https://t.co/MyHFZgOZrc

Huge thanks to coordinated work by @ThePHPF! https://t.co/AjqUb6yqvX

— Dane Knecht 🦭 (@dok2001) October 21, 2026

Dane Knecht, Cloudflare’s CTO, posted that the PHP changes were live and that patching should start. Cloudflare’s own post is blunter: the WAF is extra depth, attackers were already changing payloads, and the flaw is in the runtime. Canada’s Cyber Centre, in its October 21 alert, said a proof of concept was public and that it had not identified active exploitation at that time. On October 22, New Zealand’s NCSC said it was aware of reports of active exploitation. Those are different claims, not one score: probe traffic is not the same as a confirmed break-in, and a national team can hear reports a day after another team has seen none.

By October 22, people who run PHP for a living were still installing the builds, and some boxes stayed down because the hosting provider itself was in maintenance. The harder job, the one that does not fit in a CVE, is finding every copy of PHP that a company forgot it ships, including appliances, CI images and a control panel that never appears in the application inventory.

PHP 8.1 Gets a Source File, Not a Build

PHP 8.1 and older no longer receive updates from the PHP project. Because of the severity, the security team still published minimal source-backports for 7.4, 8.0 and 8.1, aimed at people who build from source or who lack an LTS vendor. It will not ship official binaries for those branches. Ubuntu and other distributions issued their own packages, including for some older releases, which is a different channel from php.net.

That split is the long tail OpenAI’s window does not cover. Shared hosts, forgotten Magento boxes and appliances that bundle PHP will sit on 8.1, 8.0 or 7.4 until a vendor moves, if a vendor still exists. A WordPress update does not touch that runtime. A WAF only sees traffic that passes through it. Direct hits on an origin IP skip Cloudflare entirely.

The Foundation closed its post with a funding ask, not a victory lap. Tools now find bugs faster, for defenders and for attackers, and the report pile will keep growing. What tools cannot do is pick the right fix for a long-standing engine design, weigh the compatibility cost, and review the patch. That takes engineers who know the whole codebase, and the Foundation says there are too few of them. Sponsors, hosts, clouds and governments are the people it named. The German Sovereign Tech Agency paid for the 2024 audit that first saw this crack, then watched it sit until an exploit showed up.

OpenAI wants the next disclosure to run on rails. PHP2Shell is the test that already ran: two months of coalition work, then a forum post, a video, a skipped embargo, and a day of sites going dark while the packages were still in transit. The builds are out. The window is not.

Frequently Asked Questions

Which PHP Versions Patch PHP2Shell?

The fixed builds are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Source downloads and Windows binaries sit on the same php.net downloads page, and Linux distributions plus LTS vendors received the patches in advance so their own packages could land with the public release. Hosts such as Laravel Forge that install PHP from a third-party repo will not pick these builds up through ordinary unattended upgrades; the operator has to update PHP on each server.

Does a WordPress or Plugin Update Fix PHP2Shell?

No. The flaws are in the PHP engine, not in WordPress, Drupal, Laravel or a plugin. On mod_php an unauthenticated request can trigger CVE-2026-109618 during request startup, before application code, so a security plugin that runs inside PHP is sitting in the wrong place. The host or sysadmin has to replace the PHP package, then restart every worker.

What Is the Difference Between CVE-2026-109618 and CVE-2026-109619?

CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) is out-of-memory handling that interrupts PHP while request data is only partly initialised, so cleanup treats bad data as live. CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp) is request-owned state that survives after its memory is freed and is then used by a later request on the same worker. Canada’s Cyber Centre classifies both as use-after-free (CWE-416). The Foundation says remote code execution for the first bug was also confirmed on PHP-FPM through application-level paths, not only on mod_php.

Are PHP 7.4, 8.0 and 8.1 Fixed?

The PHP project is not shipping official binaries for 8.1 or anything older. It did publish minimal source-backports for 7.4, 8.0 and 8.1 so shops that compile PHP themselves, or that still have an LTS vendor, can apply a patch. Some distributions, including Ubuntu, issued their own packages for older branches. Moving to 8.2.35 or newer remains the path PHP endorses.

What Temporary Settings Reduce PHP2Shell Risk?

PHP’s own incomplete list is memory_limit=-1 (set so an app cannot override it, for example with php_admin_value in an FPM pool), session.upload_progress.enabled=0, and fatal_error_backtraces=0 on PHP 8.5, with every worker restarted after the change. Check the live settings from a web request (phpinfo()), not from the PHP command line. Setting pm.max_requests=1 breaks the same-worker requirement that CVE-2026-109619 needs, at the cost of recycling a process after every request. Each measure is partial. The update is the complete fix.