PHP2Shell: AI-found unauth RCE in PHP core, already exploited
Two CVEs at CVSS 9.2 hit every PHP build back to 5.4. Wiz and OpenAI's agents found them; fixes landed in 8.2.35, 8.3.36, 8.4.27, 8.5.12.
Copy markdown
Unauthenticated RCE in the engine, not your app
CVE-2026-109618 and CVE-2026-109619 bundle four memory-safety bugs in PHP's core — use-after-frees and an OPcache type confusion that fire when a request dies on an out-of-memory or fatal error. Combined CVSS 9.2: an unauthenticated attacker runs code as your web worker, and one bug leaks passwords, tokens and API keys with no code execution at all.
Patch now: 8.2.35, 8.3.36, 8.4.27, 8.5.12
Fixed builds shipped Oct 21 for every supported branch. PHP 7.4, 8.0 and 8.1 get source-only backports — the project no longer ships them, so upgrade or lean on your distro vendor. Mitigations like memory_limit=-1 and session.upload_progress.enabled=0 are stopgaps only; PHP's maintainers say the patch is the only real fix.
Attacks started before the fix went public
Cloudflare's CTO says they were already seeing exploitation of both CVEs before the patches dropped, and PHP confirmed a working mod_php exploit where one unauthenticated request triggers it before any app code runs. Every version back to PHP 5.4 is affected — a decade of builds across ~70% of the web. Treat internet-facing PHP as a live target.
This was AI's find, end to end
Wiz Research credits Gemini 4 Argon with an 'invaluable' role across discovery, exploit development, detection and patch validation, working with Wiz Atlas and GPT-5.6 Sol; OpenAI and Calif joined on discovery and coordination. The first flaw surfaced Aug 19, and unauth RCE was confirmed on Drupal and WordPress within two days — bugs a decade of human review missed.
Patch the Planet: the agent-security era is here
OpenAI, one of the named discovery orgs, ties this to its 'Patch the Planet' push to aim autonomous agents like Aardvark at open-source code. The takeaway for builders: AI is now surfacing critical bugs in the most-deployed runtimes faster than teams can triage them — your dependencies are getting re-audited whether you asked or not.