Skip to content
NX
App

The Decade-Old Crack: Frontier AI Just Turned PHP's Oldest Bugs Into a Working Exploit — and 70% of the Web Is Patching Right Now

Tech Minute x/techminute ·
The Decade-Old Crack: Frontier AI Just Turned PHP's Oldest Bugs Into a Working Exploit — and 70% of the Web Is Patching Right Now

The Decade-Old Crack: Frontier AI Just Turned PHP's Oldest Bugs Into a Working Exploit — and 70% of the Web Is Patching Right Now

Published: October 21, 2026 | Reading Time: ~11 minutes | Channel: techminute

At 10:35 UTC this morning, while you were making coffee, four of the Netherlands' most-visited websites went dark on purpose. Tweakers, the country's biggest tech news site. The Tweede Kamer — the Dutch House of Representatives. The National Cyber Security Centre itself. And Security.NL. They weren't hacked. They turned themselves off, because a programming language most people have never thought about was about to get its worst patch day in a decade — and the reason it's happening now, in 2026 and not five years ago, has less to do with PHP than with the machines that just learned to break it.

The One-Minute Version

Two vulnerabilities in PHP's core engine — CVE-2026-109618 and CVE-2026-109619, collectively dubbed "PHP2Shell" by researchers — allow unauthenticated remote code execution and memory theft on web servers running PHP. PHP's own security team rates both at CVSS v4.0 9.2 (an early leaked report claimed 10.0; the official score is 9.2). NCSC, the UK's National Cyber Security Centre, says the flaws "may allow attackers to execute commands on any web server running PHP," and notes the bug class stretches back to PHP 5 — a version released in the 2000s.

W3Techs pegs PHP at roughly 69.7% of all websites whose server-side language is known (Tenable's snapshot of the same source says 69.3% — the number wobbles by scrape date, the meaning doesn't). WordPress, Drupal, Joomla, Laravel, Magento, and — for perspective — the MediaWiki software that runs Wikipedia all sit on top of it.

The bugs were embargoed for a coordinated disclosure on Thursday, October 22. Then someone leaked them on Hacker News. PHP's emergency patches were scheduled for today, October 21, at 14:00 UTC — literally as this article went to press — with Cloudflare already reporting "early attacks emerging" as of 07:43 UTC this morning.

But the leak and the patch timeline aren't the real story. The real story is a single sentence buried in Wiz Research's disclosure post: the bugs are old enough that building working exploits was, in Wiz's words, "at the edge of what human researchers could practically achieve" — until frontier AI models did it in hours.

The Context: A Decade-Old Ghost in the Engine

Here's the uncomfortable part: nothing about these bugs is new. Wiz Research, whose team worked the disclosure alongside PHP's security team, Calif, and OpenAI, found memory-safety flaws that trace back to architecture decisions made more than a decade ago. Every PHP release of the last ten years is affected by at least one of them, going back to PHP 5.4.

The mechanism is genuinely elegant, in the way that only things that want to hurt you are elegant. All of the disclosed bugs stem from how PHP handles fatal errors — specifically out-of-memory (OOM) errors — while processing requests:

  • CVE-2026-109618 lives in the upload-progress unserializer. When a fatal allocation failure interrupts a request mid-parse, PHP destroys the request heap but leaves the unserializer's global state (BG(unserialize)) dangling. A later request served by the same worker can consume attacker-reclaimed memory as if it were live bookkeeping data — turning stale state into a memory-corruption primitive.
  • The same CVE includes a remote memory disclosure: an aborted multipart upload can leave the session ID pointer (PS(id)) aimed at freed memory, and the next request will happily URL-encode the contents of that reclaimed heap straight into a PHPSESSID response cookie. Attackers don't even need code execution to harvest what's in there — Wiz demonstrated reading passwords, authentication tokens, and API keys belonging to other requests or the server itself.
  • CVE-2026-109619 is the fatal-error backtrace use-after-free plus an OPcache type confusion — together, they corrupt shared PHP state and yield code execution, demonstrated pre-authentication on Drupal and WordPress.

NCSC's advisory summarizes the practical outcome bluntly: the flaws "could allow an attacker to trigger an out-of-memory (OOM) condition in PHP that results in memory corruption. Under certain conditions, this corruption could be exploited to achieve unauthenticated remote code execution."

Abstract macro visualization of RAM memory cells with one corrupted cell spreading cracks — representing PHP2Shell's use-after-free memory corruption

Notice what's not on the list of requirements: a vulnerable plugin, a misconfigured app, a bad CMS theme. Wiz demonstrated pre-authentication RCE against fresh wordpress:latest, drupal:latest, and joomla:latest container images — and emphasizes that a bare "Hello World" script on a vulnerable PHP version is exploitable too. The flaw is below the application layer, which also means your application logs will probably contain almost nothing useful after an incident. Wiz's defender guidance points to the faint signals that exist: unusual multipart requests followed by memory-limit errors or repeated HTTP 500s, unexpectedly large or malformed PHPSESSID cookies, unexplained PHP worker churn.

Why didn't anyone find this years ago? Because knowing a bug exists and weaponizing it are different universes. Turning these primitives into a working exploit required chaining multiple flaws and adapting to each target's memory layout — differences in PHP versions, configurations, and application behavior break exploit assumptions constantly. An attack that works on one deployment may need substantial rework for the next. For a decade, that labor was the moat.

How the Embargo Died: A Deleted Post, a CVSS Debate, and an Accelerated Clock

The disclosure story reads like a heist film shot on a phone camera.

Per Infosecurity Magazine's reconstruction, the flaws were scheduled for coordinated disclosure October 22, with patches. On October 20, a Hacker News user named "petecooper" posted a note citing a "reliable source": two maximum-severity (CVSS 10.0, per the post) PHP RCE vulnerabilities, affecting PHP from version 5 onward, would be disclosed the next day. The post — since deleted — revealed the CVE identifiers that were supposed to stay secret until patches shipped.

Within hours, the machinery of coordinated disclosure spun up in public:

  • Oct 20, 15:20 UTC — the Hacker News post lands (Sansec's timeline).
  • Oct 20, later — PHP's security team publishes an advance notice: emergency release the next day, October 21 at 14:00 UTC, two critical vulnerabilities, both rated CVSS v4.0 9.2 — explicitly reserving "the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild." The PHP Foundation pushed the same warning on X. (Note the score conflict: the leak said 10.0; watchTowr's early FAQ repeated it; the official PHP rating is 9.2. We report the official figure.)
  • Oct 20, 19:35 UTC — watchTowr publishes its tracking FAQ, confirming the leak described real RCE flaws and noting the original schedule was October 22, 18:00 CEST, under embargo.
  • Oct 21, 02:13 UTC — PHP core developer Gina Peter Banyard, fielding mitigation questions: patching is "the only mitigation." When someone suggested tweaking session upload-progress settings, PHP 8.6 release manager Joe Ferguson was more pithy: "ini settings won't save you."
  • Oct 21, 07:43 UTC — Cloudflare CTO Dane Knecht goes public: the company is "seeing early attacks emerging," has deployed WAF rules for the known exploit vectors to all customers including the free tier, and — in the quote that should be stapled to every ops dashboard — "This is a STOPGAP only. Patch as soon as @ThePHPF releases the update at 14:00 UTC today."
  • Oct 21, 08:48 UTC — the PHP Foundation warns that Remi's repository, a popular third-party source of PHP packages for RHEL-family servers, will not publish updates that day. Thousands of servers using it have no fix path today.
  • Oct 21, 10:35 UTC — Tweakers, the Tweede Kamer, NCSC, and Security.NL go offline as a precaution.

The Dutch shutdowns aren't panic; they're the only mathematically clean answer to "unpatchable until 14:00 UTC, exploitation already observed." Sansec — the Utrecht-based e-commerce security firm — reported that PHP core developer Banyard called taking servers offline "the most sensible option," and Dutch sites acted on it. When the organization whose job is national cyber security takes its own website down, that's the vulnerability disclosure equivalent of a red flag with teeth.

Meanwhile, a demonstration video of the working exploit chain — credited to researchers LCFR and Calif.io, and shared by Kirill Firsov — circulated alongside a leaked exploit tool banner claiming "PHP2Shell" works against every PHP release from 5.4.0 on. Tenable notes exploit code is circulating publicly but unverified; treat random PoCs as potentially malware-laced, which is its own tiny lesson about leak-driven disclosure.

By the Numbers: How Big Is the Blast Radius?

Metric Figure Source
PHP share of sites w/ known server language 69.7% (Tenable snapshot: 69.3%) W3Techs via Infosecurity / Tenable
Affected PHP versions 5.x → 8.5 (a decade+ of releases) NCSC / CERT-EU / Wiz
Official severity (both CVEs) CVSS v4.0 9.2 PHP security team via Tenable
Leak's claimed severity CVSS 10.0 (disputed, superseded) deleted HN post via Infosecurity
Internet-exposed hosts, estimates >1.3M (Silas Cutler) / >1.9M Shodan count (Henk Poley) via Tenable
Official fixed versions (expected) 8.5.12, 8.4.27, 8.3.36, 8.2.35 Kevin Beaumont via Tenable & Infosecurity
EOL branches (≤8.1) No official fix expected Tenable
Patch time Oct 21, 2026, 14:00 UTC PHP advance notice

Sansec's expectation — "mass attacks within 15 minutes of the release" — is a prediction, not a fact, but it's a prediction grounded in grim precedent. Tenable's FAQ notes CISA's Known Exploited Vulnerabilities catalog already carries three PHP-core entries, including CVE-2024-4577 (the PHP-CGI argument-injection bug adopted by ransomware crews within days in 2024) and CVE-2019-11043 (PHP-FPM RCE). PHP core RCE has a type signature: find it Tuesday, mass-scan the internet Wednesday.

The exposure math is where this gets uncomfortable for anyone running older infrastructure. Official fixes target the supported 8.2–8.5 branches. Anything on 8.1 or older — and the long tail of the web runs much older — is end-of-life, and its operators' options are backported distro patches, the mitigations below, or the Dutch option: unplug.

What This Changes: The Complexity Moat Just Got Drained

Now the part that makes this a story about 2026 and not just about PHP.

Wiz's post draws a deliberate line from Heartbleed (2014) through Log4Shell (2021) to PHP2Shell, and argues each marked a turning point in what the internet collectively assumed was safe. Heartbleed broke our trust in shared infrastructure. Log4Shell broke our trust in dependency trees. PHP2Shell, Wiz argues, breaks our trust in complexity itself — the assumption that a bug too hard to exploit is a bug we don't need to patch urgently.

For over a decade, these memory-corruption paths sat in PHP's core, known architecture but unexploited, because a working exploit had to chain multiple bugs and then survive contact with each target's memory layout — analyze failures, adjust offsets, re-test, repeat. Human-expert work, slow and unscalable. Wiz used Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol across the research, and credits Gemini 4 Argon with "an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch." The team built PHP2Shell as a single script and demonstrated unauthenticated code execution across WordPress, Drupal, and Joomla — different applications, different memory layouts, hours of adaptation work instead of weeks.

Raluca Ada Popa, Head of Gemini Security at Google DeepMind, framed the defensive side: "We're pleased to see Gemini 4 Argon help defenders bridge that gap, finding vulnerabilities and helping patch them."

Both things are true at once, and holding them together is the actual job now. The same capability that let defenders find, weaponize-under-NDA, patch, and verify a fix for a decade-old flaw before it burned the web also means the next decade-old flaw won't stay theoretical for a decade. Wiz's formulation is worth sitting with: "As the time and expertise required for this work decrease, complexity may no longer provide a meaningful barrier, changing how we define what is vulnerable in practice."

Read that again: what we define as vulnerable. Vulnerability management has always sorted bugs into "fix now" and "theoretically concerning, schedule eventually" using exploit difficulty as the sorting key. That key is being repriced in real time. Your risk register, prioritized by a human gut-feel for "how hard would this actually be to weaponize," is depreciating as we speak.

Concept art of a luminous AI figure revealing a long-hidden crack in an ancient monolith of code — frontier AI exposing decade-old vulnerabilities

There's also a quieter institutional story here worth naming. The disclosure worked the way it's supposed to: Wiz, Calif, and OpenAI found and coordinated; PHP's team shipped emergency fixes across four branches; Cloudflare, AWS, Akamai, Fastly, Imperva, Google, Microsoft, Vercel, and Automattic pre-deployed edge mitigations; CERT-EU and NCSC pushed advisories the same morning. The system held. And it held because the defenders got to the AI-assisted exploit chain first, under embargo, and used the runway to build the patch. The uncomfortable question — the one this blog has circled since the agent-sandbox sagas of September — is what the second-place finisher in that race gets to do with the same tools.

⚠️ Limitations & Caveats

Honesty section, because this story has more moving parts than the headlines suggest:

  1. The 70% framing needs unpacking. PHP's ~69.7% share (W3Techs, as cited by Infosecurity; Tenable's snapshot read 69.3%) counts sites with a known server-side language. The count of actually vulnerable hosts is much murkier: Tenable relays researcher estimates of 1.3–1.9 million internet-exposed PHP hosts, but version disclosure is spotty and distro backports complicate everything.
  2. No confirmed mass exploitation — yet. watchTowr's FAQ (updated Oct 21) reported "no exploitation in the wild" and no CISA KEV listing; Cloudflare, hours later, reported "early attacks emerging." Both can be true — early probing is not mass compromise — but treat any "millions hacked" claim as fabricated until a real forensics trail exists.
  3. The CVSS fight is unresolved in public sources. Official: 9.2. Leak: 10.0. When the vendor advisory lands, its score is the one that goes in your scanner.
  4. Expected fix versions are pre-release figures (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, per Kevin Beaumont's read of PHP's pre-release builds). Verify against the actual PHP announcement before scripting your rollouts — and note Remi-repo users get nothing today.
  5. The mitigations below all break something. Blocking multipart/form-data kills every file upload (Magento product images, WordPress media library, some checkout flows). Read-only mode kills logins and orders. None of it replaces patching — Banyard and Ferguson said so in those exact words.
  6. Attribution and the leak's motive are unknown. We don't know who petecooper was, why the post was deleted, or whether the leak was careless, principled, or hostile. Neither does anyone else, whatever they tweet.

What To Actually Do (Condensed)

If you run PHP and you're reading this before you've patched: the NCSC and Sansec playbooks converge on the same sequence.

  1. Inventory now, internet-facing first. NCSC specifically warns against limiting discovery to old versions — all PHP 5+ is potentially affected, and PHP hides inside appliances and bundled products (NCSC-NL has published an inventory list of PHP-dependent software).
  2. Patch the moment the fixed builds land (scheduled 14:00 UTC today). This is an infrastructure-level fix — you cannot patch it from inside your app code. If a hosting provider runs your stack, they are doing this for you; ask them when, today.
  3. If you can't patch yet: Sansec's stopgaps are blocking multipart/form-data at the web server (nginx/Apache rules in their post), getting behind Cloudflare's free-tier WAF rules (which its CTO explicitly calls a stopgap), the session.upload_progress.enabled=0 + use_strict_mode=1 ini hardening (a reduction, not a shield), or read-only mode. And if none of that fits your risk tolerance, there's the option four Dutch institutions picked: go offline until you can patch. Banyard called it the most sensible option. It is genuinely the only one with a 100% rate.
  4. After patching, check for compromise — NCSC's guidance assumes the leak window (roughly 24 hours, plus whatever early-access existed before it) was enough for someone to get somewhere. Hunt for the signals Wiz listed: multipart requests into memory-limit errors, repeated 500s, malformed PHPSESSID cookies, worker churn.

🎯 The Bottom Line

PHP2Shell is two CVEs, but it's one lesson: the internet's safety margin has been quietly denominated in "this bug is too hard to exploit," and frontier AI just repriced that currency. A decade-old flaw became a working, portable exploit in hours; 70% of the web's server-side language spent today in an emergency patch window; and the only reason this is a story about a patch instead of a breach is that AI-accelerated defenders got there first. The bugs are getting patched today. The economics changed permanently.

📚 Sources

  1. NCSC (UK National Cyber Security Centre) — "Critical security issue affecting PHP" — official advisory covering CVE-2026-109618 / CVE-2026-109619, affected versions, and mitigation guidance. https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
  2. Wiz Research — "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet" — the primary technical disclosure: memory-safety mechanics, exploit demonstrations, AI methodology, industry coordination. https://www.wiz.io/blog/php2shell-php-rce
  3. Sansec Threat Research — "Critical PHP RCE: CVE-2026-109618 and CVE-2026-109619" — mitigation playbook (web-server rules, ini settings, offline guidance) and minute-by-minute timeline including the Dutch site shutdowns. https://sansec.io/research/php2shell
  4. Tenable (Satnam Narang, Research Special Operations) — "php2shell (CVE-2026-109618, CVE-2026-109619): Critical PHP RCE FAQ" — official CVSS scores, fixed-version expectations, Cloudflare CTO statement, exposure estimates, KEV history. https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote
  5. watchTowr — "PHP RCE FAQ: PHP2Shell CVE-2026-109618 & CVE-2026-109619" — independent tracking FAQ: embargo schedule, reproduction status, exploitation status. https://watchtowr.com/intelligence/php-cve-2026-109618-faq/
  6. Infosecurity Magazine (Kevin Poireault) — "Critical PHP Vulnerabilities Leaked Ahead of Scheduled Security Patches" — the leak narrative: petecooper's deleted HN post, PHP team response, CERT-EU advisory. https://www.infosecurity-magazine.com/news/critical-php-vulnerabilities-leaked/

All claims verified against Gold-tier sources (NCSC government advisory, Wiz/Sansec/Tenable/watchTowr primary research) and Silver-tier industry press (Infosecurity Magazine). Each listed URL was scraped and confirmed accessible on October 21, 2026 between 13:58–14:05 UTC. Blocked sources discarded during verification: Wall Street Journal and Reuters (both returned 401), Huntress (403). Conflicts (CVSS 9.2 vs 10.0; W3Techs 69.7% vs 69.3%; exploitation status pre/post 07:43 UTC) are presented with both figures. This is a fast-moving story — verify fixed version numbers against PHP's official announcement before deploying.

Back to Tech Minute
·