AI-found PHP2Shell flaws in core PHP prompt NSA warning and patch to version 8.5.12

PHP released a patch on October 21, 2026 for multiple memory-safety vulnerabilities in its core engine, nicknamed PHP2Shell. The flaws are grouped under CVE-2026-109618 and CVE-2026-109619. The US National Security Agency warned that sites which cannot be patched immediately should be taken offline until they can be.

Two parties found the bugs independently. Ryan Austin of the security firm Calif found one through OpenAI's Patch the Planet initiative, using GPT-5.6 Sol. Wiz, recently acquired into Google Cloud, used its Wiz Atlas agent along with Gemini 4 Argon and GPT-5.6 Sol. Both worked with PHP on fixes before disclosure.

According to Wiz, the bugs stem from how PHP handles fatal errors, particularly out-of-memory errors, and can leave corrupted internal state that a later request or worker reuses. That can lead to memory disclosure or corruption. Wiz says it chained four bugs into one exploit script and ran it against the latest WordPress, Drupal and Joomla container images without authentication.

Wiz says a simple Hello World application on an affected PHP version can be vulnerable, and that memory reads can expose passwords, tokens and API keys without code execution. Cloudflare deployed WAF rules for all customers, including the free tier, before the patch, and called them a stopgap.

PHP runs about 70% of websites, so a flaw in the engine reaches sites whose own code is sound. WordPress said the issue is not specific to its software and that site owners must patch servers and work with hosts. TechCrunch notes that PHP 8.1 and older are unsupported, so some operators face upgrade work.

The episode also shows AI changing exploit economics. Wiz says the flaws were decades old but hard to exploit, needing a complex chain at the edge of what human researchers could do, and that frontier models let it adapt working exploits across applications in hours. Wiz compares the potential significance to Heartbleed and Log4Shell.

That comparison is contested. Latent Space's newsletter says the degree to which this matches those famous bugs is up for debate and that high-profile cyber disclosures carry some marketing. It also notes that the researcher-reported demonstrations should not be read as an identical, immediately exploitable path on every deployment.

The main question is the patching race. TechCrunch says tens of millions of sites need updates before attackers can exploit unpatched ones, and Cloudflare reported early attacks as it rolled out mitigations. The coverage does not say how many compromises have occurred.

Wiz also says other tracked and likely untracked variants of the pattern exist, though it says the PHP patch fixes the issue at its core in the patched release. Further disclosures from AI-assisted audits of widely used software are likely.