AI cracked PHP's decade-old flaw in days. A third of PHP sites run branches the patch skips.
Two critical flaws in the language under most of the web were found with frontier models in days and patched on 21 October, and the harder problem is that a third of PHP sites run branches that patch will never reach.
On 21 October the PHP project shipped four new versions of a programming language that runs most of the web. 1 By the next day, government sites in the Netherlands, France, Denmark and Finland had been taken down. 2
Japan's largest bank, its biggest airline and a major railway suspended pages, and the Wikimedia Foundation pulled systems as a precaution. 2
The four releases fixed two flaws that had sat in PHP for more than a decade. 3 PHP runs 69.2% of the websites whose server-side language is known, and every release back to 5.4 carries at least one of the two bugs. 4
The flaws took days to find. Getting the fix into the machines that need it is a slower trade, and that trade now decides how exposed the web is.
What the flaw is
PHP sets memory aside to build each page and releases it when the request finishes. 5 When a request dies halfway, usually by running out of memory, some of that memory survives with internal pointers still aimed at it. A later request on the same worker reads what is lying there. 5
IBM's Patrick Fussell gave CNN the analogy: a hotel room where you check out and your key still opens the door, so you walk back in and find the next guest's belongings. 2
The bugs sit in PHP itself, so the code on top of it does not matter. 5 Wiz's researchers ran unauthenticated remote code execution against the standard container images of WordPress, Drupal and Joomla, and noted that a Hello World page on a vulnerable version is exposed the same way. 3
An attacker who wants data instead of control can read the worker's memory, where passwords, session tokens, API keys and certificates sit. 3
The two are tracked as CVE-2026-109618 and CVE-2026-109619 and scored 9.2 out of 10. 6 CISA lists Apache with mod_php as the riskiest setup, with PHP-FPM, php-cgi, FrankenPHP and LiteSpeed also affected. 7
What the models brought
The root cause was already on file. A 2024 audit of PHP, paid for by Germany's Sovereign Tech Agency and run through OSTIF by Quarkslab, turned up the first trace of the out-of-memory problem. 1 A possible exploit was theorised that year, no working path was found, and the fix went nowhere. 1
Three groups reported it within six weeks of each other in 2026. Calif, a security firm auditing PHP under OpenAI's Patch the Planet programme, started on 30 July and reported unconditional remote code execution on 11 August. 1 Wiz found the same class of bug on 19 August with its Atlas agent, Gemini 4 Argon and GPT-5.6 Sol, and reported on 24 August. 3 OpenAI sent further attack vectors on 18 September. 1
Turning a memory bug into a working exploit was the expensive half of the old job. It meant chaining several bugs and adapting to how each installation arranged its memory. 3
Adapting is what the models do cheaply. Wiz's conclusion: with frontier models and the right tools, "a single researcher completed in a week what previously would have taken a world-class team months of work". 3
Two years to decide, ten weeks to ship
The PHP Foundation's account of the delay is unusually direct. Fixing the out-of-memory bug meant choosing among options that broke backward compatibility, opened a denial-of-service route, or forced changes on third-party extensions. 1 The security team decides by consensus, could not settle on one, and the work "stalled and restarted repeatedly over months". 1
The Foundation calls the delay "a structural failure, caused by both the security team's decision process and its lack of resources". 1
Once the August reports made the impact clear, a small group of funded engineers fixed it across four release branches in about ten weeks, working weekends and around the clock. 1 The results shipped as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. 7
The queue in front of those engineers keeps growing. The PHP security team has published 15 CVEs since 1 July and worked through more than 100 reports that turned out to be invalid, duplicates or not reproducible. 1 AI helps triage them, the Foundation writes, and then the limit: "a person makes every call and works on every patch". 1
Where the fix can reach
Three things decide a site's exposure: the branch it runs, whether the update has been applied, and who controls that decision.
W3Techs counts websites, and finds 26.7% of PHP-using sites on version 7, 7.7% on version 5 and 0.1% on version 4. 4 Fixes exist for 8.2 through 8.5 only. 7 That puts 34.5% on branches the PHP project no longer patches, plus whatever part of version 8 sits on 8.0 and 8.1.
VirusTotal counted IP addresses: about 5.1 million running PHP, of which 1.1 million disclose a version in an HTTP header. 8 Among those, 272,000 run a supported branch, 758,000 run an out-of-support branch between 5.4 and 8.1, and 88,000 run something older. 8 Four in five PHP servers hide their version, which makes the visible estate look far smaller than the real one. 8
Censys counted 2.58 million internet-facing hosts on the same day. Of the 1.58 million that disclosed a version, about 1.57 million were unpatched. 9 VulnCheck saw more than 2.6 million hosts running PHP, nearly all of them vulnerable. 9
Qualys worked from anonymised data across 12,000 customers and counted about 155 million instances. 9 Of those, 110 million, or 71%, run versions 5.4 to 8.1 that will never receive a vendor patch, and 44 million run supported branches where a fix was available. 9 In the first 12 hours after disclosure, 199,000 instances had been patched. 9
Four counts, four units, a hundredfold spread: websites, IP addresses, hosts, customer instances. They agree on the shape. The patch exists, and most of the base cannot take it.
Who applies it depends on where the site lives. 5 On a managed platform, the provider sets the PHP version. On a rented server, the host does. Distribution packages get the fix from the distributor, and a machine you built yourself is yours to update. 5
Cloudflare's guidance for anyone whose PHP is managed by a hosting provider is to ask that provider to apply the security update. 5 Distributors and long-term-support vendors had the patch before the release, so their users could update on the day. 1 OpenAI published a version checker as a Codex skill for operators working out what they are running, and put $1 billion of subsidised model access behind a programme for defenders with limited security budgets. 10
Two days when the embargo broke
Coordinated disclosure runs on a shared date, and this one slipped.
At about 15:00 UTC on 20 October, both CVE identifiers appeared on forums and social media with a wrong release time and a severity of 10.0, where the real score is 9.2. 1 The PHP project moved its pre-announcement to 19:30 UTC and pulled the release forward from 22 October to 21 October. 1
Around 20:00 UTC, Calif published a video of its proof of concept working against several targets, by mistake, and copies spread. 1 At 07:41 UTC on release day, Chainguard published built images containing the fix, more than six hours ahead of the coordinated release. 1
The embargo barely covered the timeline. Amazon's threat intelligence found a PHP2Shell exploitation attempt dated 17 October in its honeypot telemetry, four days before the patch, from an address on a commercial anonymisation network. 11 How the actor obtained exploit information under embargo remains unknown. 11
Cloudflare's chief executive, Matthew Prince, described the ramp on his network: thousands of attempts in the 10 hours before the announcement, tens of thousands in the 45 minutes after, hundreds of thousands within two hours, millions by Thursday. 9
What the attackers have managed so far
The record holds attempts, and no confirmed compromise.
CISA said on 23 October that it had not observed successful exploitation. 7 SecurityWeek reported the same day that several firms have seen exploitation attempts and attackers building tooling, with no break-in confirmed anywhere. 9
Sophos analysed an attempt to install a Mirai-derived botnet through the flaws and found its sample was stopped; the company also corrected an earlier report of successful exploitation. 9 Sansec, which had predicted mass exploitation within 15 minutes of the patch, revised that view two days later: the public exploits fail against default installations. 9
One commercial exploit does reach code execution on production setups. VulnCheck built it for CVE-2026-109618, against x86-64 systems with address randomisation enabled and error display turned off, and offers it to its customers. 9 SOCRadar found an attacker server holding a "one-click" chain for PHP 8.4.26 on Apache; the operator had screened 20 sites, probed 11, and found none that met its requirements. 9
An attacker who takes process memory and stops there leaves little behind. CNBC reported that an organisation without an application security platform already in place would not see the requests. 12 Matt Suiche of Tolmo told CNBC that a company would learn of a breach when its data went on sale. 12
Five checks
- List the PHP you run. CISA notes that PHP is often a component of other software and that its prevalence "may not be directly observable", so start with internet-facing systems and then work through appliances, the marketing site and the intranet. 7
- Compare versions against 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anything on 8.1 or earlier is outside this fix, and CISA's instruction for those systems is to take them offline until they are updated. 7
- Establish who owns the update. Where a host or platform manages PHP, ask in writing which version you run and when the security release will be applied. 5
- If you cannot patch this week, turn off
session.upload_progress.enabled, block or inspect multipart uploads at the edge, and keep the firewall rules enabled. 8 Each is a stopgap, and VirusTotal cautions that the upload-progress switch may miss some vectors. 8 - Narrow what the web process can reach, and hunt back to 17 October. 11 Amazon's guidance for critical internet-facing systems is to measure patching in hours. 11
The remaining work is inventory and a maintenance bill. Models found the bug and helped fix it, and the fix took ten weeks once the decision was made. What no model resolves is a server nobody tracks, a branch nobody supports, or a foundation asking the companies built on PHP to fund the engineers who can read its code. 1
The queue is filling. On 23 October the PHP project published an advisory for a related upload-progress flaw, CVE-2026-115560, which affects even the fully patched 8.5.12 and will be fixed in the next regular release. 5 Former CISA director Chris Krebs told CNBC that 3% of all critical vulnerabilities ever discovered had been found in the previous month. 13
For a reader, the useful question this week is where your own installation sits and who moves it. If either answer is unclear, that is the exposure.
References
- 1
- 2
- 3
- 4
- 5Cloudflare deploys protections against php2shell vulnerability
blog.cloudflare.com
- 6PHP2Shell Exploitation Started Days Before Patches
securityweek.com
- 7
- 8
- 9
- 10
- 11
- 12
- 13
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.