Oct 28, 2026

PHP2Shell: AI helped find critical PHP bugs. Update now.

PHP2Shell is a pair of critical PHP bugs, found by Calif, OpenAI and Wiz with help from frontier AI. PHP 5.4 and later are affected; fixed versions shipped Oct 21, 2026.

Sir Toastimir

Art: Wiz Research, Calif, Cloudflare · anim: agentoast

What happened

PHP2Shell is the name for two critical bugs in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. They affect web servers running PHP 5.4 or later. In the worst case, a specially crafted web request can let an attacker run their own code on the server, read data, or knock the site offline.

Who found it

Calif and Wiz each published write-ups, and OpenAI was part of the coordinated disclosure. The teams say frontier AI models helped them find and analyze the bugs; Wiz says its team used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol. Cloudflare's post also lists Quarkslab among the disclosers.

What to do

PHP released fixed versions on Oct 21, 2026: 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and urges everyone to update now. Cloudflare says details leaked before the official release and it saw attack traffic, so it turned on WAF protection by default for every plan with WAF, including Free.

What we don't know yet

On Oct 23 PHP published an advisory for a rarer related bug, CVE-2026-115560, in the session upload progress feature. It affects patched versions too and will be fixed in PHP's next regular release; until then PHP suggests setting session.upload_progress.enabled=0. How many sites were actually attacked is not known.

Visuals in the video

Images from Wiz Research, Calif and the Cloudflare blog, plus agentoast data cards.