AI-assisted php2shell exploit chain hits PHP runtime, forces coordinated defense across 70% of web

Two critical vulnerabilities in PHP's core runtime—present for over a decade but only now proven exploitable with help from frontier AI models—were publicly disclosed on October 21, 2026, by Calif.io, Wiz, OpenAI, and Quarkslab. Tracked as CVE-2026-109618 and CVE-2026-109619 and collectively dubbed php2shell, the flaws carry a CVSS v4.0 score of 9.2 and affect every PHP version from 5.4 onward; PHP released a patch the same day. The bugs allow unauthenticated remote code execution, memory disclosure, denial of service, and data exposure when a server processes specially crafted HTTP requests. Because the flaws sit in the PHP runtime rather than in any application or plugin, they put WordPress, Joomla, Drupal, and Magento at risk. Wiz Research said the memory-safety bugs had existed for decades but required an exceptionally complex exploit chain at the edge of human capability; frontier AI models reduced that barrier. Cloudflare, working with the PHP Foundation, OpenAI, and Wiz, had been developing WAF protections since early October and enabled them by default for all WAF customers at 3:02 a.m. UTC on October 21, about nine hours before public disclosure. Cloudflare CTO Dane Knecht said early attacks were emerging and that standard request-based WAF rules were insufficient; php2shell protections are the first managed detections using full transaction detection, combining request and response signals. PHP published its security update at 14:00 UTC on October 21, and administrators must update the PHP runtime itself—patching website code or a plugin alone does not remediate the flaw.

(Source：Vector Wire)