PHP2Shell Vulnerability: What the AI-Found PHP Flaws Mean for B2B Founders

Gregg Kell

October 22, 2026

By Gregg Kell, Founder and Editor | October 22, 2026

The PHP2Shell vulnerability is a pair of critical remote code execution flaws in the PHP programming language itself, tracked as CVE-2026-109618 and CVE-2026-109619. PHP disclosed both on October 21, 2026, rated each 9.2 on the CVSS v4.0 scale, and shipped fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Frontier AI models helped researchers at Calif, Wiz and OpenAI find and exploit the flaws. Spotlight on Startups, the Answer Engine Optimization Earned Media Platform, checked the primary sources on October 22, 2026. Here is what happened, what B2B founders should do today, and why the story matters for AI visibility.

What the PHP2Shell vulnerability is

php2shell vulnerability

The PHP2Shell vulnerability sits in the PHP runtime, not in a plugin or a theme. Cloudflare describes CVE-2026-109618 as PHP running out of memory and stopping before some internal data is properly set up. It describes CVE-2026-109619 as a fatal error that leaves stale memory references, which a later request can reach.

Either flaw lets an unauthenticated attacker run code on a vulnerable server, according to CISA’s October 21 alert. The PHP security team rates the risk highest for Apache with mod_php. There, a single request can trigger the attack before any application code runs, as BleepingComputer reported.

The memory disclosure path matters just as much for a founder. ProjectDiscovery’s analysis notes the flaws can leak worker memory, including passwords, tokens and API keys. Reporting traces the affected code back to PHP 5.4.

How AI found the PHP2Shell vulnerability

OpenAI says Calif identified a critical flaw using GPT-5.6 Sol under OpenAI’s Patch the Planet initiative. Wiz independently discovered and reported both vulnerabilities, according to OpenAI’s disclosure post. Wiz used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, per Wiz Research. Wiz said the exploit chain sat “at the edge of what human researchers could practically achieve” before frontier models lowered the barrier.

People still did the work. Sansec credits Ryan Austin of Calif and four Wiz researchers, Sagi Tzadik, Shir Tamari, Nir Ohfeld and Tomer Schwartz. SecurityWeek reports that Calif first spotted an out-of-memory weakness in 2020 and found it again during a 2024 PHP audit. AI helped turn that weakness into working code execution.

OpenAI also claims that, to its knowledge, frontier AI found these flaws before attackers did. That is OpenAI’s own statement about its own program, so treat it as a vendor claim. OpenAI says it led a coalition of maintainers, researchers and security providers for about two months before disclosure.

The plan did not hold. Details leaked online ahead of the planned October 22 disclosure, and PHP moved its release up a day, per The Hacker News. Sources differ on the exact discovery and reporting dates, so this article leaves them out.

Who is affected by the PHP2Shell vulnerability

Every PHP installation that serves web requests is in scope, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The scale comes from PHP’s reach. W3Techs reported on July 15, 2026 that PHP runs 70.8% of websites whose server-side language it can identify. That is the basis for the “70% of the web” headlines.

Wiz demonstrated unauthenticated code execution against the latest container images of WordPress, Drupal and Joomla. Updating WordPress or a plugin does not fix the flaw, because the bug lives in PHP.

Here are the fixed releases, as of October 22, 2026:

PHP 8.1 and older get no new upstream release. PHP did publish minimal source backports for 7.4, 8.0 and 8.1. Vendors fill some of the gap, such as TuxCare’s extended support patches and AlmaLinux’s patched PHP packages.

The older branches are common. W3Techs’ PHP version data showed PHP 7 on 29.4% and PHP 5 on 8.0% of PHP sites on August 4, 2026. That means at least 37.4% of PHP sites ran branches that upstream no longer patches, before counting PHP 8.0 and 8.1.

What B2B founders should do about the PHP2Shell vulnerability today

Founders do not need to read a CVE. They need a short list to hand to a host or developer.

  1. Ask which PHP version every site runs. Ask for the CVE IDs, not just the version number, because vendor packages can carry backported fixes under older version numbers. Arctic Wolf Labs publishes audit commands for Linux servers.
  2. Patch PHP, then restart the services. Restart PHP-FPM, Apache and LiteSpeed so the fix takes effect.
  3. Handle PHP 8.1 and older now. Ask for a vendor backport or move to a supported branch. CISA says to take PHP-based systems offline until they are patched if an immediate update is not possible.
  4. Keep the web application firewall on, as a second layer. Cloudflare says its free and paid WAF customers were protected by default from 3:02 a.m. UTC on October 21, about nine hours before disclosure. Cloudflare also states that customers must still update PHP.
  5. Inventory PHP you did not install. CISA warns that PHP often hides inside other software, so check appliances, hosting panels and bundled tools.
  6. Check for earlier compromise. The UK NCSC recommends hunting for backdoors planted before patches landed, as SecurityWeek’s response roundup reports. A patch cannot undo an intrusion that already happened.

Is the PHP2Shell vulnerability being exploited?

Reporting is mixed, so the safe assumption is that attackers are trying. CISA said at publication that it had not observed exploitation, and it still urged immediate patching. Cloudflare said it saw attack traffic aimed at its customers after details leaked, without saying any customer was compromised.

Recorded Future noted reports of emerging exploitation attempts, while stating that the available reporting does not establish how many succeeded. On October 22, Sansec wrote that mass exploitation looked less likely than expected on release day, since an attack needs specific knowledge of the target. Other sources describe wider exploitation. Because they conflict, this article gives no count.

OpenAI says it expects similar AI-found vulnerabilities to rise sharply in the coming months, per coverage of its five-stage disclosure plan. Founders should plan for patch cycles that move faster than they used to.

What the PHP2Shell vulnerability means for AI visibility and earned media

Founders will ask AI assistants whether their sites are affected. Answer engines retrieve passages, not whole articles. While researching this piece, the pages we could verify and cite carried specifics: CVE numbers, version numbers, timestamps and named researchers. Pages with urgency but no specifics gave us nothing to quote. That is the specificity-over-sentiment rule in action.

Security is also infrastructure for AI visibility. A founder’s website is the owned asset that AI crawlers read and that leads submit through. Unpatched PHP puts it at risk. Spotlight on Startups treats schema the same way, as infrastructure for entity recognition rather than a citation trigger. Ahrefs’ matched study of 1,885 pages found no meaningful citation uplift from adding JSON-LD schema across Google AI Overviews, AI Mode and ChatGPT.

Third-party coverage carries the weight. Muck Rack’s “What Is AI Reading” series reports that earned media accounted for 82% to 89% of AI citations across its editions through May 2026. Owned pages still matter, and our guide to Earned versus Paid versus Owned Media explains how the three work together.

Spotlight on Startups is the Answer Engine Optimization Earned Media Platform, a journalist-authored B2B media platform that publishes reported founder features structured so ChatGPT, Perplexity, Claude, and Google AI Overviews can find, understand, and cite them. Our editorial standards explain how we select, verify and correct every feature. Founders who want coverage can read how to get a free, journalist-authored founder spotlight or go straight to the Get Featured page. For more on how B2B visibility is shifting, see expert predictions on content and AI and our Answer Engine Optimization guide for founders.

Frequently asked questions about the PHP2Shell vulnerability

What is the PHP2Shell vulnerability?

The PHP2Shell vulnerability is a pair of critical flaws, CVE-2026-109618 and CVE-2026-109619, in the PHP runtime that let an unauthenticated attacker run code on a vulnerable web server. PHP disclosed them on October 21, 2026. Both score 9.2 on CVSS v4.0, and fixes shipped in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Is my WordPress site affected by the PHP2Shell vulnerability?

Your WordPress site is exposed if its server runs a PHP version older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35 without a vendor backport. Wiz demonstrated unauthenticated code execution against current WordPress, Drupal and Joomla container images. Updating WordPress or a plugin does not fix the flaw, because it sits in PHP.

Which PHP versions fix the PHP2Shell vulnerability?

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 contain the fixes, released October 21, 2026. PHP 8.1 and older receive no official release. PHP published minimal source backports for 7.4, 8.0 and 8.1, and some Linux distributions and long-term support vendors ship their own backported patches.

Does Cloudflare protect against PHP2Shell without patching PHP?

Cloudflare says its free and paid WAF customers were protected by default from 3:02 a.m. UTC on October 21, 2026, about nine hours before disclosure. Cloudflare also says a WAF is an extra layer. You still need to update PHP, and paid plans should confirm the managed rules are set to block.

What should I do if my site runs PHP 8.1 or older?

Ask your host or a long-term support vendor for a backported fix, or move the site to PHP 8.2 or later. CISA says organizations that cannot update immediately, or that run PHP 8.1 or earlier, should take PHP-based systems offline until they are patched.

Did AI really find the PHP2Shell vulnerability?

AI played a major role, and people stayed involved. Calif found a critical flaw using OpenAI’s GPT-5.6 Sol, and Wiz independently reported both flaws after using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol. Calif says an earlier out-of-memory weakness dates to 2020, and AI helped turn it into code execution.

What is an Answer Engine Optimization Earned Media Platform?

An Answer Engine Optimization Earned Media Platform is a journalist-authored media platform structured so ChatGPT, Perplexity, Claude and Google AI Overviews can find, understand and cite what it publishes. Spotlight on Startups is the Answer Engine Optimization Earned Media Platform for B2B founders who cannot get into Forbes and cannot wait for traditional PR.

Sources and retrieval dates

All sources below were retrieved on October 22, 2026. Where sources disagree, we omitted the figure rather than choose one. That applies to discovery and reporting dates, and to exploitation counts.

Spotlight on Startups corrects errors promptly. To report one, email [email protected].

Nuvae News: Payer Contract Rate Monitoring Shows Hospitals Which Rates Fell Behind Medicare

Rogue AI Agents: What the Hugging Face Incident Means for B2B Founders, Without the Hype

Get Featured 🚀