PHP2Shell: The Week AI Changed Exploit Economics

Posted on by
Contents show
PHP2Shell

A critical vulnerability named PHP2Shell sat unexploited in the codebase of PHP, the language powering roughly 70 percent of all websites, for more than a decade because turning it into a working attack was too complex for anyone to bother. In August, a single researcher using frontier AI models completed in one week what a world-class team would previously have needed months to achieve, and the result was PHP2Shell, unauthenticated remote code execution demonstrated against WordPress, Drupal, and Joomla running their latest releases.

The disclosure, coordinated by Wiz Research with the PHP team, OpenAI, and Calif, and patched on October 21, is being compared to Heartbleed and Log4Shell for its reach: two CVEs with severity up to CVSS 9.2, affecting every PHP version released in the past decade back to PHP 5.X, exploitable independently of whatever application runs on top. Even a Hello World PHP application on an affected version is exposed.

The deeper PHP2Shell story is the inflection the researchers named explicitly. The flaw was always there; what changed is that AI collapsed the cost of weaponizing it. That changes the economics of vulnerability management for every organization on the internet, in both directions.

This article explains what the vulnerabilities do, why the reach is so broad, exactly how AI changed the exploitability equation, what defenders must do, and what the Heartbleed comparison gets right.

What the PHP2Shell vulnerabilities actually do

The PHP2Shell bugs are memory-safety issues rooted in how PHP handles fatal errors, and their pattern is worth understanding because it recurs across the four disclosed instances.

When PHP hits a fatal error, particularly an out-of-memory condition, during request processing, the abort can leave the engine's internal state corrupted: a global variable still pointing to memory that was freed when the request's heap was destroyed. A later request handled by the same worker can consume that stale state as if it were live, and what happens next depends on which global was orphaned.

The disclosed instances grouped under CVE-2026-109618 include an upload-progress unserializer use-after-free and a remote process-memory disclosure. The memory-disclosure bug is particularly elegant: a stale session pointer causes PHP to URL-encode reclaimed heap memory into a PHPSESSID response cookie, handing an attacker a region of live worker memory that may contain passwords, authentication tokens, API keys, and certificates from other requests. It works even on applications that never call session_start, which makes it application-agnostic.

The instances under CVE-2026-109619 include a fatal-error backtrace use-after-free and an OPcache type confusion that corrupts shared state across workers. Both were developed into full exploitation chains: the backtrace primitive produced unauthenticated remote code execution against Drupal, and the OPcache confusion produced the same against WordPress.

Wiz combined the PHP2Shell vulnerabilities into a single exploit script and demonstrated unauthenticated code execution against the latest container images of WordPress, Drupal, and Joomla, the three platforms that illustrate the blast radius because they are the most widely deployed.

Why 70 percent of the web is exposed to PHP2Shell

The scale of the exposure follows from where the flaw lives, and the architecture point is worth internalizing because it recurs across the software stack.

PHP is the scripting language behind WordPress, Drupal, Joomla, MediaWiki behind Wikipedia, and countless custom applications, powering roughly 70 percent of websites. The vulnerabilities disclosed are in the PHP engine itself, below the application layer, which means every application running on an affected version inherits them regardless of how well that application is written. A hardened WordPress installation with immaculate code on a vulnerable PHP runtime is exposed, and so is the two-page brochure site on shared hosting.

The version reach extends the exposure. Every PHP release of the past decade is affected by at least one of the issues, back to PHP 5.X, which means systems that have not been updated in years carry the flaw, and systems updated to versions predating the October patch carry it too.

The PHP2Shell ecosystem structure completes the picture. PHP runs across clouds, hosting providers, content-delivery networks, and millions of independently managed servers, and a flaw in the shared engine propagates through all of them simultaneously. That is why the disclosure required a cross-industry response: Automattic, Akamai, AWS, Cloudflare, Fastly, Google, Imperva, Microsoft, and Vercel all prepared guidance, detections, and out-of-the-box mitigations for customers who could not patch immediately.

The consequence for site owners is that application security and platform security are different disciplines, and this event is a platform problem. The only complete remediation is the PHP update itself.

The PHP2Shell AI inflection point

The reason the PHP2Shell disclosure matters beyond its severity is the changed economics, and Wiz's account of it is unusually explicit.

The vulnerable code had been present for more than a decade. Exploiting it required chaining multiple bugs and adapting to how PHP allocates and reuses memory across requests, work that differs by PHP version, configuration, and application behavior, so an exploit that works against one deployment breaks against another and requires fresh analysis each time. Before AI, that adaptation burden was the practical defense: a vulnerability too complex to weaponize reliably functioned as a vulnerability that was not exploited.

The PHP2Shell researchers used Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol throughout, and credited the models with finding the vulnerability, developing the exploits, building attack detections, and validating the patch. Google DeepMind's head of Gemini Security framed the result from the model side: the flaws remained unaddressed for over a decade because discovery and exploitation were incredibly complex, and frontier AI helped defenders bridge that gap.

The PHP2Shell disclosure timeline shows what one researcher with AI assistance accomplished: first discovery on August 19, confirmed unauthenticated RCE against Drupal on August 20, against WordPress on August 21, reported to PHP on August 24, patched and disclosed October 21. A week from discovery to working exploit chains against two of the most deployed platforms on the internet, by a single researcher.

The changed equation cuts both ways, and Wiz named both edges. AI lowers the cost of scaling attacks across deployments, which shrinks the population of theoretically-vulnerable-but-impractical software. The same capability gives defenders a tool to find and fix flaws that survived years of scrutiny before attackers reach them. The race is now between the two costs, and the PHP episode is the first documented instance of both sides moving at once.

The PHP2Shell patch and what site owners must do

The PHP2Shell remediation is unambiguous, and the steps matter because patching the files alone is insufficient.

PHP released patched versions on October 21: the fixes are available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Updating is the only complete fix, because the vulnerabilities live in the engine and the patch eliminates all known variants, including ones Wiz tracked and others likely untracked that fold under the same two CVEs.

After updating, PHP processes must be restarted and containers rebuilt, because the corrupted-state mechanism lives in running workers, and a patched binary started against stale worker state does not clear the exposure. Sites on managed hosting should confirm their provider has applied the update and restarted the runtime, and sites running containers need new images rather than restarted containers from old images.

The detection guidance fills the gap for organizations that cannot patch immediately: unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, unexpectedly large or malformed PHPSESSID response cookies, and unexplained PHP worker churn are the signals Wiz documented. Because the exploitation runs below the application layer, application logs may contain little context, which makes those infrastructure-level signals the primary tripwires.

Cloud and platform customers got a head start: the coordination meant major providers had detections and mitigations ready before the technical details went public, which is the quiet success of the coordinated disclosure process and the reason no mass exploitation wave followed the patch by days.

The PHP2Shell Heartbleed comparison, examined

The comparison of PHP2Shell to Heartbleed and Log4Shell is analytically precise, and examining it clarifies what is the same and what is new.

Heartbleed, disclosed in 2014, exposed a memory-disclosure flaw in OpenSSL, the shared library securing much of the internet, and its reach followed the same architecture logic as PHP2Shell: a flaw in shared infrastructure propagates to everyone downstream. Log4Shell, in 2021, demonstrated the dependency problem: software nobody knew they were running created exposure nobody had inventoried. PHP2Shell shares both properties, a flaw in the language runtime itself and reach across millions of independently managed servers.

What is new is the discovery and weaponization economics. Heartbleed was found by a researcher who understood the code deeply, and Log4Shell's exploit, once demonstrated, was simple enough to replicate widely. PHP2Shell's exploit chains were complex enough to resist a decade of scrutiny, and frontier AI is what made them practical, which adds a dimension the earlier events lacked: the exploitability of known-but-complex flaws is no longer a constant, and every organization's risk model assumed it was.

That assumption is the real casualty of the PHP2Shell disclosure. Vulnerability management has always triaged by severity and exploitability, depatching what is actively exploited and deferring what is theoretically possible. The population of theoretically possible just grew, because the labor that made complexity a defense is now cheap, and the triage calculus has to change accordingly.

The corresponding PHP2Shell opportunity is the one the researchers emphasized: applying the same capability systematically, finding flaws in existing software before attackers and catching new ones before production. The PHP episode is the first public demonstration of that loop closing, discovery to patch in two months with the model contributing at every stage, and the organizations that build it into their security operations will age better than those that treat it as a one-off.

The WordPress ecosystem reality check

WordPress is the demonstration target that gives the PHP2Shell disclosure its practical meaning, and the ecosystem context is worth walking through.

WordPress powers a very large share of all websites, runs on PHP at its core, and is maintained by a security team that participated in the coordinated response through Automattic. The platform's plugin ecosystem multiplies the surface: millions of sites run combinations of plugins and themes that no scan fully inventories, and PHP2Shell's engine-level reach means the inventory question, which sites run which vulnerable versions, is the operational challenge that decides how fast exposure shrinks.

Hosting providers are the acceleration layer. Managed WordPress hosts applied the patch centrally and restarted runtimes for their customers, which protects millions of sites without individual action, and the providers that publicized their patch status converted a security event into a trust signal. Self-managed sites, where the owner updates PHP or not, are the residual population the detection guidance targets.

The lesson generalizes beyond WordPress. Any organization running self-managed PHP, internal tools, legacy applications, appliances with embedded PHP runtimes, should treat the version check as urgent, because the exposure does not care how obscure the application is.

For readers tracking the security story this event belongs to, the frontier cyber model that contributed to the disclosure is examined in our GPT-6 Cyber analysis, the persistent compute infrastructure behind agent-based defense tooling is covered in our Sailboxes analysis, and the platform patch dynamics that mirror this event are unpacked in our GitHub Octoverse analysis.

The PHP2Shell verification loop, step by step

The disclosure process deserves its own walkthrough, because it is the template for how AI-assisted security should work.

Discovery came first, on August 19, when Wiz Research found the initial PHP vulnerability using its own tooling and two frontier models. The next two days delivered the escalation that transformed the finding's severity: confirmed unauthenticated remote code execution against Drupal on August 20 and against WordPress on August 21. The team reported everything to the PHP security team on August 24, and the PHP project acknowledged and began the coordinated fix on September 21.

The patch arrived on October 21, the same day as public disclosure, meaning defenders received fixes at the moment attack details became available rather than after a gap. That synchronization is the coordinated disclosure process working as designed, and it required the model's contribution to patch validation: verifying that the fix eliminated the exploit chains before release, so the patched versions shipped without the variants Wiz had tracked.

The two-month window is the notable measurement. From first discovery to public fix, the cycle ran at a pace that older vulnerability research, with its months of manual exploit development and its slower coordination, rarely achieved. The same acceleration that makes the flaw dangerous in attacker hands compressed the defensive timeline in defender hands, and the PHP episode is the cleanest public demonstration that both clocks now run faster.

What remains open is scaling. One researcher, one codebase, one patched language is a proof of concept; the industry's ambition, as the disclosure itself states, is making that loop routine across the software everyone depends on, finding flaws before production rather than after a decade of exposure.

PHP2Shell guidance for different kinds of site owners

The remediation advice differs by who controls the runtime, and covering the cases prevents the most common post-disclosure mistakes.

Managed hosting customers, the largest group by site count, should verify rather than assume: providers applied the patch centrally, but confirming the current PHP version through a health-check plugin or the host's status page closes the gap between the provider's action and the site's actual state. Most major hosts patched within days of the release.

Self-managed server operators own the full sequence: update PHP to a patched release, restart the PHP process manager, and confirm worker processes are running the new binary. Sites behind load balancers need every backend updated, because the corrupted-state mechanism means a single stale worker can serve the vulnerable path regardless of what its peers run.

Container-based deployments have the most commonly missed step. Restarting a container built from a pre-patch image changes nothing, and the correct action is pulling a rebuilt image whose base includes the patched PHP, then redeploying. Orchestration platforms that pin image digests require the digest update to propagate deliberately.

Organizations that cannot patch immediately, constrained by change windows or vendor dependencies, should apply the detection guidance as an interim measure and treat unpatched state as an active risk with a deadline, because the disclosure means the exploit techniques are public. The platform mitigations from the major clouds and CDNs buy time; they do not replace the update.

Questions readers are asking

Is my website affected by PHP2Shell?

If it runs PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35, or later, no. Any PHP version released before the October 21 patch, back to PHP 5.X, is affected by at least one of the issues, independent of the application running on top.

What do I need to do?

Update PHP to a patched version, restart PHP processes, and rebuild containers from new images rather than restarting old ones. Managed hosting customers should confirm their provider has patched and restarted the runtime.

Has this been exploited in the wild?

The disclosure was coordinated with patches available and platform-level mitigations prepared by major cloud and hosting providers, and the detection guidance exists for organizations that cannot patch immediately. Applying the update remains the only complete remediation.

Why does this matter if my site is small?

The vulnerabilities are in the PHP engine, not the application, so exposure depends on the PHP version rather than the site's size, traffic, or code quality, and the memory-disclosure variant works even on applications that never use PHP sessions.

Sources
Subscription Form