~/ / AI articles / AI helped find PHP2Shell: the critical PHP vulnerabilities of October 2026
AI helped find PHP2Shell: the critical PHP vulnerabilities of October 2026
According to press reports, AI models helped researchers find two critical vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated remote code execution. PHP released fixed versions on 21 October 2026. This article summarizes what the official announcements and the reports say about the flaws and about how AI was involved, and lets you check whether the PHP you run has the fix.
Checked against the official announcements on 2026-10-24. This page is not an official advisory, and the details can change, so follow the sources at the bottom.
What to do first
- Update PHP to a fixed release (8.5.12, 8.4.27, 8.3.36 or 8.2.35), or to the fixed package from your Linux distribution. PHP says there are no complete mitigations and that updating is the only safe choice.
- After updating, restart PHP-FPM, Apache and any long-running PHP workers so that they load the fixed code. A service that started before the update is still running the old code.
- If PHP came from a distribution package, check the full package version, including the part after the first dash. Distributions can include the fix without changing the first part of the number.
- If you cannot update right away, see the mitigations below. PHP says they reduce exposure to specific attack paths but do not make an installation safe.
What happened
On 21 October 2026 PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two critical vulnerabilities, both rated CVSS v4.0 9.2.
CVE-2026-109618, called RCE via OOM corruption: out-of-memory handling can interrupt PHP while internal request data is only partially initialized, and request cleanup may then treat the invalid data as valid.
CVE-2026-109619, called RCE via stale global state: request-owned internal state can survive after its backing memory has been freed, and a later request handled by the same worker may use that stale state.
- CVE-2026-109618 · CVSS 4.0 9.2
- CVE-2026-109619 · CVSS 4.0 9.2
How AI was involved
According to The Next Web, the security firm Calif found the first bug in August with help from an OpenAI model, during an audit of PHP's source code that OpenAI funded. Wiz said it found the flaws independently, weeks later, using AI tools including Google's Gemini models.
The site php2shell.com credits research by Wiz Research, OpenAI Codex Security and Calif. Calif said it used generally available models, and that knowing PHP's history mattered more than the model.
The same article reports that Cloudflare enabled WAF rules for its customers about nine hours before disclosure, and that a proof-of-concept exploit then circulated online. The php2shell.com site says a WAF or CDN rule should not be treated as a substitute for updating PHP.
Timeline
- PHP announces an upcoming critical security release, scheduled for 21 October at 14:00 UTC.
- PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are released with a security advisory, and Ubuntu publishes USN-8948-1.
- PHP publishes an informational advisory about session.upload_progress.enabled, for a further and unlikely vector tracked as CVE-2026-115560.
Who is affected
PHP says all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It considers the risk highest for mod_php, where an unauthenticated request can trigger the attack before any application code runs.
The GitHub advisories list versions below 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as affected. The site php2shell.com, shown as run by Wiz, says affected releases go back to PHP 5.4.
PHP 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, and PHP provided minimal source backports for PHP 7.4, 8.0 and 8.1 for people who build from source.
Fixed versions
A version at or above the fixed release of its branch has the fix. A distribution package is fixed by its package version, so use the second table for Ubuntu and Debian.
PHP's own releases
| Branch | First fixed release |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
Ubuntu and Debian packages
| Distribution | Package | Fixed package version | Notice |
|---|---|---|---|
| Ubuntu 26.10 | php8.5 | 8.5.9-0ubuntu2.1 | USN-8948-1 |
| Ubuntu 26.04 LTS | php8.5 | 8.5.4-0ubuntu1.5 | USN-8948-1 |
| Ubuntu 24.04 LTS | php8.3 | 8.3.6-0ubuntu0.24.04.13 | USN-8948-1 |
| Ubuntu 22.04 LTS | php8.1 | 8.1.2-1ubuntu2.28 | USN-8948-1 |
| Debian 12 (bookworm) | php8.2 | 8.2.35-1~deb12u1 | DLA-4848-1 |
| Debian 13 (trixie) | php8.4 | 8.4.27-1~deb13u1 | DSA-6574-1 |
The tables show only what the official notices list. For other distributions, check your vendor's security notice.
Check your PHP
Pick where your PHP comes from, paste the version text, and the tool compares it with the fixed versions above. It judges only the text you paste. It cannot see which version is running, so also confirm that the service was restarted after the update.
Commands that show the version
php -vdpkg -l 'php*' | grep ^iiapt-cache policy php8.3-fpm | grep Installed
Everything runs in your browser. The text you paste is not uploaded.
If you cannot update right away
PHP lists these measures. It says they reduce exposure to specific attack paths but do not make an installation safe, and that only an update is a complete solution.
CVE-2026-109618
- Set memory_limit=-1, preferably in a way applications cannot override, such as php_admin_value in the FPM pool or Apache configuration. An underlying allocation failure can still reach the vulnerable path.
- Set a low post_max_size: 8M for applications that do not need file uploads, and 32M if uploads are needed. Keep upload_max_filesize below post_max_size.
- Enforce limits at the web server or proxy for decoded request size, input field count, multipart part count, header count and nesting depth.
- Use a container or cgroup limit as an availability boundary. Do not use RLIMIT_AS or RLIMIT_DATA, because they can cause the vulnerable allocation failure.
CVE-2026-109619
- Set session.upload_progress.enabled=0 in php.ini, an FPM pool or the server configuration, and restart every worker. Do not rely on ini_set() or an FPM .user.ini file.
- On PHP 8.5, set fatal_error_backtraces=0 and restart every worker.
- Remove invalid or deprecated settings applied per request that emit diagnostics before initialization. Hiding diagnostics does not help.
- Fix fatal errors and execution timeouts that an attacker can reach.
The 23 October informational advisory
PHP suggests setting session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect against an unlikely further remote code execution vector. If you already applied it from the 21 October advisory, keep it in place.
PHP says the issue can occur only under an unusual combination: an application sets session.serialize_handler to php_binary or php_serialize in its configuration, switches it to php at runtime with ini_set() before session_start(), and session upload progress is still enabled. PHP will publish a full advisory for CVE-2026-115560 with the next release.
What this page does not do
- It is not an official advisory and does not give exploit details. The official announcements and advisories below are the authority.
- It cannot tell whether a system has been attacked. The php2shell.com site notes that the absence of suspicious activity does not establish that a system is unaffected.
- Exposure depends on the version, the configuration and the individual vulnerability. Mitigations can affect how an application works.