Critical 'php2shell' flaws in PHP found with AI help; websites worldwide urged to patch immediately
Two remote code execution bugs in the PHP engine, which runs a large share of the web, have been fixed in emergency releases as security agencies warn of active attack attempts.
Website operators around the world are racing to install emergency updates after the PHP project fixed two critical security flaws in the core of the programming language, which powers a very large share of websites, including those built on WordPress, Drupal and Joomla.
The flaws, nicknamed "php2shell", are tracked as CVE-2026-109618 and CVE-2026-109619. According to the European Union's computer emergency response team, CERT-EU, both carry a severity score of 9.2 out of 10 and allow an attacker to run code on a server remotely without logging in. Fixed versions were released on 21 October.
Verify a degree in days, not weeks
Employers, embassies and HR teams: get education credentials verified directly with the issuing university.
What went wrong
CERT-EU says one bug involves memory being mishandled when PHP stops a request that exceeds its memory limit, for example during a file upload. The other allows leftover data from one request to be reused by a later request on the same server process. Researchers at cloud security firm Wiz said the problems sit in PHP's engine itself, so even a very simple site running an affected version can be exposed, regardless of the application on top.
Affected releases include PHP 8.5 before 8.5.12, 8.4 before 8.4.27, 8.3 before 8.3.36 and 8.2 before 8.2.35. Older branches that no longer receive official support are also vulnerable; the PHP team has published minimal source fixes for some of them.
AI tools at the centre
The bugs were found with the help of artificial intelligence. Wiz says its researchers used AI models including Google's Gemini and OpenAI's GPT systems, while Fortune reported that AI red-teaming firm Calif separately spotted part of the problem working with OpenAI. Wiz described the episode as "an AI inflection point" for security research.
Attackers have moved quickly. Fortune, citing Cloudflare, reported millions of exploit attempts by the evening of 21 October, and said Amazon Web Services described the flaw as being broadly exploited. CERT-EU said proofs of concept are circulating and that exploitation was likely already under way. Some government agencies in Europe took websites offline as a precaution, according to Fortune.
What site owners should do
CERT-EU and Wiz both say updating PHP to a fixed version is the only complete remedy. Where that is not immediately possible, CERT-EU advises isolating internet-facing systems and applying temporary configuration changes, which reduce but do not remove the risk.
For India, home to a vast number of small businesses, government portals and startups running PHP-based sites, the advice is clear: check with your hosting provider or IT team that servers have been updated, and watch for unusual activity such as repeated server errors.
Hiring? Screen before you sign
Education, employment and identity checks for companies of every size, by an ISO-certified screening team.
Related stories
TechnologyOpenAI says two of its AI agents switched off their own safety monitoring during internal tasks
In one case, an agent removed a monitoring tool and then wrongly told a user it had not, the company disclosed. OpenAI says it is tightening detection and investigating why it happened.
TechnologyJapan launches MMX mission to bring back the first samples from Mars' moon Phobos
JAXA's spacecraft lifted off on an H3 rocket from Tanegashima and is due to reach Mars in 2027, with a capsule carrying about 10 grams of Phobos soil set to land in Australia in 2031.
TechnologyCERT-In warns AI agents accessed data of Indian organisations without being detected
India's cyber security agency said AI agents under testing reached live systems of Indian entities through exposed credentials, and that criminals are using AI tools to speed up attacks.