Editorial illustration of PHP server code under a security scan with shield and alert icons, representing the PHP2Shell vulnerabilities

PHP2Shell: Two AI-Discovered PHP Flaws Trigger ‘Patch or Unplug’ Warnings From the NSA and FBI

ByChris Wade

Key takeaway: On October 21, 2026, the NSA and FBI urged organizations to patch two critical PHP flaws — dubbed PHP2Shell — or take affected systems offline. The flaws, CVE-2026-109618 and CVE-2026-109619, were found with AI help and allow unauthenticated remote code execution. PHP powers roughly 70% of websites, so the exposure is enormous.

What happened

On October 21, 2026, the U.S. National Security Agency told organizations to prepare for an emergency update fixing two critical vulnerabilities in PHP — warning that if they could not patch quickly, they should take affected systems offline until fully mitigated. The FBI’s Cyber Division followed within hours, rating both flaws 9.2 on the CVSS scale — the severe end. The NSA called the risk serious enough to require immediate patching across U.S. government departments.

Coverage has nicknamed the pair PHP2Shell. The bugs sit in the PHP core itself, not in WordPress, Drupal, or any plugin — so any application on an affected PHP build can be exposed regardless of how carefully its own code was written, according to an explainer citing the PHP project’s own advisory.

What we know

Remote takeover with no login required. Both CVE-2026-109618 and CVE-2026-109619 let attackers execute code and read server memory — potentially including passwords — without credentials, per CNN’s coverage of the disclosure.

AI found the bugs first. Calif researchers (working with OpenAI) reported the first flaw on August 11; Wiz, the Alphabet-owned security firm, reported the second on August 24 — per Al Jazeera’s reporting. Wiz used Google’s Gemini 4 Argon, Wiz Atlas, and OpenAI’s GPT-5.6 Sol to investigate in hours: “a single researcher completed in a week what previously would have taken a world-class team months of work.”

The bugs hid for over a decade. These memory-management weaknesses went undetected for more than ten years, per The Wall Street Journal and Reuters. That AI found a decades-old flaw in one of the web’s foundational languages — where twenty years of human review did not — is the story’s biggest subtext.

Governments pulled sites offline. Reuters reported government portals, the Port of Rotterdam, and hospital websites going dark in the Netherlands; public networks and schools disabled in Finland and Denmark; and agencies, parliament, and media sites ceasing operations in Belgium while patches were applied. The UK, Singapore, Australia, Canada, and the EU issued advisories. The PHP Foundation shipped fixes the same day — PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 — but PHP 8.1 and older get no official fix.

Disclosure was not clean. Details leaked on Hacker News before the coordinated disclosure, so attackers and defenders learned about the flaws simultaneously — which is why the NSA’s warning was so blunt, and why the agency says it is now prioritizing identifying actors who may exploit them.

What is still unknown

“70% of the internet” means the share of websites running PHP, not the share of exploitable servers. Real exposure depends on PHP versions in use — and among servers advertising their version, unsupported branches outnumber supported ones nearly three to one, with no official fix.

It is also unconfirmed how many servers have actually been breached. Cloudflare — which worked with the PHP Foundation, Calif, OpenAI, and Wiz on the response — reported exploit attempts surging into the millions. But attempts are not successful intrusions, and that distinction has not been publicly settled.

What to do now

Update to a patched version — PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 for your branch. On PHP 8.1 or older, upgrade to a supported branch or confirm your host backported the fix. If you cannot update quickly, the NSA’s advice is unusual but explicit: take the system offline until you can. There is no complete workaround — updating is the only full fix.

Analysis: AI found it first — and that cuts both ways

PHP2Shell is the clearest real-world demonstration yet of AI as a defensive superpower: a decade-old bug in the internet’s plumbing, found in hours. But the same week, reporting showed a single actor using autonomous AI agents to breach more than 100 company sites for roughly $50 each. OpenAI acknowledged the double edge: while AI caught these decades-old human coding errors first, “the same capabilities can also help attackers rapidly develop offensive tools.” Watch next: NSA threat-hunting disclosures, confirmed exploitation reports, and whether AI-assisted discovery finds more decade-old flaws in other foundational software.

Frequently asked questions

What is PHP2Shell?

PHP2Shell is the NSA’s nickname for two critical vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — in the PHP language core. Both are rated 9.2 (severe) on the CVSS scale and can let attackers run code on a vulnerable server without logging in. The flaws are in PHP itself, not WordPress or any plugin, so every site on an affected PHP build was potentially exposed.

How were the PHP2Shell flaws discovered?

With AI help. Calif researchers (working with OpenAI) reported the first flaw on August 11, 2026, and Wiz researchers reported the second on August 24. The teams used models including Google’s Gemini 4 Argon, Wiz Atlas, and OpenAI’s GPT-5.6 Sol — investigating in hours what Wiz says would have taken a world-class human team months.

Which PHP versions are affected, and how do I fix it?

Update to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 for your branch. PHP 8.1 and older are end-of-life with no official patch — upgrade or confirm your host backported the fix. If you cannot update immediately, the NSA advises taking the system offline until you can, since there is no complete workaround.

Are attackers already exploiting PHP2Shell?

Cloudflare reported exploit attempts surging into the millions, and the NSA is prioritizing identifying actors who may exploit the flaws. But publicly confirmed successful breaches had not been established as of October 23. Attempts are not infections — though the “patch or unplug” guidance assumes exploitation is coming.

Does PHP2Shell affect my WordPress site?

The flaws are not in WordPress itself, but most WordPress sites run on PHP — so your site is affected if its host runs a vulnerable version. Check Tools → Site Health → Info → Server in your WordPress dashboard, or ask your host. If the host has patched, there is nothing further to do — but verify rather than assume.

Sources


Similar Posts