A fatal bug that hid in plain sight for fourteen years — found by AI — triggered a rare global emergency mobilization of the internet in late October. On October 21, the PHP development team rushed out emergency security updates for two critical vulnerabilities that allow attackers to run code on servers without any login: CVE-2026-109618 and CVE-2026-109619, collectively dubbed PHP2Shell, each scoring a severe 9.2 on the CVSS scale. With roughly 70% of all websites built on PHP, government sites in Canada, Australia and across Europe went dark as a precaution, and Japan’s Prime Minister Takaichi Sanae personally warned the public.
The most dramatic element of this story is who found it: not a human penetration tester, but AI. Security firm Calif, working through OpenAI’s “Patch the Planet” initiative, used the GPT-5.6 Sol model to audit the PHP source code at scale, surfacing a flaw that human maintainers had overlooked for fourteen years. AI has moved from “writing code” to “finding vulnerabilities and rescuing the internet” — and this is its most iconic real-world demonstration yet.
What Is PHP2Shell, and Why Is It So Dangerous
PHP2Shell refers to two remote code execution (RCE) flaws in the core of the PHP language, affecting virtually every PHP version in existence. “Unauthenticated” means an attacker needs no account or password: sending a specially crafted request to a vulnerable server is enough to gain the power to execute arbitrary commands. The name “PHP2Shell” captures exactly that — attackers can obtain a shell (command-line control) on the server.
According to the official PHP announcement, any deployment “serving web requests with PHP” is affected, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Apache mod_php carries the highest risk — researchers demonstrated an attack that completes the intrusion before the website’s own code even begins running, rendering application-layer defenses useless. Public reporting indicates one of the flaws is a use-after-free memory bug, and that every PHP version since PHP 5 is affected.
Global Response: NSA Warning, Government Sites Go Dark
The coordinated disclosure schedule was derailed when vulnerability details leaked online a day early, forcing PHP to ship patches ahead of plan. A public proof-of-concept exploit soon followed. The US National Security Agency (NSA) issued an unusual public warning urging all operators to update immediately; multiple Canadian government pages were pulled offline for “urgent maintenance”; Australia took down sites including its own cyber-threat advisory portal cyber.gov.au; several European countries enacted preventive blocks. In Japan, Prime Minister Takaichi Sanae briefed the public directly, calling on businesses and institutions to respond without delay.
Security firm Sansec offered a startling prediction: mass automated exploitation could begin within 15 minutes of the patch release. WatchTowr and Huntress say they have not yet observed active exploitation in the wild — but “the entire criminal underground is working out how to weaponize it.” WordPress users should pay particular attention: WordPress core and the overwhelming majority of plugins are written in PHP, making both managed hosts and self-hosted site owners a high-risk group.
How AI Found a 14-Year-Old Bug Humans Missed
The most thought-provoking aspect of this event is how the bug was discovered. Through OpenAI’s Patch the Planet initiative, Calif ran the GPT-5.6 Sol model as a systematic audit over PHP — one of the world’s most widely deployed programming languages. AI agents can tirelessly track memory lifecycles across an entire codebase and cross-reference call paths across millions of lines, ultimately pinpointing a defect that countless human reviews had missed for over a decade.
Credit, however, deserves clarification. Calif later acknowledged that independent researcher @lcfr_hax first discovered PHP2Shell and developed a working exploit as early as August 5; his work persuaded the PHP Foundation to fund fixes for the entire class of bugs. The AI then performed independent verification and a class-wide scan on top of that foundation. In other words, this was a “human researcher × AI agent” collaborative operation — but the fact that AI compressed the cost of searching for an entire bug class by an order of magnitude is undeniable.
Immediate Action Checklist for Site Owners
If your site runs on PHP, take these steps now:
- Upgrade immediately to the official PHP emergency releases of October 21 — do not wait for your host’s regular update cycle
- Inventory your assets: the real risk for many organizations is not knowing which servers still run old PHP versions — edge devices, legacy systems, forgotten test environments
- Check WordPress: verify your hosting environment’s PHP version; shared-hosting users should confirm the upgrade timeline with their provider
- Deploy WAF rules: until upgrades are complete, use interim rules to filter abnormal multipart requests (the flaw involves the PHP_SESSION_UPLOAD_PROGRESS form-field handling)
- Monitor logs: watch for anomalous request patterns targeting form upload fields — the most likely attack surface currently known
Conclusion: A Watershed for AI-Driven Security
PHP2Shell is likely to be remembered by future security textbooks as a watershed: the first time AI agents surfaced a world-affecting vulnerability in critical infrastructure at this scale, forcing an entire industry to accelerate its response. For operators, the good news is the patch already exists; the bad news is that attackers have AI too. “Patch faster than your adversary” has never been more literally true — go check your PHP version now.
