PHP2Shell: AI Found the Bug Faster Than We Can Patch

On the morning of October 21, thousands of small business owners opened an email from their web host with the same message: your site is going offline for emergency maintenance. No warning, no date to reschedule. A bug in PHP, the language that runs WordPress and most of the web, could let a stranger take over the server without logging in.

The bug is called PHP2Shell, and the way it was found matters more than the bug. AI models did much of the hunting. A single researcher using them finished in about a week what would once have taken a team months. Then attackers moved faster still: Cloudflare saw tens of thousands of exploit attempts within 45 minutes of the news getting out.

This piece walks through what PHP2Shell is, how AI changed the speed of bug hunting, why the fix still runs at human speed, and what to do if you own a website.

What PHP2Shell Is and How AI Found It

PHP is the server-side language behind about 69% of websites whose language is known, according to W3Techs. WordPress, Drupal, and Joomla all run on it. So when a flaw lives in PHP's core engine, every site built on top inherits it, even if the site's own code is clean.

PHP2Shell is two vulnerabilities. Both are use-after-free bugs, a class of memory error where a program keeps using a piece of memory after it has handed it back. One sits in how PHP tracks upload progress. The other sits in how it builds error backtraces. Both scored 9.2 out of 10 on the current severity scale, and one scored 9.8 on the older one.

Two teams found them independently:

• Calif: researcher Ryan Austin found the first issue on August 1, working inside OpenAI's Patch the Planet program with the GPT-5.6 Sol model.
• Wiz: the cloud security firm found its first issue on August 19 using Gemini 4 Argon, GPT-5.6 Sol, and its own tool, Wiz Atlas.

According to Wiz's technical write-up, the models did more than spot the bug. They helped adapt the exploit to different PHP versions, configurations, and memory layouts, which is the slow, fiddly part of turning a crash into a working attack. The company says one researcher did in a week what used to take a team months.

The New Math of AI Bug Hunting

Put the dates side by side and the problem jumps out. Here is how PHP2Shell moved from discovery to the wild, using Wiz's published timeline and reporting from Fortune:

• Day 0 (August 19): Wiz finds its first flaw.
• Day 2 (August 21): working takeover confirmed against WordPress.
• Day 5 (August 24): reported to the PHP security team.
• Day 33 (September 21): PHP acknowledges and starts a coordinated fix.
• Day 59 (October 17): Amazon's threat sensors log an exploit attempt, four days before disclosure.
• Day 63 (October 21): patches ship and the bug goes public.

Now do the arithmetic. Going from bug to working attack took 2 days. Going from report to patch took 58. That is a ratio of roughly 29 to 1 in favor of whoever is attacking. And the 58 days only covers the PHP team. After the patch ships, every host, agency, and shop owner still has to install it.

Scale makes it sharper. Palo Alto Networks counted 22.6 million potentially vulnerable instances. Even if 95% of them patched in the first week, about 1.1 million servers would still be exposed, and attackers only need one script to try them all.

This is the same pattern behind the WPSplinter router flaw researcher Quentin Kaiser disclosed the same week, where he credited AI models with cutting several months of work to under a week. Finding bugs got cheap. Fixing them did not.

Who Got Knocked Offline

When maintainers say there is "no complete mitigation," the fallback is blunt: unplug the site until it is patched. Plenty of large organizations did exactly that.

• Governments: all French Interior Ministry websites, the Dutch portal Overheid.nl, Finnish public web services, and some Canadian government sites.
• Nonprofits: the Internet Archive briefly shut down, and Wikimedia took many supporting services offline, including its Phabricator bug tracker.
• Games and forums: Japanese titles such as Granblue Fantasy and Umamusume: Pretty Derby, plus forums like 4chan and Something Awful.

None of those outages came from an attack. They came from defenders choosing a few hours of downtime over the risk of a takeover. That trade is what AI bug hunting pushes onto everyone: when a critical flaw drops, the safe move is often to go dark first and patch second.

Attackers, meanwhile, are using the same tools. We covered how AI agents are already breaching companies on their own, and a published patch is itself a map, since comparing the old and new code shows exactly where the weakness was.

What to Do If You Run a PHP Website

If you pay for managed WordPress hosting, your provider has probably patched already. Check anyway. If you run your own server, this is your checklist.

1. Find your version. Run php -v on the server or look in your hosting dashboard.
2. Update to a fixed release. The patched versions are 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Anything older on those branches is exposed.
3. Handle end-of-life versions. PHP 7.4, 8.0, and 8.1 got source patches only, with no official builds. cPanel and CloudLinux shipped backports. If you are on 7.x, this is the push to upgrade.
4. Don't lean on firewall rules. Cloudflare deployed temporary blocking rules, but the PHP team said updating was the only safe choice.
5. Look for signs of a hit. Wiz lists unusual multipart uploads followed by memory-limit errors, bursts of HTTP 500 responses, oversized or malformed PHPSESSID cookies, and unexplained PHP worker restarts.

If you find those signs, assume the server was entered. Rotate database passwords and API keys, and restore from a backup taken before October 17, the first date exploitation was seen.

Why managed hosting just got more valuable

A $5 a month shared plan and a $12 a month self-managed server look similar on a spreadsheet. The difference is who wakes up at 2 a.m. when a 9.8 drops. If you have no one on call, a host that patches for you is worth the markup.

Who Fixes What the Machines Find?

That's the uncomfortable part of this story: discovery now scales with compute, and repair still scales with volunteers. PHP is maintained largely by a small group of people. One of them, Ondřej Surý, personally built installable packages for older PHP versions during the rush.

Programs like Patch the Planet are an attempt to close that gap. OpenAI describes it as pairing AI-assisted research with human review from Trail of Bits, whose engineers reproduce each finding, remove duplicates, and help write patches before anything reaches a maintainer. Participating projects get model access and API credits.

Critics point out the other side. Maintainers already drown in low-quality, AI-generated bug reports, and every false alarm costs the same volunteer hours as a real one. A large language model can flag a thousand suspicious lines of code in an afternoon. Someone who understands the project still has to read each one.

The likely future is not fewer bugs. It is more of them, found faster, arriving in waves. Expect more "Black October" weeks, more emergency maintenance emails, and more pressure on companies to fund the people who maintain the code they run on.

Frequently Asked Questions

What is PHP2Shell?

PHP2Shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, disclosed on October 21. They let an attacker run code on a server without logging in, and they affect PHP versions going back to 5.4.

Did AI really find the PHP vulnerabilities?

AI models played a central role, alongside human researchers. Calif used OpenAI's GPT-5.6 Sol, and Wiz used Gemini 4 Argon, GPT-5.6 Sol, and its own Wiz Atlas tool. Humans still reported, verified, and coordinated the fixes.

Is my WordPress site vulnerable to PHP2Shell?

It is if the server runs an unpatched PHP version. Wiz demonstrated takeovers against WordPress, Drupal, and Joomla. Check that your PHP version is 8.2.35, 8.3.36, 8.4.27, 8.5.12, or later on its branch.

Will AI find more bugs like this?

Almost certainly. The same models that helped find PHP2Shell are available to researchers and attackers alike, and similar AI-assisted finds have appeared in browsers and router firmware. The bottleneck is now patching, not discovery.

Patch Speed Is the New Security Skill

PHP2Shell will be fixed on most servers within weeks. The lesson outlasts it. When AI turns bug hunting from a months-long craft into a week-long sprint, the gap between disclosure and attack shrinks to minutes.

So check your PHP version today, put a name next to "who patches our site," and treat the next emergency maintenance email as routine rather than rare. The machines are going to keep finding things. Your job is to be ready when they do.