The PHP2Shell fallout keeps spreading. On October 22, several security outlets followed up: for the PHP core vulnerability (CVE-2026-109618, CVE-2026-109619) that OpenAI called one of the most impactful security events in recent memory, attackers had already secured a four-day exploitation window before the official patches landed on October 21. The flaw sits in the PHP interpreter's memory handling, allows unauthenticated remote code execution, scores 9.2 under CVSS 4.0, and affects nearly every PHP version serving websites.
Timeline: from AI-assisted bug hunting to global emergency
The discovery process itself bears AI's fingerprints: on August 11, Calif found one of the critical flaws with GPT-5.6 Sol as part of OpenAI's Patch the Planet program; on August 24, Wiz independently discovered and reported both bugs, using Gemini 4 Argon, GPT-5.6 Sol, and its own Wiz Atlas tooling; on September 18, OpenAI's own security team reported them independently as well. The PHP project had planned a coordinated disclosure for October 22, but details leaked on October 20, forcing the four patch releases (8.5.12, 8.4.27, 8.3.36, 8.2.35) forward to October 21. And Amazon Threat Intelligence had already caught exploitation attempts against a honeypot on October 17 — the attackers were four days ahead of the patch. In the first 24 hours after disclosure, Imperva logged 480,000 attack requests and 122,000 attack sessions targeting nearly 22,000 sites across 103 countries; the US NSA, the UK NCSC, and the White House then urged federal agencies and critical-infrastructure operators to assess their exposure immediately.
The impact: this is not just a WordPress problem
The most easily misunderstood point: this is a vulnerability in the PHP language runtime itself, not a bug in some plugin or application. WordPress, Drupal, and Joomla are merely the most visible victims. Per Wiz, every version from PHP 5.4 through 8.5.11 is hit by at least one of the bugs; the PHP project rates Apache mod_php as the highest-risk environment, because a demonstrated attack succeeds with a single unauthenticated request before any application code runs. Beyond code execution, the flaw can read server memory Heartbleed-style — passwords, tokens, and API keys can leak out.
What to do now
The PHP project's stance is unambiguous: upgrading is the only safe choice — updating the application without updating the PHP runtime does not close the hole. Those who cannot upgrade right away should apply interim mitigations: set memory_limit to -1 where applications cannot override it, keep post_max_size low, disable session.upload_progress.enabled, and set fatal_error_backtraces to 0 on PHP 8.5, then restart every worker process. These only block known attack paths and are no substitute for upgrading.
PHP2Shell will become a landmark case: for the first time, AI-assisted bug hunting turned a deep flaw hiding for over a decade into a reproducible exploit chain — both OpenAI and Wiz needed more than one model to dig it out. This time the attacker-defender time gap was four days; next time it may be shorter. For site owners and ops teams, there is only one conclusion: update the PHP runtime now, not later.
