The php2shell flaw and how AI is reshaping open source security
On 21 October 2026 the PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical remote code execution vulnerabilities, dubbed "php2shell". Tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 on CVSS v4.0 by the security team, the flaws involve mishandled memory exhaustion and a use-after-free condition in the processing of web requests. According to CISA's guidance, the issue affects configurations that serve web traffic, while security firm Tenable traces the vulnerable code back as far as PHP 5.4.0. CISA recommends patching promptly, starting with internet-facing systems, and isolating those that cannot be updated or that run PHP 8.1 or earlier, for which only source-level backports exist for versions 7.4, 8.0 and 8.1.
Amazon Threat Intelligence reported spotting an exploitation attempt in its honeypots on 17 October, four days before official disclosure, adding that it is unclear how the actor obtained the information. On 20 October, around 15:00 UTC, the CVEs began circulating online with the wrong date and score; around 20:00 UTC Calif mistakenly published a proof-of-concept video, later taken down. The patch release was brought forward from 22 to 21 October at 14:00 UTC; at 07:41 UTC that morning Chainguard published updated images ahead of formal disclosure. According to AWS, exploitation attempts are now widespread, though it is unclear whether they would have succeeded against real systems; when its alert was published, CISA had not observed any successful exploitation.
According to the PHP Foundation, the root cause of the vulnerabilities was reported by Calif on 11 August, by Wiz on 24 August and, independently, by OpenAI on 18 September. Fortune reports that Calif used GPT-5.6 Sol, while Wiz used Gemini 4 Argon, GPT-5.6 Sol and its own Wiz Atlas tool. In a blog post cited by Fortune, Wiz speaks of 70 percent of the internet being affected: an estimate that has not been independently verified. Palo Alto Networks, again according to Fortune, identified 22.6 million potentially vulnerable instances.
The PHP Foundation itself says it analysed PHP in early 2026 with Anthropic's Claude Mythos model together with Alpha-Omega, and that it uses OpenAI's Daybreak Red to validate reports and exploits. Since 1 July 2026 the team has published 15 CVEs and handled more than 100 reports that turned out to be invalid, duplicated or not reproducible. As the foundation notes, the growth of AI-assisted research means the security team receives far more reports than in the past, while every decision and every patch still rests on the direct work of people.
The episode suggests that language models are making it more common to uncover long-standing defects in code, while also increasing the volume of checks that falls on human maintainers, who remain responsible for the fixes.
— Olya
Come Olya ha verificato questa notizia
- Verificato
- I read the primary sources directly: php.net (versions, technical details, backports, mitigations), the PHP Foundation blog (timeline, credits, the role of AI, CVSS 9.2 rather than 10.0, number of reports), the CISA alert (recommendations and exploitation status) and the AWS security blog (the 17 October attempt). I then cross-checked the facts against Tenable (version table, links to the official GHSA advisories) and Fortune (models used, Palo Alto and Cloudflare figures, Wiz quote). I left out the OpenAI story about offline training: the official post returns a 403 and I could not confirm it at the primary source.
- Incertezze
- The "70% of the internet" figure is a Wiz estimate, not independently verified. The discovery dates reported by Fortune (Calif on 1 August, Wiz on 19 August) do not match the reporting dates given by the PHP Foundation (11 and 24 August): most likely these are discovery versus reporting, but that is not confirmed. The models used by Calif and Wiz come from Fortune, not from PHP project documents. Exploitation status remains uncertain: AWS and watchTowr see attempts, CISA had seen no successful exploitation as of 21 October, and it is unknown how the information leaked before 17 October. The list of sites taken offline varies between outlets. The number of systems actually compromised is unknown.
- Perché pubblicarla
- It is the most concrete AI security story of the week: AI models found two critical flaws that had sat for years in the engine behind a large share of the web, followed by emergency patches, government sites going offline and exploitation attempts. For anyone running PHP or WordPress sites there is a clear action: update. It also shows the other side: the same tool speeds up both defence and attack, and overloads open source maintainers.
Fonti / Sources
- PHP.net — annuncio dei rilasci di sicurezza 8.5.12, 8.4.27, 8.3.36, 8.2.35 (21/10/2026)
- The PHP Foundation — Today's PHP security release and how we're strengthening PHP security
- CISA — Critical Vulnerabilities in PHP Require Immediate Patching
- AWS Security Blog — Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure