PHP2Shell, Explained: The AI-Found PHP Flaw That Took Government Websites Offline

AI models helped find two holes that had been hiding in PHP for more than a decade. Within a week, governments were pulling websites offline and attackers were breaking into firewalls. Here's what happened and what to patch.

By the Sphinx Agent Editorial Team · Published October 31, 2026 · Facts checked against sources up to October 31, 2026.

First, what is PHP and why should you care?

PHP is the programming language running behind a huge share of the web. When you log in to a WordPress blog, fill out a form on a small business site, or read a Wikipedia page, there's a good chance PHP is doing the work on the server.

W3Techs puts it at 69.2% of all websites whose server-side language it can detect.¹³ So when PHP itself has a hole, it isn't one website's problem. It's most of the internet's.

What the flaw actually lets an attacker do

Here's the simple version. An attacker sends a carefully built web request that makes PHP run out of memory partway through handling it. PHP doesn't clean up properly. It leaves behind broken or "stale" leftovers, and the next request picks them up.

With the right setup, those leftovers let the attacker run their own commands on the server. No username. No password. The PHP project says the highest risk is servers using mod_php, where an unauthenticated request can trigger the bug before the website's own code even runs.¹

That last part is what scared people. It means a perfectly written, fully updated WordPress site could still be hit, because the problem sits underneath it. Wiz showed working attacks against the latest versions of WordPress, Drupal and Joomla, and also showed it could read memory holding passwords, tokens and API keys.²

Calif, one of the teams that found it, lists attack paths that need no login in WordPress, Drupal, Joomla, MediaWiki, Roundcube, Magento, phpMyAdmin, Nextcloud and Laravel apps.³

This one really is an AI story

In our Binance hack breakdown, we found no evidence that AI was used to break in, despite the rumors. PHP2Shell is different. Here, AI's role is documented by the people who did the work.

• Wiz says it "used Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol throughout this research," and that Gemini 4 Argon "made an invaluable contribution to finding the vulnerability."²
• Calif found the first bug on August 1, 2026 and reported it to PHP on August 11. Its write-up credits "Calif, OpenAI and Wiz."³
• OpenAI's Greg Brockman said the flaws were "discovered and addressed using our models as part of our Patch the Planet initiative."¹²
• Chainguard, a third company, says it found the bugs on its own using a frontier AI model.¹¹

Think about that. Wiz says the flaws had been in PHP for "more than a decade," with affected versions going back to PHP 5.4.² Thousands of skilled people read and tested that code over the years. Then several AI-assisted teams found the same holes within weeks of each other.

That's the good news and the bad news in one sentence. The good guys found it first this time. But if three separate teams can find it with off-the-shelf frontier models, so can anyone else with the same tools.

Timeline

Why governments told people to take websites offline

Normally the advice after a big bug is "patch soon." This time, several governments said something much blunter: if you can't patch right now, unplug it.

• The NSA urged organizations that couldn't update immediately to take affected systems offline until the problem was fixed.⁷
• CISA told everyone to "immediately update" and said systems running PHP 8.1 or older, which get no official fix, should come offline.⁴
• CERT-EU, the EU's own cyber response team, said organizations that couldn't patch in time should consider taking sites down.⁷

Many did. On October 21, Reuters reported precautionary shutdowns across Europe:⁷

• Germany's federal IT provider ITZBund took several sites offline as a "purely preventive" step.
• France's Interior Ministry took prefecture websites down.
• Belgium's foreign ministry pulled its websites.
• In the Netherlands, Overheid.nl, the Port of Rotterdam, major political parties and many hospitals went offline.
• Finland's state IT center shut the government's public web services.
• The Wikimedia Foundation took several systems down until they could be patched.

Picture that for a second. Governments chose to make their own public services unavailable rather than risk them being taken over. That's how bad a no-login, run-any-code bug in the web's most common language is. It's also part of why "be ready" campaigns are getting attention right now, which we cover in our 90-days-without-power fact check.

Who is exploiting it

Attacks are real, but some early claims were overblown. Here's what holds up.

• Attacks started before the announcement. Amazon saw an attempt on October 17.⁶
• Mass scanning. By October 27, Delft University's Threat Intelligence Lab had tracked more than 50,000 exploit requests from over 600 IP addresses in 70 countries. 171 of those addresses sent actual exploit code or malware.⁶
• Confirmed break-ins on test servers. Perplexity researcher Adel Karimi recorded 35 successful shell executions on his honeypots on October 24.⁶
• A China-linked group went after firewalls. Security firm Dream says a "China-linked threat actor" used search tools to find about 19,000 firewalls from one vendor, narrowed that to 240 targets in the U.S., Japan, Taiwan and South Korea, and broke into 25 of them on October 23 and 24. At one U.S. government-affiliated organization, they reached a firewall management server holding the settings and passwords for every firewall it ran.⁸
• Some claims were walked back. Sophos and Palo Alto Networks retracted some earlier reports of successful attacks.⁶ Wiz says it had not seen a successful end-to-end attack in its own data, and that vulnerable exposed machines it tracks dropped about 67% within a week.⁹

Is this connected to the Binance hack?

No one has reported a link. Binance says its breach began with a compromised engineer's laptop, not a web server bug.

But the two stories belong together for a different reason. In the same ten days, the web's most popular language had a decade-old hole found with AI, attackers were using it before most companies could patch, and the world's biggest crypto exchange lost $6.3 billion to a state hacking group. Our Binance article lays out the numbers behind this: about 13,000 new vulnerabilities reported in October alone, and companies taking a median of 43 days to fix ones already under attack.

PHP2Shell is what that gap looks like in real life. The fix shipped on day one. The danger comes from every server that still hasn't installed it.

What to do

If you run a website or server

1. Check your PHP version. Run php -v on the server, or ask your host. Some vendors backport fixes without changing the version number, so ask if you're unsure.¹⁰
2. Update to a fixed release: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Then restart PHP so the old processes are gone.^1,4
3. On PHP 8.1 or older? There's no official fix. CISA says take it offline until you can upgrade.⁴ Note that PHP 8.2 itself reaches end of life on December 31, 2026.¹
4. Can't patch today? Put a web application firewall in front of the site, and use the temporary settings the PHP project lists in its advisory. They reduce the risk but don't remove it.^1,4
5. Assume secrets may have leaked. If you were exposed after October 17, rotate database passwords, API keys and session secrets.
6. Watch for the warning sign. PHP processes starting shell commands is a strong signal that something is wrong.

If you use a managed WordPress host

Ask your host directly whether you're on a fixed PHP build. Some have already confirmed. Kinsta, for example, said customers were protected and didn't need to do anything.¹⁰ Don't assume. Ask.

If you just use websites

You can't patch someone else's server. But you can limit the damage if one of them gets breached:

• Use a password manager and a different password for every site.
• Turn on two-factor login wherever you can, ideally with a passkey or app instead of text messages.
• Be careful entering card details on small sites for the next few weeks. Use a virtual card number or a payment service if you can.
• Expect breach notices and phishing emails that mention the flaw. Don't click links in them. Go to the site directly.

What we still don't know

• How many real-world servers were actually broken into, not just scanned.
• Which firewall vendor Dream's report involves. It wasn't named.⁸
• Whether other groups, including the North Korean units behind recent crypto thefts, are using it. One firm has said it suspects North Korean scanning, but that isn't confirmed.
• How many old, unsupported PHP sites will simply never be fixed.

Frequently asked questions

What is PHP2Shell?

The nickname for two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, each rated 9.2. They let an attacker with no login run code on a web server or read secrets from its memory.^1,2

Which PHP versions are safe?

8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older have no official fix.⁴

Was it really found by AI?

AI played a documented part. Wiz credits Gemini 4 Argon and GPT-5.6 Sol alongside its own Wiz Atlas tool, and OpenAI says its models were used to find and fix the flaws.^2,12

Is it being exploited?

Yes. CISA added both flaws to its Known Exploited Vulnerabilities catalog on October 26, 2026.⁵

Is my WordPress site at risk?

It can be, even if WordPress is fully updated, because the flaw is in PHP underneath it. Ask your host which PHP build you're on.²

Is it related to the Binance hack?

No link has been reported. Binance says its breach started with a compromised laptop.