Critical PHP Patches Address 'Very, Very Bad Vulnerability'

Artificial Intelligence & Machine Learning , Endpoint Security , Incident & Breach Response

The PHP Foundation released security updates to address two critical "PHP2Shell" vulnerabilities in its server-side code that have existed for more than a decade. Both of the vulnerabilities can be remotely exploited by unauthenticated attackers to run arbitrary code, take full control of the underlying server and steal data.

See Also: Webinar | Verifying AI Agent Activity Against Your Data Policies

"All PHP users are strongly encouraged to update immediately," the open source software maintainers warned alongside the Wednesday release of PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which fix the flaws.

No other versions of PHP are set to receive fixes; everything before 8.x is "end of life" and unsupported.

"For the avoidance of doubt: The PHP2Shell vulnerability is very, very bad and requires urgent attention," said Ciaran Martin, the founding head of Britain's National Cyber Security Centre, who's now a professor of practice at the University of Oxford, in a social media post.

"There's so much cybersecurity nonsense floating around on a daily basis in 2026 that it's easy to miss genuinely big and important moments amidst all the noise, especially if you're outside the full time cybersecurity community living and breathing cyber risk," he said.

The flaws are a memory corruption vulnerability that can interrupt PHP and lead to invalid data being treated as valid, tracked as CVE-2026-109618 , and a stale global state problem tracked as CVE-2026-109619 . Both of the flaws have a "critical" CVSS v4.0 score of 9.2.

"All PHP installations serving web requests, including PHP-FPM, Apache with mod_php , php-cgi , FrankenPHP and LiteSpeed" are at risk, the PHP team said. The risk is highest for mod_php , where two working proof-of-concept attacks - one using each of the two zero days - against it have been confirmed, they said.

Experts have rated the threat posed by these flaws as being severe, with researchers at Wiz likening their risk to that posed by Heartbleed and Log4j .

"There's a massive attack surface on this one," Inversion6 CISO Ian Thornton-Trump told ISMG. Many different pieces of software, ranging from content management systems to e-commerce storefronts to the front ends of internet of things devices, use or embed the software.

Cybersecurity platform Censys on Wednesday counted 2.6 million hosts and 55 million web properties running PHP, but cautioned that "exposure does not confirm vulnerability."

Of all websites known to use a server-side programming language, 70% rely on PHP, reports market researcher Web Technology Surveys. While 65% of PHP installations use version 8, version 7 still enjoys a 27% market , followed by version 5 with 8%.

Experts' advice is to install the PHP updates, moving to a supported version if necessary, as quickly as possible. "If an immediate update is not feasible, it is recommended that organizations take the system offline until it can be fully mitigated," said the National Security Agency, which promised to shortly release more detailed guidance.

The same advice has been issued by CERT-EU and Britain's National Cyber Security Centre, and demonstrated by the Dutch National Cyber Security Centre, which took its PHP-using website offline Wednesday "as a precaution," pending patches being released and the site updated.

Vulnerability Details Leaked Early

The software community appears to have been caught out by details of the two zero-day vulnerabilities leaking Tuesday, ahead of their embargoed release Thursday as part of a large vulnerability-disclosure process.

The vulnerabilities were independently discovered two months ago by two teams using artificial intelligence. They included members of offensive security firm Calif, who were using OpenAI's GPT-5.6 Sol, and working with the AI vendor as part of its Patch the Planet initiative, and who reported the flaws to PHP on Aug. 11 and 21. Another team, from Wiz, was independently using Google's Gemini 4 Argon, OpenAI's GPT-5.6 Sol and its own Wiz Atlas, and reported the PHP flaws to maintainers on Aug. 19 and 24.

The PHP team began coordinating a fix on Sept. 21. The research teams collectively assisted, also working with "major cloud providers on variant discovery, coordinated disclosure, patch verification and out-of-the-box mitigations to protect customers and reduce exposure across the entire ecosystem," Wiz said.

A coordinated vulnerability disclosure process, including details of the flaws and patches from PHP, was scheduled under embargo for Thursday. But after details of the flaws leaked Tuesday, PHP moved its patch release up to Wednesday (see: Attackers Exploit Leaked Zero-Day Flaws in Widely Used PHP ).

Cybersecurity firms report seeing active attacks attempting to exploit the vulnerabilities, although it's not clear how many - if any - might yet be successful. But attackers regularly reverse-engineer security patches, oftentimes fielding a working exploit in less than 24 hours, meaning the clock is ticking to update PHP or take vulnerable systems offline.

"Threat actors move fast, especially with the help of AI and this will likely be a priority target for them over the coming hours and days so it is crucial organizations monitor PHP and web-server processes for unusual processes, command execution or other signs that an attacker may already have gained a foothold," said Don Smith, vice president of threat intelligence at cybersecurity firm Sophos' cyber-threat unit, in an emailed statement.

AI Delivers Complex Exploit Chain

Veteran security experts said that what's notable these two vulnerabilities is that the attack chain needed to exploit them is very complex and would typically have required not only deep expertise but extensive amounts of time. AI has changed that calculus, with one set of researchers involved saying they found the flaws after starting to look only two months ago.

"These are not simple coding mistakes. They involve subtle memory-management failures and complex exploit chains that traditionally require highly specialized security expertise," said Chris Wysopal, chief security evangelist at code-testing firm Veracode, in an emailed statement to ISMG.

"What's significant is that AI didn't just help find these vulnerabilities. It helped researchers turn bugs that had been hiding in PHP for more than a decade into working exploits, adapting them to different environments in hours."

Cybersecurity experts said warnings that started being sounded in the spring after Anthropic's Mythos was first unveiled, the potential for frontier large language models to not only find vulnerabilities in widely used software but quickly develop complex exploit chains to attack it, have come to pass, at least in this case with PHP (see: Zero Days for the Masses: Mythos Presages Exploit Tsunami ).

"The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit," Wiz said.

How coordinated vulnerability disclosure should function in the age of frontier AI, and when not only multiple groups of defenders but also attackers might find the same vulnerabilities using the same or similar tools, remains an open question.

"This is an example of the Defender's Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare," OpenAI said.