PHP2Shell: AI helped find critical PHP flaws. Who’s at risk, and what to update

What PHP fixed on October 21

On October 21, 2026, the PHP project released 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which fix “two critical vulnerabilities that can allow unauthenticated remote code execution,” in the words of its security advisory. The researchers who reported them call the pair PHP2Shell, and PHP scores them 9.2 out of 10 on CVSS.

• CVE-2026-109618: when PHP runs out of memory partway through a request, the cleanup afterward can treat half-built data as valid.
• CVE-2026-109619: state belonging to one request can outlive its memory, and a later request on the same worker can use it.

The advisory puts “all PHP installations serving web requests” at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates the risk highest for mod_php, “with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.”

The flaws are in PHP itself, so a site’s own code doesn’t protect it. The researchers’ PHP2Shell site says sites can be affected “even when their application code is secure.” It demonstrated running code without logging in on WordPress, Drupal and Joomla, using their latest container images, and says an attacker can also read passwords, tokens and API keys from PHP’s memory.

PHP branch	Exposed	Fixed in
8.5	Before 8.5.12	8.5.12
8.4	Before 8.4.27	8.4.27
8.3	Before 8.3.36	8.3.36
8.2	Before 8.2.35	8.2.35
8.1 and older	Back to PHP 5.4	No PHP release, only vendor backports

For 7.4, 8.0 and 8.1, PHP’s security team also published minimal source patches for people who build PHP themselves.

How AI found it

The PHP Foundation’s account starts in 2024, when a PHP core developer fixing an issue from an outside audit “found the first signs of the OOM problem behind CVE-2026-109618.” No way to attack it was known, and work on a fix stalled for months, a delay the Foundation calls “a structural failure.”

AI-assisted research changed that this year:

• Calif found a way in. The security firm began auditing PHP on July 30 through OpenAI’s Patch the Planet program, and on August 11 its researcher Ryan A reported remote code execution with the same root cause. OpenAI says Calif found it “using GPT‑5.6 Sol.”
• Wiz and OpenAI found more. OpenAI independently reported the same root cause. Wiz reported further attack paths on August 24, and OpenAI on September 18. Wiz says it used its Wiz Atlas tool, Gemini 4 Argon and GPT-5.6 Sol, with Argon making “a particularly significant contribution,” and that “a single researcher completed in a week what previously would have taken a world-class team months of work.”
• Anthropic’s model had looked too. Earlier in the year, the Foundation and Alpha-Omega scanned PHP with Anthropic’s Claude Mythos. The Foundation doesn’t say that scan found these flaws; it now also uses OpenAI’s Daybreak Red to validate reports.

The reports keep coming. PHP’s security team has published 15 CVEs since July 1 and worked through more than 100 reports that were invalid, duplicates or not reproducible. AI helps sort them, the Foundation says, but “a person makes every call and works on every patch.” OpenAI says PHP2Shell is among “several significant vulnerabilities we’ve already found and are working to fix, and we expect similar findings to increase sharply in the coming months.”

Is it being exploited?

The release came a day early. Around 15:00 UTC on October 20, the two CVE numbers began circulating online “with a wrong release time and a wrong CVSS score of 10.0,” the Foundation says, so PHP moved its release forward to 14:00 UTC on October 21. After PHP’s pre-announcement that evening, Calif mistakenly published a video of its exploit at work, which “contributed to accelerated development of various PoCs.”

Cloudflare says “the vulnerability was leaked before the official release date and we observed attack traffic targeting our customers,” and that attackers kept changing their payloads to get past its rules. It gives no numbers. In the October 23 version of CISA’s Known Exploited Vulnerabilities catalog, neither CVE is listed.

Cloudflare’s firewall has blocked known PHP2Shell attempts since 3:02 a.m. UTC on October 21, on every plan with its WAF deployed, Free included. On Pro, Business and Enterprise, it asks you to confirm its Managed Ruleset is set to block. It presents the rules as “an additional layer of defense-in-depth mitigation,” and says to update PHP anyway.

What to do

1. Find out who runs your PHP. If a host manages it, ask the host to confirm it has installed the fixed release. As Cloudflare puts it, “updating website code or a plugin(s) alone does not fix these vulnerabilities.”
2. On your own server, update PHP. PHP says Linux distributions and long-term-support vendors got the patches in advance, so check your distribution’s packages first. Rebuild container images that include PHP.
3. Restart everything that runs PHP. The PHP2Shell site says to restart Apache, PHP-FPM and any long-running PHP workers after the update.
4. Move off PHP 8.1 and older. The PHP project no longer updates them. Some vendors backport fixes; otherwise, upgrade to 8.2 or later.
5. Turn off session upload progress for now. On October 23, PHP disclosed CVE-2026-115560, a related flaw that fully patched releases still have. It needs an unusual setup, an application that switches session.serialize_handler to php at runtime with session upload progress on, but until its next regular bugfix release PHP suggests setting session.upload_progress.enabled=0. Cloudflare says its rules cover it for sites that use the default upload progress field name.

If you can’t update today

PHP’s advisory lists stopgaps and says “only an update is a complete solution.” Each one blocks some attack paths, not all:

• Set memory_limit=-1 where applications can’t override it, such as php_admin_value in the FPM pool or Apache configuration, and contain memory with a container or cgroup limit instead. Don’t use RLIMIT_AS or RLIMIT_DATA, which can trigger the bug.
• Set a low post_max_size: 8M if the site takes no uploads, 32M if it does.
• Set session.upload_progress.enabled=0 in php.ini or the FPM pool, not with ini_set() or .user.ini, and restart every worker.
• On PHP 8.5, set fatal_error_backtraces=0 and restart every worker.

The PHP2Shell site warns that memory_limit=-1 hands memory exhaustion to the operating system, which may stop workers in the middle of requests.

Checking a site with an agent

OpenAI published a PHP version checker as two Codex skills: phpcheck-url, for a site you only have the address of, and phpcheck-server, for one you can log in to. To install both, OpenAI says to ask Codex:

$skill-installer install both skills from https://github.com/openai/php2shell-checker

Then ask $phpcheck-url check https://example.com. Without an agent, node phpcheck.js "https://example.com" does the same check. The skills are ordinary SKILL.md folders, and Claude Code’s skills follow the same Agent Skills standard, so Claude Code can load them from ~/.claude/skills/ too.

Know what it can’t tell you. The URL check reads the version a site advertises in its X-Powered-By and Server headers; if a site hides it, the result is UNKNOWN. Headers can’t show a backported fix, so OpenAI’s README says even OK “only describes the advertised version.” The checker sends no exploit probes.

The same week: a Brotli bug in Node.js and Bun

Node.js 22.23.4, 24.22.1 and 26.12.1, released October 21, fix a flaw reported by researchers at OpenAI Codex Security. In CVE-2026-111497, which Node rates high, malformed Brotli data that an application decompresses with node:zlib “can corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution.” Node.js 20 and older are past end-of-life, and Node says those “are always affected when a security release occurs.” Bun 1.4.4 brought the fix on October 22; run bun upgrade.

OpenAI’s Patch the Planet page says anything that hands attacker-controlled Brotli data to the decoder may be exposed: compressed request bodies, responses from untrusted servers, compressed files. “Using Brotli only to compress outgoing data does not by itself establish exposure.” It says to check “tools that bundle Node.js or Bun” and Electron-based desktop apps, which can carry copies of their own. For AI tools, this is where things stood on October 25:

Tool	Runs on	Fixed?
MCP servers and tools you start with node or npx	Your Node.js	Once you update Node.js
OpenCode	Its own copy of Bun	Yes, in 1.19.4, October 22
Claude Code	Its own binary, which “does not itself invoke Node”	Not mentioned in its changelog through 2.1.310
Apps built on Electron	Electron’s copy of Node.js	Electron hasn’t said; its 45.0.0 lists Node.js 24.22.0

The MCP docs say “many other MCP servers require Node.js to run,” usually started with npx, so updating Node.js covers those. Node.js 24.22.0, in Electron 45.0.0, is the release before Node’s fix. For OpenCode, run opencode upgrade. In Enjoy, an agent’s new version shows beside its name in the agent settings, and Enjoy installs it with the agent’s own updater, as Update an agent shows. Until you can update, Patch the Planet gives stopgaps for Express, Next.js, Envoy and Python HTTP clients, such as setting images.unoptimized to true in Next.js.

What hasn’t been said

• How widely PHP2Shell is being exploited. Cloudflare reports attack traffic without numbers, and CISA hasn’t listed either CVE as exploited.
• When CVE-2026-115560 will be fixed. PHP says only its “next regular bugfix release.”
• Whether Claude Code and Electron apps carry the vulnerable Brotli decoder. Neither Anthropic nor Electron has published anything on it.
• What else the models have found. OpenAI hasn’t named the other vulnerabilities it says it is working to fix.

We’ll update this memo when PHP fixes CVE-2026-115560.