On October 21, 2026, the PHP project published emergency patches for two remote code execution (RCE) flaws with a CVSS v4.0 score of 9.2. Nicknamed PHP2Shell, they have sat in the language for years, and practical exploitation was so complex that nobody had demonstrated it: researchers say frontier AI models lowered that barrier.
What CVE-2026-109618 and CVE-2026-109619 Are
They are two memory-safety bugs in the PHP engine, both scoring 9.2 on CVSS v4.0. According to Help Net Security, the first (CVE-2026-109618) is an RCE through corruption after an out-of-memory (OOM) condition: if PHP is interrupted by memory exhaustion while the request's internal data is only partially initialized, the later cleanup can treat that invalid data as valid. The second (CVE-2026-109619) is an RCE through stale global state: request-specific internal state survives after its memory is freed, and a later request on the same worker can use it before normal initialization resets it.
A key detail: per the same report, a working exploit reportedly needs a single unauthenticated request, and it triggers before any application code runs. That means WordPress, Laravel or a hand-built site are equally reachable: the flaw sits underneath all of them.
Affected Versions and Patches
CERT-EU indicated the flaws could affect every version since PHP 5, although, according to CyberScoop, the PHP project did not officially confirm the technical cause or the full list of affected versions at the time of publication. Linux distributions and LTS vendors received the patches before the public release: the fastest route is your vendor's package.
The Role of AI: From Decades of Latency to an Exploit Chain
Wiz described the flaws as old and hard to exploit: proving they were exploitable required an unusually complex chain of steps. According to CyberScoop, security firm Calif found them using OpenAI's GPT-5.6 Sol, and Wiz independently discovered and reported them using GPT-5.6 Sol, its Atlas tool and Google's Gemini 4 Argon. Wiz says that with AI, that difficulty "is no longer a barrier." OpenAI said it expects more findings of this kind in the coming months and offered a free tool to identify vulnerable versions.
The takeaway for defenders is uncomfortable: if a model can assemble the exploit chain for a decades-old flaw, the cost of turning a patch into an exploit drops for everyone, attackers included.
Leak, Prior Exploitation and Exposure
On how many systems are exposed, the figures vary by method: researchers estimated more than 1.3 million internet-exposed hosts and a Shodan search counted about 1.9 million; VirusTotal found about 758,000 servers on unsupported branches (5.4 through 8.1) versus 272,000 on supported branches. The "70% of the internet" headline comes from PHP's share among sites whose server-side language is known (estimated at 70-80%), not from 70% being compromised. CISA, at the time of the reports, said it had not observed exploitation; several vendors were mostly seeing reconnaissance. Unverified exploit code is circulating, and security firms warn it may contain malware.
What to Do This Week
- Inventory everything that runs PHP, including WordPress, CRMs, customer portals and internal dashboards, plus any containers that embed it.
- Update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or ask your vendor for the backported package. If you're running 8.1 or earlier, you also carry a version-debt problem.
- If you can't patch today, the UK's NCSC recommends taking the system offline; Cloudflare enabled initial WAF rules on all plans, but they are a stopgap, not a replacement for the patch.
- Don't run "PoCs" circulating on forums: they may be malware.
- Assume the cycle between patch and exploit is shrinking: automate the rollout of critical updates.
If you need help prioritizing an exposure inventory or designing an accelerated patching process, write to us at info@guatemalia.com.