PHP2Shell: The AI-Discovered PHP Vulnerability That Put Websites Worldwide on Alert

• In October 2026, security researchers disclosed critical vulnerabilities in PHP, nicknamed PHP2Shell. They were tracked as CVE-2026-109618 and CVE-2026-109619, with a CVSS v4.0 severity score of 9.2 out of 10.
• The flaws could allow an attacker, without logging in, to run malicious code on a vulnerable web server or read sensitive information from server memory, such as passwords, tokens, API keys and certificates.
• PHP versions released over the past decade—including those dating back to PHP 5.4—were reported as affected by at least one of the issues.
• PHP released emergency patches on October 21, 2026. The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
• India’s cyber-security agency, CERT-In, issued a critical alert and advised organisations using PHP to install the updates.
• In India, government agencies began patching official websites, while banks reportedly audited applications, took some non-critical services offline and prepared backup arrangements.

What is PHP?

PHP stands for PHP: Hypertext Preprocessor. It is a free, open-source, back-end programming language that runs on web servers and helps create dynamic websites—pages that can change based on user actions or stored data.

When you open a website, PHP may be working behind the scenes to collect information, process requests and generate the page you see. It has been widely used since the 2000s and powers platforms such as Wikipedia, WordPress, Drupal and Joomla.

According to Wiz Research, PHP powers about 70% of websites worldwide. In India, it is commonly used for government portals, university websites, WordPress-based business sites, online stores and older enterprise systems.

The important point is that the newly disclosed flaws were in PHP itself, not in a particular website plugin or theme. That means even a website whose own code was secure could be at risk if it ran an unpatched, vulnerable version of PHP.

How were the vulnerabilities found?

Researchers at cyber-security firms Wiz and Calif, working with OpenAI, discovered the vulnerabilities during a coordinated security research effort. Wiz reported that it first found a PHP vulnerability on August 19, 2026, confirmed remote code execution against Drupal on August 20 and WordPress on August 21, and reported the findings to the PHP security team on August 24.

The bugs were memory-safety issues. In simple terms, PHP could sometimes leave behind corrupted or outdated information in a server’s memory after a request failed—especially during an out-of-memory error. A later request handled by the same server process could then interact with that damaged memory, potentially allowing an attacker to execute code or read private data.

Wiz combined the issues into an exploit called php2shell and demonstrated unauthenticated remote code execution on test deployments of WordPress, Drupal and Joomla. It also demonstrated that attackers could read sensitive process memory without achieving full code execution.

Ryan Austin, a Calif researcher who helped uncover the flaws, told the BBC: “It was the most serious vulnerability I’ve ever found.”

How AI was used

AI did not create the vulnerability—the underlying bugs had existed for more than a decade. What changed was that advanced AI tools made it much faster to analyse the complex PHP code, chain multiple weaknesses together, test different server setups and turn the flaws into a working exploit.

Wiz said its team used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol during the research. It credited Gemini 4 Argon with a particularly significant contribution to finding the vulnerability, developing the exploit, detecting attacks and validating the patch.

Before AI, building and adapting such an exploit across different PHP versions, configurations and memory layouts would have required highly specialised manual work. Wiz said AI reduced that barrier, allowing a single researcher to complete in a week what might previously have taken a world-class team months.

OpenAI described the discovery as “one of the most impactful security issues in recent memory” and said the incident showed both how AI can uncover security flaws and how it can help attackers rapidly develop offensive tools and exploits.

Raluca Ada Popa, Head of Gemini Security at Google DeepMind, said: “Using Gemini 4 Argon, the team at Wiz has shown why frontier AI is a game-changer for cyber defense.”

What happened after disclosure

The PHP Foundation released patches on October 21, 2026, and urged users to update immediately. Because technical details and exploit information were leaked online before the planned announcement, developers had to rush out the security advisory and patch.

The disclosure triggered a global response:

• Wikimedia, the organisation behind Wikipedia, took down some systems as a precaution.
• The Finnish government, Edinburgh Council, the BBC and the Netherlands’ cyber-security agency took sites or pages offline.
• Several Scottish public organisations, including councils and health boards, also took websites offline.
• The US National Security Agency urged organisations using PHP to patch immediately or take systems offline if they could not do so, saying the flaw could provide a “direct path” to exploit a system’s database.
• The UK’s National Cyber Security Centre advised organisations to check for attacker-installed backdoors.
• Japan’s Prime Minister Sanae Takaichi urged people to check whether their public websites used PHP and said temporary suspension could reduce risk if patching was not possible quickly.

Cloudflare CEO Matthew Prince said on X that the company saw “thousands” of exploitation attempts in the 10 hours before public disclosure, which rose to “tens of thousands” within 45 minutes of the announcement, “hundreds of thousands” within two hours, and “millions” thereafter.

Response in India

CERT-In rated the issue critical and warned that a remote attacker could execute arbitrary code and potentially compromise affected systems. It advised all organisations and individuals using PHP to install the latest security updates.

The Indian government began emergency patching of official websites. A Ministry of Electronics and Information Technology official, quoted on condition of anonymity, said: “There have been no complaints of disruptions to government websites. All government agencies should comply with CERT-In’s advisory to update their servers with the newly released patches. There is no new direction from our side.”

Banks reportedly began auditing applications for weaknesses, taking some non-critical services offline and preparing backups to redirect traffic if parts of their websites or mobile applications experienced downtime.

Why Indian websites should act now

India has a large number of PHP-based websites, including small business sites, college portals, government services and WordPress-powered stores. Many are maintained by external vendors or run on shared hosting, which can delay security updates.

The main risk is not just website defacement. If attackers gain control of a server, they may be able to steal customer data, credentials, payment-related information or access to connected systems. Wiz warned that exposed memory could contain passwords, authentication tokens, API keys and certificates.

Small businesses should not assume that updating WordPress, Joomla, Drupal or their plugins is enough. The fix must be applied to PHP itself, usually through the hosting provider, server administrator or development team.

How to prevent attacks

For website owners

• Update PHP immediately to version 8.2.35, 8.3.36, 8.4.27 or 8.5.12, depending on the PHP branch your site uses.
• Contact your hosting provider or developer and explicitly ask whether the PHP2Shell security patch has been applied.
• Update WordPress, plugins, themes and other software, but remember that this alone does not fix a flaw in the PHP engine.
• Review access logs for unusual activity, especially unexpected multipart file-upload requests, memory-limit errors, repeated HTTP 500 errors or unusual PHP worker behaviour.
• Use a web application firewall and restrict administrative access, as recommended in CERT-In-related guidance reported by Indian media.
• Check backups and ensure they are recent, tested and stored securely.
• Temporarily take a site offline if it cannot be patched quickly and it handles sensitive data. The UK’s NCSC and Japan’s Prime Minister both suggested this as a risk-reduction measure.

For IT and security teams

• Identify every server, container, staging environment and legacy application running PHP.
• Prioritise internet-facing systems and systems that handle personal, financial or login data.
• Apply the official PHP patches, restart services as required, and verify the patched version is live.
• Search logs for signs of exploitation and check for unexplained administrator accounts, modified files or backdoors.
• Monitor vendor advisories, as security agencies have warned that exploitation attempts may increase in the weeks after disclosure.

For ordinary users

Most internet users do not need to update PHP themselves. However, users should follow security notices from websites they use, change passwords if a trusted service asks them to, and be cautious of phishing messages that exploit fear around this incident.

The bigger lesson

PHP2Shell is a warning about both old software and new AI capabilities. The vulnerabilities had remained hidden for years, but AI made it easier to understand, exploit, and to fix them.

For Indian businesses, educational institutions and government departments, the immediate action is clear: identify PHP-based systems, apply the official patches, verify the update, and review server logs. For the longer term, organisations should treat regular patching, vendor accountability and security testing as essential parts of running a website—not optional IT tasks.