Frontier AI models have identified two critical remote code execution (RCE) vulnerabilities in the PHP language runtime that remained undetected through a decade of manual security audits.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, allow unauthenticated attackers to execute arbitrary code on servers running affected versions of PHP. AI-assisted analysis identified these memory-corruption flaws, which had remained hidden in the PHP codebase for more than a decade.
Wiz Research, which combined these vulnerabilities into an exploit script dubbed “php2shell,” identified the flaws as memory-safety issues stemming from how PHP handles fatal errors during request processing. CVE-2026-109618 involves out-of-memory (OOM) corruption, where PHP interrupts a request while internal data is only partially initialized. During the subsequent cleanup process, the runtime incorrectly treats this invalid data as valid. CVE-2026-109619 involves stale global state, where request-owned internal state persists after its backing memory has been freed, allowing a subsequent request handled by the same worker to utilize the stale data before it is reset.
Both vulnerabilities carry a CVSS v4.0 score of 9.2, marking them as critical. The flaws exploit the runtime’s trust-through-defaults pattern: the engine assumes its internal state is consistent even after an interrupted request. This pattern of implicit trust in memory management is a recurring theme in recent infrastructure vulnerabilities, similar to issues previously tracked in BeyondTrust, nine-layer, and ConnectWise. Unlike the identity-layer and supply-chain trust gaps analyzed in our prior coverage, including the synthesis in the nine-layer report, PHP2Shell represents a distinct class of failure: it sits below the application layer entirely, where the language runtime blindly trusts its own internal memory state.
Wiz Research identified these vulnerabilities using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol. According to the firm, a single researcher completed in a week what would previously have taken a world-class team months of work. Writing in the Google Cloud post she co-authored with CISO Chris Betz, Raluca Ada Popa, Head of Gemini Security at Google DeepMind, said Gemini 4 Argon made “an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch.”
Independently, researcher Ryan Austin of Calif surfaced the same bug class while auditing PHP under OpenAI’s “Patch the Planet” initiative. Calif’s write-up of the disclosure dates the first confirmed out-of-memory fatal to August 1, days into the audit, with the first bug reported to PHP on August 11 and a working exploit confirmed by the project on August 15.
Wiz Research writes that the findings “rank among the most severe vulnerabilities discovered in PHP, and arguably in software history,” and that demonstrating exploitability required “an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve” before frontier AI models lowered that barrier.
According to Wiz Research, PHP powers 70% of all websites globally, meaning the vulnerabilities affect a significant portion of the internet. The flaws impact all currently supported PHP branches, including versions 5.4 through 8.5.11, as well as older end-of-life branches. Apache mod_php represents the highest risk surface, as the exploit can succeed before any application code executes. Other environments, including PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed, are also at risk.
Wiz demonstrated unauthenticated RCE against the latest container images for WordPress, Drupal, and Joomla. While Google Cloud is not itself vulnerable, the company confirmed that users running PHP on its infrastructure may be exposed.
The PHP security team released patches on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Because PHP 8.1 and older versions are end-of-life, the project provided only minimal source-backports for versions 7.4, 8.0, and 8.1. Administrators are advised to update immediately.
For systems where immediate patching is not possible, the PHP project recommends specific mitigations: setting memory_limit to -1 to address CVE-2026-109618, and setting session.upload_progress.enabled to 0 and fatal_error_backtraces to 0 to mitigate CVE-2026-109619. While eSentire’s advisory reports unverified claims of exploit code circulating in the wild, those reports remain unconfirmed. Rapid7’s emergency threat response covers the same pair; that page returned a 403 bot wall at fetch, so it is named here rather than quoted.
