AI Turned PHP’s Old Memory Bugs Into Remote Code

PHP published four security releases on October 21 for PHP2Shell, two bugs that let a stranger run code with no login. Both carry a CVSS v4.0 score of 9.2. They sit in the engine, so WordPress, Drupal, Joomla and home-grown apps share the same hole.

The U.S. Cybersecurity and Infrastructure Security Agency told operators who cannot install the fix, including anyone still on PHP 8.1 or older, to take PHP-based systems offline until they can patch. Several European governments had already gone dark as a precaution. The outages were the visible shock. The lasting pressure is that the PHP project saw the out-of-memory failure in 2024, could not agree on a fix, and needed AI-assisted labs to prove it was remote code execution.

Two Bugs, Four Patches and a Day of Dark Sites

Around 15:00 UTC on October 20, the identifiers CVE-2026-109618 and CVE-2026-109619 began circulating with a wrong score of 10.0 and a wrong release time. The PHP Foundation said no technical details leaked. The project still pulled its warning forward to 19:30 UTC and moved the ship date from October 22 to October 21 at 14:00 UTC, so distributors would have packages ready when the notes went public.

The security advisory on php.net says the pair can allow unauthenticated remote code execution on any PHP install that serves web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Risk is highest on mod_php, where a working exploit can fire before application code runs. There are no complete workarounds. Updating is the only safe choice, then every PHP worker has to be restarted so old processes are not left in memory.

THE FIXED PHP RELEASES

Germany’s Federal Ministry for Digital Transformation and Government Modernisation took some sites down as a preventative step. France’s Interior Ministry deactivated official pages for local administrative offices. Authorities in Belgium, the Netherlands, Finland and the Czech Republic also shut sites to apply the patch. Japanese Prime Minister Sanae Takaichi warned anyone with a public site to check for PHP and, if a fix could not be applied quickly, to consider taking the site down.

The U.S. National Security Agency, in an October 21 press note, said the flaws nicknamed PHP2Shell could let attackers take control of web servers without prior access, then steal data or move deeper into a network. In a social post the same day it told organizations using PHP to be prepared immediately for an update, and to take systems offline if that update could not be installed at once.

CISA said it had not observed exploitation at the time it published. The PHP security team said it had not identified any functional exploits at the moment of public disclosure. Some hosts later said they had blocked attack attempts the same day the packages landed. Attempts are not the same as a confirmed break-in, and those two official statements remain the clean record for October 21.

The PHP Team Saw the Hole in 2024

In 2024 the PHP Foundation paid for its first external security audit in years, funded by Germany’s Sovereign Tech Agency and carried out by Quarkslab through OSTIF. While fixing one of those findings, a core developer contracted by the Foundation noticed the first signs of the out-of-memory problem that is now CVE-2026-109618.

A possible exploit was discussed inside the project. No working remote-code path was proven, and other bugs with clearer impact took priority. The security team drafted several fixes. Each one threatened compatibility, performance, or the large set of third-party extensions. Consensus stalled, and work started and stopped for months.

We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources.

The PHP Foundation, October 21, 2026

That delay was a structural failure the Foundation is now rewriting into majority votes and faster escalation. The missing piece in 2024 was not a scanner. It was a proven path from a fatal error to a shell, and a team small enough that the hard trade-offs sat on the same few people who already maintained the engine.

How Out-of-Memory Errors Became Remote Code

Calif joined OpenAI’s Patch the Planet program and started an audit on July 30, with the Foundation in the loop. Researcher Ryan Austin did not ask a model to find every bug in PHP. He pointed it at modern relatives of Stefan Esser’s 2004 memory-limit remote flaw, a class Esser had treated as too serious to publish an exploit for.

On August 1 the first out-of-memory interruption that led to code execution appeared. Calif reported an unconditional remote-code path on August 11. OpenAI reported the same root cause the same day. PHP confirmed the proof of concept on August 15. Wiz Research, owned by Alphabet, found its first variant on August 19 using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, got unauthenticated code execution against Drupal the next day and WordPress the day after, and reported on August 24.

Wiz said the findings rank among the most severe bugs discovered in PHP, and arguably in software history. The underlying flaws had been present for decades, it wrote, but proving they were exploitable required a chain at the edge of what human researchers could practically achieve. Frontier models reduced that barrier.

In plain terms, PHP can leave half-built request data behind if a request hits memory_limit at the wrong instant. Cleanup then treats that junk as real. A later request on the same worker can run attacker code, which is CVE-2026-109618, remote code execution via out-of-memory corruption. CVE-2026-109619 is the sibling case: a fatal error leaves internal state pointing at memory from a previous request, and the next request on that worker uses it. Calif showed a way to blow past the default 8 MiB post size cap and force the default 128 MiB memory limit with empty nested file uploads, so the crash can be aimed.

Calif’s earliest affected path dates to PHP 5.4.0. The firm listed working pre-auth code execution against current WordPress, Drupal, Joomla, MediaWiki, Roundcube, Magento, phpMyAdmin, Nextcloud, Laravel and Symfony builds, among others. Amy Burnett, a security researcher at OpenAI who helped harden the patch, called php2shell the most consequential vulnerability she had ever helped discover, and said the largest credit for the recent find belonged to Austin.

FROM ESSER’S BUG TO THE OCTOBER FIX

1. 2004: Stefan Esser finds a memory-limit remote flaw in PHP and withholds a public exploit.
2. 2020: Bug 78876 reports that long variables can trigger an out-of-memory condition and skip cleanup of temp files.
3. 2024: The Quarkslab audit rediscovers the out-of-memory issue; exploitation is not proven and a fix stalls.
4. July 30, 2026: Calif starts a Patch the Planet audit of PHP.
5. August 1, 2026: Calif surfaces the first out-of-memory interruption that leads to code execution.
6. August 11, 2026: Calif and OpenAI independently report the same root cause.
7. August 19-24, 2026: Wiz finds variants, confirms Drupal and WordPress code execution, and reports to PHP.
8. October 20, 2026: CVE identifiers leak; PHP brings the warning forward.
9. October 21, 2026: Fixed releases and public write-ups ship.

OpenAI framed the two-month gap as a Defender’s Window: to its knowledge, frontier AI found the flaws ahead of attackers, giving maintainers time to change the engine. That window is real for operators who can install 8.2 through 8.5. It is much thinner for everyone else.

PHP Still Runs 69.3% of Identified Websites

W3Techs, which surveys site technology, finds PHP on 69.3% of all the websites whose server-side programming language it can identify, in figures dated October 22, 2026. That is the share that makes a language-level bug into a public-web event. Wikipedia’s MediaWiki, WordPress.org and a long list of national and commercial properties sit in that set.

PHP VERSION SHARE AMONG PHP SITES

Version 8’s 65.3% still includes 8.0 and 8.1, which the project no longer ships. The 26.9% still on PHP 7 and the 7.7% still on PHP 5 are entire families with no official binary for this pair. A shared host can hide thousands of sites behind one advertised build, so the public version string is a floor, not a census of pages.

The Servers That Cannot Take an Official Fix

The patch on php.net is not the patch on a cheap shared plan. Linux distributions and long-term support vendors received the changes early, which is why governments could move on October 21. Generic web hosting is slower. On large shared platforms, managed WordPress stacks were updated first while ordinary web hosting still waited on a vendor package, and VPS owners were told to bump PHP themselves.

WHAT STILL CANNOT TAKE THE OFFICIAL FIX

• Unsupported branches: PHP 8.1 and older get no official binary; the project published only minimal source backports for 7.4, 8.0 and 8.1.
• Vendor lag: A package that has not reached the host’s repo leaves every site on that machine on the old interpreter.
• Workers left running: An upgrade without a restart of PHP-FPM, Apache or the equivalent keeps the vulnerable process in memory.
• Partial switches: Disabling session upload-progress, turning off 8.5 backtraces, or setting pm.max_requests to 1 each break only part of the chain.

Those leftover boxes are where the second-order cost lands. AI shortened the path from a 2024 theory to a public exploit class. It did not shorten the path from php.net to a five-year-old WordPress install on PHP 7.4. Operators who cannot move will stay in the CISA offline bucket, or they will sit on the public internet with a known no-login bug in the interpreter.

Eleven Contractors Cannot Absorb the Next AI Wave

As of January 1, 2026, the Foundation listed 11 contracted developers on PHP, plus eight volunteer board members and an executive director seat sponsored by JetBrains. That is the paid bench behind a language still on 69.3% of identified sites.

THE PHP FOUNDATION IN 2025 AND 2026

• 2025 expenses: $784,376, against $645,191 received after fees, a gap the Foundation put at about $139,000 and called a deliberate draw on reserves.
• Money in: $730,534 donated in 2025, from 536 sponsors and individual contributors.
• Report volume: 15 CVEs published since July 1, 2026, and more than 100 reports that were invalid, duplicates or not reproducible.
• New security hires: an Ecosystem Security Team in May 2026, plus triage and hardening contractors through the summer.

AI is already the firehose. Alexandre Daubois, who joined in July to help the security team handle reports, described a queue that models help group and check, while a person still makes every call and every patch. The Foundation used Anthropic’s Claude Mythos with Alpha-Omega earlier in the year, then added OpenAI’s Daybreak Red to validate reports and exploits. The tools find candidates. They do not pick a fix that will not break extensions.

Tools now find bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing. What tools cannot do is decide on the right fix for a long-standing design decision in the engine, weigh the compatibility trade-offs, and review the patch.

The PHP Foundation, October 21, 2026

That is the ask hiding under the NSA warning. The Foundation wants companies that ship products on PHP, hosts that deliver it, and governments whose services run on it to sponsor at a level that matches their use. It pointed at the German audit grant as proof that public money can buy an audit, and said it needs that on a sustained basis. OpenAI, which led a two-month coalition with Wiz, Cloudflare and others around this disclosure, called the episode a new phase in which AI can find security bugs with internet-scale impact. The Foundation’s version is blunter: the reports will keep coming, and today there are too few engineers who know the whole codebase.

Chainguard Published Images Six Hours Early

The coordinated disclosure held until two days before the original target. After the CVE identifiers leaked on October 20, Calif mistakenly published a proof-of-concept video that showed the exploit against several targets. Copies spread after the video was deleted, and that sped up other proof-of-concept work on October 21.

At 07:41 UTC on October 21, more than six hours before the coordinated release, Chainguard published built images that already contained the fix. Like other distributors it had received the patch in advance so its users could update at disclosure. Publishing the binaries early let anyone study the fix while every other PHP user was still waiting. The Foundation said that disregarded weeks of work toward a single public moment.

Distributors that kept the embargo still gave governments a one-day window to take sites down, patch and return. Shared hosts and EOL branches did not get that window in the same form. CISA had not seen exploitation when it published. The PHP team had not seen a functional exploit at disclosure. The next test is whether the 26.9% of PHP sites still on version 7, and the 7.7% still on version 5, get a backport, a migration, or a quiet compromise that never makes a government homepage go dark.

The Foundation’s close was a funding pitch, not a victory lap. It wants structural issues like this out-of-memory flaw handled before they become emergencies, and it named sponsors, hosts and public bodies as the people who can pay for that bench.