PHP2Shell vulnerabilities expose 3.8 million sites to RCE

The scale of the exposure

The Verge reports that two critical vulnerabilities in the PHP programming language are currently affecting a massive portion of the internet. These flaws, collectively referred to as PHP2Shell, allow for unauthenticated remote code execution (RCE), meaning attackers can run arbitrary code on servers without needing any credentials. The impact is immediate and widespread: 4chan, DeviantArt, Wikipedia, and even Pokémon Home have taken their services offline as a precaution. According to VirusTotal, approximately 3.8 million sites currently run PHP with at least one port open, while W3Techs data indicates that PHP powers 69.3 percent of all websites with known server-side languages. This is not a niche issue; it is a systemic threat to the infrastructure of the open web.

How AI changed the threat model

The vulnerabilities themselves are not new. They have existed in PHP for roughly 20 years. However, the PHP Foundation notes that an exploit for one of the flaws was only "theorized" in 2024, with no concrete vectors found at the time. What has changed is the capability to exploit them. OpenAI states that its AI security group, Calif, identified a critical flaw using GPT-5.6 Sol. Google-owned security firm Wiz independently discovered and reported the vulnerabilities using AI as well. Wiz describes the previous exploitation requirements as "an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve." Powerful AI models have now made it "much easier to turn that kind of obscure bug into dangerous vulnerabilities," effectively automating the discovery and exploitation of complex memory corruption issues that were previously out of reach for most attackers.

Technical specifics of the bugs

The two vulnerabilities are distinct in their mechanics but similar in their outcome. The first, CVE-2026-109618, involves RCE via out-of-memory (OOM) corruption. In this scenario, OOM handling can interrupt PHP while internal request data is only partially initialized. The request cleanup process may then treat this invalid data as valid, leading to code execution. The second, CVE-2026-109619, involves RCE via stale global state. Here, request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it. Both flaws allow attackers to gain full control of the server, including access to passwords, API keys, cryptographic certificates, and sensitive databases.

Immediate response and mitigation

The severity of the situation has prompted urgent recommendations from major cybersecurity bodies. The NSA Cybersecurity account on X recommended that organizations take their systems offline if an immediate update is not feasible. The UK’s National Cyber Security Center issued a similar advisory. Cloudflare’s CTO confirmed that the company is "seeing early attacks emerging" as of last night. For developers and site owners, the directive is clear: update to the fixed release of PHP immediately. GoDaddy advises that any site using PHP should assume it is affected. Sites running PHP 8.1 or older are in a particularly precarious position, as these versions are no longer supported and will not receive an official fix. Users of managed hosting services should contact their providers to confirm when patches will be deployed. If you host sensitive data, it is best to disable your site until the patch is applied.

What this means for developers

This incident marks a significant shift in the security landscape for web developers. The ability of AI models to identify and exploit complex, long-standing vulnerabilities means that the "security through obscurity" or "complexity as a barrier" defenses are rapidly eroding. Developers must now assume that any complex codebase is subject to AI-driven scrutiny. This changes the workflow for security audits and code review. While AI tools like GPT-5.6 Sol and Wiz’s models are being used by defenders, they are equally available to attackers. The barrier to entry for exploiting memory corruption bugs has dropped from "elite researcher" to "determined hacker with access to an LLM." This necessitates a more proactive approach to dependency management and patching. The era of waiting for a CVE to be widely publicized before acting is over; the window between discovery and exploitation is shrinking.

What to watch

• Patch adoption rates: Monitor how quickly the 3.8 million affected sites update. Slow adoption will leave a large attack surface open for weeks or months.
• AI-driven exploitation tools: Watch for the release of open-source or commercial tools that automate the exploitation of these specific PHP vulnerabilities, which would further lower the barrier for attackers.
• Government response: Track whether other national cybersecurity agencies issue similar "take offline" advisories, which would indicate a broader, coordinated threat assessment.
• PHP Foundation updates: Follow the PHP Foundation’s communications for any additional details on the vulnerabilities or further patches, as the initial disclosure may not cover all edge cases.