php2shell: a CVSS 9.2 RCE in PHP
where the bottleneck was human
Fixed in 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35. AI sped up the finding; human consensus was the constraint.Oct 22, 2026
On 21 October 2026 the PHP project shipped PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical, unauthenticated remote code execution flaws — CVE-2026-109618 and CVE-2026-109619, CVSS v4.0 9.2. The nickname circulating is "php2shell". What makes this an AI story is not the bug but the bottleneck: AI-assisted discovery compressed the find-to-report loop to days, while the human decision to patch took months.
1. What the two flaws areVerified
| CVE | Root cause | Reach |
|---|---|---|
| CVE-2026-109618 | Out-of-memory handling: if a request hits memory_limit at the wrong moment, request data is left partially initialised and later treated as valid. | With Apache + mod_php an unauthenticated request triggers it before any application code runs; full RCE demonstrated on default settings. Also confirmed via PHP-FPM application paths. |
| CVE-2026-109619 | Stale global state after a fatal error: a worker may reuse freed memory belonging to a previous request. | Unauthenticated heap use-after-free, memory disclosure and RCE with the worker's privileges. |
Every SAPI serving web requests is in scope: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. Source: php.net release notice
2. AI found it; humans could not decideVerified
The PHP Foundation's own post-mortem is unusually candid. In 2024 the first external audit in years (funded by the Sovereign Tech Agency, run through OSTIF by Quarkslab) surfaced signs of the OOM problem. In 2026 the Foundation scanned PHP with Anthropic's Claude Mythos via Alpha-Omega, added OpenAI's Daybreak Red to validate reports, joined OpenAI's Patch the Planet programme, and from 30 July Calif began an audit. On 11 August a Calif researcher reported unconditional RCE; OpenAI independently reported the same root cause the same day.
The Foundation published 15 CVEs since 1 July and processed more than 100 invalid, duplicate or non-reproducible reports in the same period. Its verdict on the two-year delay: a "structural failure" of a consensus-driven security team with too few engineers who know the engine.
3. What to doThird-party verified
- Update to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 — check distribution and LTS vendor packages first, as patches were pre-distributed.
- PHP 8.1 and earlier get no official fix. Minimal source backports exist for 7.4/8.0/8.1; otherwise set
session.upload_progress.enabled = Offas recommended by PHP and Huntress. - Detect: alert when php-fpm, php-cgi, httpd or apache2 spawns shells, interpreters or download tools. Florian Roth's
process-watcheris free. - Status: Huntress reported no in-the-wild exploitation on partner systems as of 21 October 16:30 ET, while others reported emerging attacks. PoCs are circulating.
4. Our readAIfrontier view
This is not "AI created a vulnerability". It is AI improved the defenders' eyesight until human coordination became the rate limit. Discovery now moves in days; the decision to ship a fix still moved in months. The practical implication: keep PHP versions in your asset inventory (this is a foundation flaw, not an app flaw), treat end-of-life PHP as effectively undefended, and fund the human step that decides and applies patches — otherwise more findings simply become more backlog.
出典 / Sources
- PHP.net release announcement (21 Oct 2026) https://www.php.net/archive/2026.php#2026-10-21-5
- The PHP Foundation, "A first external audit and increased security focus" https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
- GHSA-w8hw-w9fx-j79w (CVE-2026-109618) https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
- GHSA-6wmf-4rv5-p3rp (CVE-2026-109619) https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
- Huntress, "php2shell, Leaked Critical PHP Vulnerabilities" https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities
- CERT-EU Security Advisory 2026-018 https://cert.europa.eu/publications/security-advisories/2026-018
- Wiz, "PHP2Shell" https://www.wiz.io/blog/php2shell-php-rce