AI found two critical flaws in PHP. What to check at your company

What happened

On Oct. 21, 2026, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Together they're being called PHP2Shell. Both are rated 9.2 out of 10 under CVSS v4.0. They can let an attacker run code on a web server without logging in.

PHP's advisory says every PHP installation serving web requests is at risk, and the risk is highest for Apache with mod_php, where a request can trigger the attack before any of the site's own code runs. Its advice was blunt: "There are no complete mitigations, updating is the only safe choice." PHP 8.1 and older get no updates from the PHP project, so those sites depend on their Linux vendor or an upgrade.

Security firm Wiz says every PHP version released in the last decade is affected by at least one of the bugs, going back to version 5.4.

Why AI is part of the story

Several teams found pieces of the problem in August, and all of them used AI, Fortune reports. One was Calif, a red-teaming firm working in OpenAI's Patch the Planet effort. Wiz says it used its own tools plus Google and OpenAI models. OpenAI said it ranks among the most serious security problems in years.

The bug wasn't new. According to CBS News, the WSJ reporter who broke the story said it had existed for at least a decade. People suspected something was wrong, but nobody had turned it into a working attack. AI made that step cheaper, for defenders and attackers alike.

How fast attackers moved

• Before the patch. Amazon Threat Intelligence says it caught an exploit attempt before disclosure, and tells companies to investigate from at least Oct. 17.
• Hours before the release. The embargo was set to lift at 14:00 UTC on Oct. 21. Amazon saw proof-of-concept exploits around 02:00 UTC that day, and says PHP2Shell is now seeing broad exploitation attempts.
• After word got out. As reported by Fortune, Cloudflare saw tens of thousands of attempts within 45 minutes, hundreds of thousands within two hours, and millions by that evening.
• How many servers. Palo Alto Networks' Unit 42 counted over 22.6 million exposed instances that are potentially vulnerable, based on its own scanning.

Amazon's advice to security leaders is the part to remember: for critical flaws in internet-facing systems, measure patch timelines in hours. A 7-day or 30-day patch window assumes a delay that no longer exists.

The time between a patch and an attack is now measured in hours. A 30-day patch window no longer fits.

Where the skeptics have a point

Early coverage ran ahead of the facts. TryHackMe notes that a leak on Hacker News claimed a 10.0 severity score; PHP's own rating was 9.2. It also points out that watchTowr's public FAQ listed no reported exploitation in the wild, and that Reuters reported Australia's cyber agency wasn't aware of active exploitation. As TryHackMe puts it, an attempted exploit isn't the same as a break-in.

The "70% of the internet" headline is also loose. It means PHP's share of websites, not 70% of sites that can actually be hacked. Many hosts patched shared servers quickly. In TidBITS reader comments, site owners said their hosts updated PHP without being asked; one blocked their WordPress site until the fix landed.

All fair. But "probably fine" isn't a status you can act on. You want a yes or no from whoever runs each system.

What this means for a mid-size office

Most 40-400 person companies don't think of themselves as running PHP. Many do without knowing it:

• The company website. WordPress and most of its plugins run on PHP. Updating WordPress doesn't update PHP on the server.
• Customer and supplier portals. Order portals, quote request forms, dealer sites and file-sharing pages are often PHP.
• Older internal web apps. A timesheet tool, a ticketing system or an intranet someone set up years ago, still running on a server in the closet or a cheap VPS.
• Vendor-hosted software. Some business software runs PHP under the hood. That's the vendor's job to patch, but it's your data.

What to do this week

1. List your web-facing systems. Website, portals, forms, anything reachable from the internet. Note who runs each one: your IT, a hosting company, an agency or a software vendor.
2. Ask each owner in writing. Does it run PHP? Which version? Has it been updated to a fixed release? Shared hosting is usually handled by the host. A VPS or your own server is usually on you.
3. Patch or take it offline. CBS reports the FBI's cyber division told organizations that can't patch right away to take sites offline temporarily. A brochure site can go dark for a day. An unpatched portal with customer data shouldn't stay up.
4. Check from Oct. 17, not Oct. 21. Ask your IT provider to review web server logs from at least Oct. 17, per Amazon's guidance. Wiz lists warning signs such as repeated server errors after odd upload requests and unusually large session cookies.
5. Set a real patch clock. Decide who owns critical updates for internet-facing systems and how fast they have to act. Days, not weeks.

The broader lesson is the one from AI finding flaws faster than people can patch them: the tools that find bugs for defenders find them for attackers too. The companies that come through fine are the ones that know what they run and who updates it.