AI Helps Uncover Critical PHP2Shell Security Flaws Affecting Websites

AI Helps Uncover Critical PHP2Shell Security Flaws Affecting Websites

Artificial intelligence is playing an increasingly important role in cybersecurity after researchers used AI-assisted tools to help uncover critical vulnerabilities in PHP, one of the internet's widely used programming languages.

The flaws, collectively known as PHP2Shell, were publicly disclosed on October 21, 2026. They could allow attackers to execute malicious code on vulnerable servers without first logging in, potentially putting website data, applications, and server systems at risk.

The PHP development team has released security updates to address the problems. Website owners, hosting providers and IT administrators are being urged to identify affected systems and install the appropriate fixes as quickly as possible.

The discovery also highlights a growing cybersecurity challenge: AI can help security researchers identify weaknesses in complex software, but similar capabilities could help attackers develop exploits more quickly.

Why Is the PHP2Shell Vulnerability a Serious Concern?

PHP is a server-side programming language used to build websites and web applications. It helps websites process requests, handle forms, interact with databases, and deliver dynamic content.

Many popular content management systems and web applications rely on PHP, including WordPress, Drupal, and Joomla.

Because PHP is used across a wide range of online services, vulnerabilities in its underlying runtime can have consequences beyond a single website or application.

The PHP2Shell name refers to two critical security vulnerabilities tracked under these identifiers:

• CVE-2026-109618: A vulnerability involving memory corruption during out-of-memory error handling.

• CVE-2026-109619: A vulnerability involving stale internal state and memory-management errors.

According to security advisories, successful exploitation can allow an unauthenticated attacker to execute code remotely or access sensitive information in memory.

The reported severity scores are 9.2 out of 10 under the CVSS version 4.0 system, placing both issues in the critical category.

However, the existence of these vulnerabilities does not mean that every PHP-powered website has been attacked. Actual exposure depends on factors such as the PHP version, server configuration, deployment environment, and whether security updates have been applied.

What Could Attackers Do if a Server Is Vulnerable?

Remote code execution is one of the most serious categories of software vulnerability because it can allow an attacker to run commands or programs on a remote system.

If PHP2Shell is successfully exploited, an attacker may be able to perform actions permitted by the compromised web server process.

Depending on the environment and the privileges available, potential consequences include:

• Accessing or stealing sensitive information.

• Changing website files or content.

• Installing malicious scripts or additional tools.

• Using a compromised server to attack other systems.

• Disrupting website operations or services.

The precise impact depends on the server's configuration and the permissions available to the vulnerable process. Remote code execution does not automatically provide unrestricted control of an entire server, but it can create a serious path to further compromise.

Website operators should therefore treat the issue as a high-priority security concern rather than assuming that application-level passwords alone will protect them.

How Did Artificial Intelligence Help Find the Flaws?

The discovery demonstrates how AI-assisted analysis can help security researchers examine complex source code and investigate weaknesses that may be difficult to understand through conventional manual review alone.

According to research published by cybersecurity company Wiz, its researchers used AI-assisted tools, including Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol, as part of their investigation. The research also involved Wiz's security research platform.

The work helped researchers investigate memory-management behaviour in PHP's underlying engine and develop evidence that the flaws could be exploited under certain conditions.

The distinction is important: AI did not simply announce that a piece of code looked suspicious. The research involved examining the code, investigating possible failure conditions and validating the security impact.

The findings were then reported through a coordinated disclosure process so the PHP security team could prepare fixes.

AI-assisted vulnerability research can help defenders analyse large codebases, test unusual conditions and investigate potential attack paths. Human expertise, controlled testing and responsible disclosure remain essential to ensure that discoveries are understood and addressed safely.

Why Are Researchers Concerned About AI and Cyberattacks?

The same technology that helps defenders identify vulnerabilities could also help malicious actors analyse software weaknesses and develop attacks.

Once a security update becomes public, attackers can compare the corrected software with older versions to understand what changed. That information may help them identify the original weakness and attempt to exploit systems that have not yet been updated.

AI could potentially accelerate parts of this process by helping analyse code differences, summarise technical documentation and investigate possible attack paths.

However, AI does not make every vulnerability easy to exploit, and successful attacks still depend on technical details, system configuration and defensive controls.

The immediate concern is the gap between the release of a security fix and the time it takes organisations to install it everywhere it is needed.

For organisations operating large websites or complex hosting environments, identifying every affected PHP installation can take time. Attackers may attempt to exploit exposed systems while administrators are still completing updates.

Which PHP Versions Are Affected?

Security advisories identify multiple PHP versions as affected. The PHP project has published patched releases for supported branches.

The fixed versions include:

PHP branch	Fixed release
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35

Website operators should confirm the correct package and version through the official PHP security advisory or their operating system and hosting provider.

Older PHP branches, including PHP 8.1 and earlier, are no longer supported by the main PHP project. Some vendors or operating system distributions may provide backported security fixes, but users should not assume that an old version is protected simply because it continues to run.

Installing the appropriate security update is the primary recommended action. Changing selected settings may reduce exposure in some circumstances, but temporary workarounds are not equivalent to a complete fix.

Official advisory: https://www.php.net/archive/2026.php#2026-10-21-5

What Should Website Owners Do Now?

Website owners and administrators should take practical steps to determine whether their systems are affected.

1. Check the PHP version

Identify the PHP version used by the website, including the version running on the production server. The version shown on a local computer may be different from the version used by the live website.

If you use a hosting provider, check its security announcements or contact its support team to confirm whether the affected PHP runtime has been updated.

2. Install the appropriate security update

Update to a fixed release or apply a security package officially provided by the hosting platform or operating system vendor.

Websites may use PHP through different server configurations, so administrators should ensure that all relevant installations and services are covered.

3. Restart or reload the relevant services

Depending on the hosting environment, updating the package may need to be followed by restarting or reloading PHP workers and related services so the corrected code is running.

Hosting providers often manage this process for shared hosting customers.

4. Review logs and investigate suspicious activity

Administrators should review relevant web server and PHP logs for unusual errors, unexpected requests, abnormal process activity, or unfamiliar changes to website files.

If a server may have been compromised, updating PHP alone may not remove malicious files or undo changes already made. A security investigation may be necessary.

5. Use temporary precautions if immediate patching is impossible

Organisations that cannot patch promptly should follow the official advisory and their security team's guidance. Depending on the level of exposure, temporarily restricting access or taking an affected service offline may be appropriate.

Security teams should evaluate temporary configuration changes carefully because they may not fully eliminate the vulnerability.

Do Ordinary Website Visitors Need to Install Anything?

Most ordinary website visitors do not need to install a separate program to address PHP2Shell.

The vulnerability affects the PHP software running on web servers, rather than being a conventional problem that users fix by installing an application on their personal computers.

The main responsibility lies with website owners, hosting providers, developers, and system administrators.

Visitors should still keep their browsers and devices updated, use strong and unique passwords, enable multifactor authentication where available, and avoid suspicious downloads. These practices help with general online security but do not patch a vulnerable PHP server.

If you operate a WordPress website or another PHP-based service, contact your hosting provider if you are unsure whether the server has been updated.

What This Discovery Means for the Future of Cybersecurity

PHP2Shell illustrates both the opportunities and the challenges associated with AI-assisted security research.

On the defensive side, AI can help researchers inspect complex software, investigate subtle programming errors, and validate potential vulnerabilities. This may make it easier to identify problems before they are widely exploited.

On the offensive side, similar capabilities could help attackers analyse software and adapt their techniques more quickly after vulnerabilities become public.

This makes timely software maintenance, coordinated disclosure and effective security monitoring increasingly important.

Organisations will also need to keep accurate inventories of their software, understand which systems are exposed to the internet and establish reliable processes for applying emergency security updates.

AI is not a replacement for experienced security professionals. Its value depends on how its findings are tested, verified, and acted upon.

Conclusion

The PHP2Shell incident highlights the potential impact of critical vulnerabilities in widely used software and the growing role of artificial intelligence in cybersecurity research.

Researchers used AI-assisted tools to help investigate two serious PHP vulnerabilities that could permit unauthenticated remote code execution. The PHP development team subsequently released security updates, and administrators are being urged to apply the appropriate fixes.

The discovery also underlines the need to prepare for a world in which both defenders and attackers can use AI to analyse software more efficiently.

For website owners, the immediate priorities are straightforward: check affected PHP installations, apply the correct security updates, review suspicious activity, and confirm that the patched software is actually running.

Technology and cybersecurity notice: This article is for general informational purposes. Website administrators should consult official PHP security advisories and their hosting or security providers for system-specific remediation instructions.

Sources and further reading

• PHP security advisories: https://www.php.net/archive/2026.php

• Wiz Research: https://www.wiz.io/blog/php2shell-php-rce

• Canadian Centre for Cyber Security: https://www.cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619

• NHS England Digital security alert: https://digital.nhs.uk/cyber-alerts/2026/cc-4875