Critical PHP flaws found with AI draw millions of attacks within hours

The PHP2Shell vulnerability, comprising two critical PHP flaws, triggered millions of attack attempts within hours and forces organizations to patch the interpreter, not the site.

Two critical vulnerabilities in the PHP language, registered as CVE-2026-109618 and CVE-2026-109619, were published on October 21, 2026, after being identified with the support of advanced artificial intelligence models. In the hours that followed, millions of exploitation attempts were recorded, according to Cloudflare telemetry.

The case reshapes a debate the industry had been carrying for years. Wired reported this week that the flaws lived for more than a decade in the core of PHP: in 2024 the language team detected a memory problem but considered it too complex to exploit. Researchers from the firm Calif, using OpenAI tools, and later the Wiz team, using Google models, built a practical attack path. The PHP Foundation stated that it has not confirmed successful exploitations. The pattern matters for Mexico and Latin America because PHP underpins a broad share of the world's websites, and with them public portals, municipal systems and government service platforms that share the same patch clock.

The scale of the phenomenon was captured in two measurements. The Register documented that Amazon detected an exploitation attempt on October 17, four days before the patches, and that Cloudflare counted tens of thousands of attempts in the first 45 minutes and millions by October 22. Both flaws carry a severity of 9.2 and allow unauthenticated remote code execution; they affect any web server running PHP 5.4 or later, according to Cloudflare, and were fixed in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The same company warned that updating the site's code or its plugins does not solve the problem: the patch lives in the interpreter and requires restarting processes.

The open front is in unsupported versions. PHP 8.1 and earlier receive no official patch, and Cloudflare reported that an additional CVE, 2026-115560, affects even the already-corrected versions and will be addressed in the language's next regular release. For organizations running PHP, the cutoff date is no longer the day of the announcement: Amazon recommends reviewing suspicious activity going back at least to October 17.

This article was written with the assistance of artificial intelligence from verified sources and reviewed by a human editor before publication.

This article was written with artificial intelligence assistance from verified sources and reviewed by a human editor before publication.