The bug the world now calls PHP2Shell had been sitting in PHP for about fourteen years. Nobody noticed. Thousands of developers read that code, security teams audited it, automated scanners crawled over it for more than a decade, and it stayed where it was.
In August 2026 a researcher pointed an AI model at PHP’s internals, and it came out.
Two months later, government websites across Europe were being taken offline on purpose, and a suspected state-linked group was using AI of its own to break into servers with the same flaw. This is the story of those two months, because it is the clearest example yet of what AI is genuinely good at — and of the places where it is still people who carry the weight.
What the bug actually was
The flaws were given two identifiers, CVE-2026-109618 and CVE-2026-109619, and the nickname PHP2Shell. Both are rated 9.2 out of 10 on the CVSS v4.0 scale.
What makes them so severe is a phrase that should worry anyone who runs a website: unauthenticated remote code execution. No password. No account. No tricking a user into clicking a link. A request arrives, and on a vulnerable setup it can run code on the server before a single line of your own application has executed.
Per CISA’s advisory it reaches essentially any PHP installation serving web requests — Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. PHP considers mod_php the highest risk of those.
August: the AI finds it
According to SOCRadar’s timeline, the first of the two bugs was found on 19 August 2026, reported to the PHP project on 24 August, and acknowledged on 21 September.
Who exactly found it is the one part of this story the sources do not agree on. Elastic’s write-up credits Wiz Research, saying they identified the flaws with the help of frontier AI models and went through coordinated disclosure with the PHP project. Halborn credits researchers from Calif, Wiz and OpenAI working with AI-assisted tooling. We could not find a single authoritative statement settling it, so treat the credit as shared and the detail as unconfirmed.
What is not disputed is the method. A model was turned loose on a codebase, and it surfaced something that fourteen years of human attention had walked straight past.
Why this is the thing AI is actually good at
It is worth being precise about what happened, because “AI found a bug” gets repeated as if the machine had an insight.
PHP’s source is enormous and old. Reviewing it means holding a lot of detail in mind at once and staying equally alert on page nine hundred as on page one. Humans are poor at exactly that. We skim familiar code. We assume the part that has been there since 2012 was checked by whoever wrote it. We get tired.
A model has none of those habits. It does not find old code boring, it does not assume a senior engineer already looked, and its attention on the ten-thousandth function is the same as on the first. That is not intelligence beating us. It is tirelessness beating a very human blind spot — and on a job like this, tirelessness is what the job needed.
Worth noticing too: the model did not act on it. It produced a finding. A person decided it was real, decided it was serious, and decided to report it quietly rather than sell it or publish it. That decision is the reason this story has a patch in it at all.
20 October: it reaches the wrong people
Responsible disclosure runs on a simple bargain: the finder stays quiet, the maintainer fixes it, everyone updates, and attackers learn about it after there is somewhere to go.
That bargain broke on 20 October. Details of the vulnerabilities leaked publicly through a Hacker News post that was later taken down. By then it did not matter that it was removed — the information was out, and the clock that had been running quietly since August became a race.
The PHP security team moved the same evening. Rather than wait for a scheduled release, they pushed out an advance notice to the php.announce list — one account attributes that message to Jakub Zelenka — telling administrators that patches were coming and to be ready.
The fixes shipped the next day, 21 October: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The team also produced minimal source backports for the 7.4, 8.0 and 8.1 branches, which are past end of life and would normally get nothing at all.
That is roughly a day from “the secret is out” to “here is the fix, for more versions than we officially support”. For a volunteer-heavy open source project, it is a genuinely impressive piece of work.
And then attackers brought their own AI
This is the part that makes PHP2Shell different from the usual severe-bug story.
Researchers at Dream and Palo Alto Networks’ Unit 42 described a campaign that used an AI-assisted exploit chain to gain root access to around 25 PAN-OS firewall and management servers across the United States, Japan, Taiwan and South Korea, and to move against Active Directory inside a US government-affiliated network. They attributed it to a suspected China-nexus actor. One report puts the figure at 24 rather than 25.
The evidence for the “AI-assisted” label is circumstantial but specific: the attackers’ own infrastructure contained an installation of Anthropic’s Claude Code, API keys for the FOFA search service, and an AI-driven offensive security platform called aiscan.
So within roughly a week, the same class of tool sat on both sides. It helped find the flaw, and it helped weaponize it. Anyone telling you AI is purely a defensive advantage, or purely an attacker’s advantage, is selling something.
What the humans did that the machine did not
It would be easy to write this up as a story about software finding what people missed. That version leaves out most of what actually happened.
- Someone chose to report it. A working exploit for unauthenticated RCE in PHP has a market price. It was handed to the maintainers instead.
- Someone judged the severity. Scanners produce findings constantly, most of them noise. Deciding this one was an emergency was a human call.
- Someone shipped the patch in a day. Under pressure, after a leak, for four branches plus three unsupported ones.
- Someone verified it was real. watchTowr reproduced CVE-2026-109618 independently rather than taking the leak at face value, and GMO Flatt Security analyzed an early demo video.
- Someone retracted a mistake. Unit 42 published a report on 23 October tying an intrusion to PHP2Shell, then withdrew it when they could not confirm the initial access came from these flaws. During a panic, pulling your own story back is an unglamorous, deeply professional thing to do.
- Someone decided to pull the plug. Government teams across several countries took their own public websites offline rather than risk it. That is a career-risky call made with incomplete information, and no model was going to make it for them.
Every one of those is judgement, accountability or nerve. None of them is pattern matching over a large codebase.
The honest scoreboard
AI did something here that humans had demonstrably failed to do for fourteen years. Pretending otherwise would be silly, and the people who found it deserve the credit for pointing the tool at the right place.
But the finding was the cheap part. Disclosing responsibly, judging severity, patching under pressure, verifying claims, admitting error publicly, and deciding what to take offline — that was all people, and that is what actually contained it.
Which is, more or less, the argument this site keeps making about AI in ordinary work. It is extraordinary at the exhausting, repetitive half of a job. It is not the one holding the pager, and it is not the one who answers for the decision.
If you run a PHP site, the practical side of this matters more than the narrative. We covered what broke, who patched when, and how to check your own server in the follow-up to this article.
Sources
Reporting in this article draws on advisories and coverage from CISA, Help Net Security, SOCRadar, Elastic Security Labs, The Hacker News, The Register and watchTowr. Where those sources disagree, we have said so rather than picked the tidiest version.
