PHP2Shell Exploits Hit the Interpreter Core AI Formal Proofs Assume Away
A third of the world's PHP deployments now face a critical, remotely exploitable flaw with no official patch, so legacy operations teams must rely on backports or temporary shutdowns. The incident also resets expectations for AI-assisted development: proving code logic doesn't prove the runtime it runs on.
Two critical flaws in the PHP interpreter's C-language kernel, CVE-2026-109618 and CVE-2026-109619, are already causing real damage: European government sites went offline, Dutch digital identity systems shut down, and Japanese platforms posted maintenance notices. Both carry a CVSS score of 9.2, and under default configurations an unauthenticated request can trigger the underlying exception and execute code on the server. Because the defect lives in the interpreter rather than application logic, even a site that prints Hello World is exposed.
Independent researcher Ryan Austin found the vulnerabilities in early August and traced the trail back to a 2004 memory-limit issue and a 2020 problem report. His retrospective emphasizes that no special AI tool made the discovery; AI's actual role was compressing the exploit verification cycle from weeks to days. The timing collided with OpenAI and Anthropic announcements about AI-driven vulnerability discovery and formal proof, and the contrast frames the engineering boundary: formal verification proves application logic against an idealized runtime, but says nothing about the C implementation underneath.
Official patches only cover PHP 8.2 through 8.5. With roughly 65% of PHP sites on 8.x, 27% on 7.x, and 7% on 5.x, about a third of the PHP web has no official fix. ServBay responded by backporting patches to EOL branches including 7.x and 5.6, and its per-project PHP version binding lets legacy sites stay on patched older interpreters while new projects run current versions.
The gap between Anthropic's formal-proof results and this incident is not about proof quality; it is about what formal proof assumes away. A verified function still depends on an interpreter, OS, and hardware that are not part of the proof.
The public narrative around AI vulnerability discovery keeps crediting frontier models, but the actual sequence here gives the credit to human memory of old bug reports. LLMs made the exploit faster to validate, which is a real gain, not the same as finding the bug.
Backporting security patches to unsupported branches is becoming a normal operational requirement, not a temporary workaround. The upgrade-only advice ignores the cost and risk of rewriting legacy systems under incident pressure.
The exploit timeline compresses the defender's window: once the patch is public, attackers can reverse it faster, so teams without a patching path face a race where even taking the server offline may be the rational move.
Separate acceptance of application-layer proof, runtime version, and patch status — that boundary is well drawn. Since upgrading the interpreter changes the behavior of existing systems, beyond verifying that the vulnerability no longer reproduces, evidence of key business regression and rollback should be kept as well.