PHP2Shell: AI Found Two PHP RCEs in Two Days, Patching Took Two Months

Discovery in 2 Days, Fix in 2 Months: After AI Dug Through PHP, Kazik Explains the Attack-Defense Time Gap

The author retraces the two PHP remote code execution vulnerabilities, both starting from a maximum CVSS severity - CVE-2026-109618 and CVE-2026-109619, jointly called PHP2Shell - across the entire discovery-to-patch timeline.

Business reality: 69.3% of websites run on PHP, and the two holes hid for twenty years

W3Techs statistics: 69.3% of websites use PHP as their backend. These two holes were hidden in request-handling code introduced in the PHP 5.4 era, untouched for twenty years. The PHP Foundation publicly asked for help in its postmortem, and Debian's PHP package maintainers receive less than $700 per month in sponsorship. Discovery speed has increased tenfold; the number of bomb-disposal people has not increased by one. When AI turns over every landmine in the world, are there enough people to remove them?

Vulnerability technical principle: multipart POST triggers memory corruption; unauthenticated RCE

An attacker sends a specially crafted multipart POST request, and the PHP parser writes out of bounds to heap memory while reading the file upload progress field. The trigger point is before application code execution, no login required, no application-layer payload required. Tencent Cloud's security advisory put it directly: "can allow an unauthenticated remote attacker to trigger memory corruption by sending a specially crafted multipart POST request and ultimately achieve remote code execution" (advisory link).

The discovery method is worth separate attention. The researcher had GPT-5.6 Sol write the first hole's error pattern into a SKILL.md file. The agent used this guide to scan the entire codebase along the same clue and found the second hole in the file upload progress recording logic. What was found is no longer a point, but a whole class of problems. A human stops after finding one; a methodology can automatically produce the next one.

Impact scope: Apache mod_php default configuration is the most dangerous; WordPress and Drupal are all affected

All SAPIs are within the risk range: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed. mod_php shares the process address space with Apache, so memory corruption directly hits the web service itself; therefore the default configuration is the most dangerous. WordPress, Drupal, Laravel - as long as the underlying layer is PHP, changing plugins is useless; you can only upgrade the PHP binary. Fixed versions are 8.5.12, 8.4.27, 8.3.36, 8.2.35. For those still running 8.1 and earlier unsupported versions, CISA's recommendation is only four words: take the machine offline first.

PHP2Shell attack path and AI discovery flow

PHP2Shell attack path and AI discovery flow

Programmer reaction: watching from the shadows

Code no one looked at for twenty years; one model turned it all over in two days

Approach A (traditional manual audit): why no one found it in twenty years

The coverage bottleneck of manual audit: code volume and experience cannot be replicated

The PHP core codebase has undergone multiple rounds of refactoring since 2004, and the combination of boundary conditions on the multipart POST parsing path has grown exponentially. GPT-5.6 Sol located the memory corruption point in the file upload progress module in two days, then wrote the error pattern into a SKILL.md audit guide. The agent used the same guide to continue scanning and found the second hole.

A top researcher's understanding of the C memory model and SAPI interfaces previously could not be copied to a second person. Now it is a file, given to thousands of agent instances to run in parallel. The code volume did not change; the people reading the code changed.

The PHP Foundation's maintenance dilemma: Debian packagers receive less than $700 a month

69.3% of websites run on PHP, and Debian packagers receive less than $700 a month in sponsorship. The fix dragged on for two months, not because the technology could not solve it, but because no one was queuing in the human pipeline.

Break point in the traditional audit pipeline

Break point in the traditional audit pipeline

When AI turns over every landmine in the world, the number of people removing the mines has not increased by one.

Approach B (AI agent audit): dug through the core in two days; SKILL.md makes discovery reproducible

The mechanism from hitting one point to sweeping a whole class of problems

The bottleneck of Approach A is that experience cannot be replicated. AI connected this pipeline, but the way it connects determines efficiency.

There is a key action in the PHP2Shell discovery process. After using GPT-5.6 Sol to dig out CVE-2026-109618, the researchers did not stop. They had the model write the just-discovered error pattern into a SKILL.md, a repeatable audit guide, and then let the agent continue scanning the whole codebase along the same clue. The result was CVE-2026-109619 in the code responsible for recording file upload progress.

This step changed the topology of discovery. When a human finds a hole, experience stays in the head; the next person reasons from zero. When AI finds a hole, experience is serialized into a file, and it can be handed to hundreds or thousands of agents to run in parallel.

Pipeline from a single point to class-wide scanning

Pipeline from a single point to class-wide scanning

Chrome 156's 353 vulnerabilities: AI reports have already become the main force

This is not an isolated case. On October 20, Google released Chrome 156 stable, fixing 353 security vulnerabilities in a single version; a year ago, Chrome 141 and 142 had 21 and 26 respectively. Within one year, the number of fixes per release rose more than tenfold (data source: GeekPark's statistics on Chrome security bulletins).

The list of reporters has also changed. Of the 6 "Critical" vulnerabilities in Chrome 156, 4 were submitted by Anthropic researcher Xinyang Ge, one explicitly marked "assisted by Claude"; another came from OpenAI's Codex Security. AI company names have begun to appear in batches in the security advisories of the world's most-used browser.

OpenAI gave a one-sentence judgment on the day PHP2Shell was made public: in the next few months, similar discoveries will increase sharply. The machine speed on the discovery side has already started running, but the bomb-disposal people are still the same group. When AI turns over every landmine in the world, do we have enough people to remove them? This gap is what the next two sections address.

Approach C (hybrid remediation pipeline): why the fix took two months

The architectural gap between discovery and fix: the timeline of patches, backports, and ecosystem synchronization

AI compressed discovery to two days, but the remediation pipeline still has to go through the complete engineering cycle. The PHP2Shell patches eventually landed on four branches: 8.5.12, 8.4.27, 8.3.36, 8.2.35. Each branch independently verifies whether the memory corruption on the multipart parsing path is sealed, and runs the full regression suite to confirm that no new parsing exceptions have been introduced. This is not a matter of one diff being enough; it is four test suites multiplied by three runtimes (mod_php, PHP-FPM, php-cgi), plus the private integration layers of FrankenPHP and LiteSpeed.

The gap is not in writing the patch; it is in distribution after the patch. Under Apache mod_php, the parser is embedded directly in the Apache process, so fixing means restarting the entire web service; the restart window in production itself has to be scheduled. PHP-FPM can hot-reload worker processes, but FrankenPHP's Rust runtime has its own compilation chain. The WordPress and Drupal plugin ecosystems do not automatically recompile just because an 8.3.36 release exists; each hosting provider and cloud platform's CI pipeline has to be triggered one by one. The time cost of ecosystem synchronization often exceeds the patch development itself.

The core human force maintaining this pipeline - Debian packagers - receives less than $700 a month in sponsorship, propping up the foundation of 69.3% of the world's websites. EOL versions (8.1 and below) are not among the four fixed branches; CISA's advice has no second option: if you cannot pull a supported version, take it offline and isolate it.

PHP2Shell remediation pipeline and time consumed at each stage

PHP2Shell remediation pipeline and time consumed at each stage

How to fill the four-day window when in-the-wild exploitation precedes the patch

Four days before the patch went online, a PoC was already circulating on gray markets. There is an information gap worth noting here: CISA wrote in its announcement text "no actual attacks observed as of publication," while CERT-EU's simultaneous statement explicitly noted that a PoC had already spread. The two agencies use different monitoring calibers, but they point to the same fact: attackers do not need to wait for an official announcement; they only need to wait for the PoC to change hands for the first time on a dark web forum.

Cloudflare's CEO gave a data anchor: 10 hours before formal disclosure, thousands of exploitation attempts had been recorded across the network; 45 minutes after the announcement, the number jumped to tens of thousands; within two hours it exceeded hundreds of thousands. The curve is exponential, meaning each additional hour of waiting creates a newly compromised surface several times larger than the previous hour.

What can the defenders do in these four days? WAF rules can block malformed multipart signatures, but php.net's original text is "there is no complete mitigation; upgrading is the only safe choice." WAF blocks traffic signatures; it cannot stop an attacker from changing the encoding and attacking again. Cloudflare network-layer rules can buy a few more hours of emergency window, but they cannot replace the underlying parser fix. For systems running EOL versions, CISA's advice is single: pull the machine off the network.

The different levels of government response actually reflect different resource constraints. Finland took public-facing websites offline directly; Japanese Prime Minister Sanae Takaichi publicly said "if there is no time to fix it, temporarily closing the site is also an effective risk-reduction measure"; the NSA pushed update instructions to all federal agencies using PHP; Canada, the UK, Singapore, Australia, and the European Commission issued simultaneous warnings. The actions differ, but the logic is the same: before the patch arrives, shrink the exposure surface to zero.

From experience, the four-day window is not a PHP-specific case. As long as the discovery side keeps running faster than the deployment side, the difference in every "2-day discovery + N-day fix" cycle is a natural window for in-the-wild exploitation. There are two executable paths to shortening N: one is to build patch distribution into the CI/CD pipeline so the deployment side runs at the same speed as the discovery side, with hosting providers and cloud platforms automatically triggering upgrades at the same time the announcement is published; the other is to establish a mandatory isolation mechanism for EOL versions so that "temporarily running" no longer means "running forever." Without these two, the next PHP2Shell window will only be longer, because discovery-side speed is still rising.

Selection decision: which remediation path should your PHP assets take

Decision table: version x maintenance status x hot-update capability

The php.net announcement left only one judgment: "there is no complete mitigation; upgrading is the only safe option." But the premise of upgrading is knowing which version and which runtime you are running on. The official fixed versions are only four branches: 8.5.12, 8.4.27, 8.3.36, 8.2.35; 8.1 and below are not in the backport scope.

Current version	Maintenance status	Runtime	Action	Downtime window
8.2 - 8.5	In maintenance	PHP-FPM	Hot-load new .so	< 30 s
8.2 - 8.5	In maintenance	Apache mod_php	Restart httpd	1 - 2 min
<= 8.1	EOL	Any	No official patch; upgrade major version or take offline	Depends on business
Any	-	With Cloudflare / Tencent Cloud WAF in front	Buys a 4 - 6 h window; does not replace the patch	0

Three things to do in the next seventy-two hours

First, asset inventory. Run php -v on all production environments; cloud vendor consoles (AWS ECS, Alibaba Cloud Function Compute, GCP Cloud Run) all have APIs to batch pull PHP version numbers. Miss one unmanaged virtual machine, and the entire patch chain breaks there.

Second, take offline what cannot be upgraded. CISA's wording is very direct: systems on 8.1 and below that cannot complete a major version upgrade in the short term should be disconnected from the network. Finland, the Netherlands, and Japan have already done this. WAF rules can buy four to six hours of buffer, but CERT-EU has confirmed that a PoC is already circulating; a buffer is not a solution.

Third, watch the logs. Grep access logs for abnormal multipart POST requests, focusing on paths that bypass the front-end framework and directly hit the PHP kernel handler. If a 404 is immediately followed by a 200, something has already gone in.

Architecture overview: one diagram explains the complete chain of discovery, fix, and verification

Mermaid flow diagram and key choke points

Put the previous four sections into one pipeline, and there are only two places that truly consume time: discovery to report (this time zero, AI directly produced a PoC), and patch backport plus ecosystem synchronization (four parallel branches, with downstream WordPress and Drupal maintainers still having to issue their own adaptation updates).

Full PHP2Shell attack-defense chain