PHP2Shell: AI Found the Memory Bugs Days Before the Patch, and Attackers Were Already Exploiting Them
The PHP2Shell saga compresses the interval between a vulnerability's discovery and mass exploitation: AI-assisted development turned memory bugs that once required deep specialization into usable exploits within days, while attackers were already striking before the patch shipped. Edge protections like WAFs buy time but don't replace the runtime update, and a leaked CVE with a wrong severity score directly costs unpatched servers.
PHP2Shell bundles two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that live in PHP's runtime memory and error handling. Wiz traced affected versions back to PHP 5.4 and showed every release in the past decade carries at least one of the flaws. The team also demonstrated a path that reads passwords, tokens, and API keys from process memory without remote code execution. OpenAI's Calif used GPT-5.6 Sol under the Patch the Planet program to find one critical flaw, while Wiz independently discovered both and used Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol to adapt the exploit across PHP versions, configurations, and memory layouts.
Attackers moved before the patch existed. AWS MadPot recorded an exploitation attempt on October 17, four days before the advisory. Cloudflare reported thousands of attempts within hours of the announcement, spiking to hundreds of thousands within two hours. The PHP Foundation moved the release from October 22 to 21 after CVE numbers leaked early with an incorrect 10.0 severity score, and distributors were left scrambling. Patched releases are 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Administrators must verify the actual PHP-FPM or mod_php binaries, not just the CLI version, and confirm container images and workers restarted. WAFs from Cloudflare gave a default protection layer, but the NSA advisory is blunt: inventory PHP services, patch, or take them offline.
The hardest part of PHP2Shell isn't that AI found a bug; it's that AI-era tooling lets researchers and attackers alike turn memory-corruption findings into working exploits across varied PHP environments, shrinking the time from a discovered flaw to a usable attack.
The early CVE leak with a wrong severity score shows how fragile coordinated disclosure becomes as participant count grows; one mistaken number forced a release a day early and left distributors unprepared.
AWS's pre-disclosure observation and OpenAI's claim that frontier AI found the flaw earlier than attackers are not in tension: research advance does not guarantee secrecy, and the four-day gap is best treated as a forensic starting point, not a settled explanation.
Edge protections like WAFs buy time but create a false sense of completeness when backends or test environments bypass them; only the patched runtime closes the hole.
Measuring AI's security contribution by the number of discovered vulnerabilities overstates its value; the actual test is whether findings translate into patches that reach running systems before exploitation.