Decade-old PHP bug puts websites at risk: How AI uncovered it, who is vulnerable and how to stay safe | Explained

PHP2Shell is a pair of critical flaws in PHP’s core engine, CVE-2026-109618 and CVE-2026-109619, that could let attackers run code remotely and steal data without logging in. Wiz Research found them using AI models; Amazon spotted attacks before disclosure. Here’s how they work and who is at risk.

Two critical vulnerabilities in PHP, the programming language behind around 70% of websites worldwide, have prompted urgent warnings from cybersecurity agencies. Dubbed PHP2Shell, the flaws could allow attackers to remotely run malicious code, steal sensitive data, and take control of affected servers without authentication.

Wiz Research found the flaws and announced them on 21 October 2026, alongside PHP security updates. Google, OpenAI, Amazon Web Services (AWS) and other tech firms worked with the researchers to analyse the vulnerabilities and develop safeguards. The discovery has also raised concern about how easily AI can now be used to build complex cyberattacks.

What are the PHP2Shell vulnerabilities?

The flaws sit in PHP’s core engine, not in any particular website application. They are tracked as CVE-2026-109618 and CVE-2026-109619. Both are memory-safety bugs that can lead to sensitive data leaks or remote code execution.

Researchers demonstrated successful attacks against WordPress, Drupal and Joomla. The weaknesses are not in these platforms themselves but in PHP, so any site running an affected version may be exposed. An attacker could gain access to passwords, authentication tokens, API keys and other data held in the server’s memory.

Affected versions go back to PHP 5.4, so software more than 10 years old may be vulnerable.

How did AI help uncover the flaws?

According to Wiz Research, frontier AI models helped investigators find the vulnerabilities and turn complex memory errors into working exploits. The team used Wiz Atlas, Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol.

Pragya Singha Roy