AI found a decade-old hole in PHP

First of three. Fable, Mythos, and Google's cyber model is who is allowed to run this kind of work. Are we entering a new age of decade-old vulnerabilities? is what that means for banks, hospitals, and the memory on a PHP worker.

On October 21, 2026, PHP shipped emergency releases for two flaws that had been sitting in the engine since the PHP 5.4 era. Wiz Research calls the pair PHP2Shell. Both are scored CVSS 9.2. They allow unauthenticated remote code execution, and one of them can also read process memory the way Heartbleed read OpenSSL. The application on top can be a hardened WordPress, a one-file script, or Wikipedia's MediaWiki. The bug is underneath it.

Wiz's account of the work is the part that changes the next ten years. The flaws came from architecture decisions more than a decade old. Demonstrating that they were exploitable took a chain long enough that it sat at the edge of what a human research team could practically finish. Frontier models made that chain practical, and made it portable across targets in hours.

The hole is in the language, so the site does not have to be sloppy

PHP is the server-side language behind a large share of the public web. Wiz's figure, the one reporters have been repeating, is about 70% of websites. WordPress, Drupal, Joomla, Magento, WooCommerce, Laravel, and Symfony all sit on it. A core-engine bug inherits that entire estate.

PHP2Shell.com, the researchers' own summary, splits the finding into two classes:

• CVE-2026-109618 is out-of-memory corruption. PHP can be interrupted while a request's internal data is only partly initialized. Cleanup then treats that invalid data as valid. Wiz demonstrated pre-authentication code execution, as the PHP worker, on WordPress, Drupal, and Joomla.
• CVE-2026-109619 is stale state across requests. Memory that belonged to one request can still be consulted by a later request on the same worker. That path can disclose worker memory or execute code. The disclosed memory can hold passwords, session tokens, API keys, and certificates from other requests, or from the server itself.

The vulnerable range is PHP 5.4 through 8.5.11. The first fixed releases are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older are end of life, and the project is not shipping fixes for them. Updating a plugin or a CMS does not touch the runtime. Restarting the workers after the runtime update does: a replaced binary that is not the process still serving traffic is still the old bug.

Source: PHP Supported Versions, PHP.net.

The step-by-step patch, the distro-backport caveat, and the NCSC's "take it offline if you cannot patch" line are in the October 21 fix post. This one is about how the bug was found.

Three labs, three models, one coordinated release

The public credit line is wider than a single model demo. Wiz names Sagi Tzadik, Shir Tamari, Nir Ohfeld, and Tomer Schwartz. OpenAI Codex Security (Amy Burnett) and Calif (Ryan A.) worked the same disclosure with the PHP security team and with Google's Gemini team. The model mix Wiz lists is its own Atlas system, Gemini 4 Argon, and GPT-5.6 Sol. Google Cloud's advisory singles out Argon for the finding, the exploit development, the detection work, and the check that the patch actually held.

CNN reported that the bugs were found in late August and held until PHP had a fix. That is a normal embargo. What was new is the speed inside it. Wiz says frontier models were what made it practical to build the chain, then adapt it across applications and memory layouts in hours. A week of that work, in their telling, replaced months for a specialist team.

The PHP project scheduled the emergency release for October 21 at 14:00 UTC. The identifiers and demonstrations leaked ahead of that window. By the morning of the release, Cloudflare was already seeing attack traffic. Amazon later said its MadPot honeypot had been targeted while the report was still under embargo. CISA's alert the same day said the agency had not observed exploitation as of publication, and still told operators who could not patch to take PHP systems offline. Those statements measure different sensors. They agree on the action.

Complexity stopped being a lock

Wiz puts PHP2Shell next to two earlier breaks in shared infrastructure. Heartbleed, in 2014, was a bug in the library that terminated TLS for a huge fraction of the internet. Log4Shell, in 2021, was a bug in a logging dependency that teams could not even inventory. PHP2Shell is their candidate for the third: a bug everyone already ran, which stayed theoretical until a model could finish the chain.

That is a change in the definition of "vulnerable." A memory-safety bug that needs a specialist month, a lab, and a custom heap layout is a research finding. The same bug, once a model can retarget it between a WordPress host and a Drupal host before lunch, is an incident. The code did not get worse in August. The cost of understanding it did.

The researchers were on the defensive side of that cost curve. They held the report, worked the patch, and published after the fixed releases existed. The same cost curve applies to everyone else who can call a model of that class. The access rules around those models are the subject of the next post. The systems that still run the unpatched runtime — government sites, hospital portals, shop backends, bank-facing PHP — are the one after that.

The vulnerability classes and the model list are from Wiz Research, PHP2Shell.com, and Google Cloud's advisory. The August discovery timing is CNN's. Patch steps: NCSC Critical PHP Security Alert.