Remotely exploitable PHP bug found on 70% of world’s websites

What it is

PHP2Shell is the name for two PHP flaws, CVE-2026-109618 and CVE-2026-109619, that let an unauthenticated attacker run code on a web server. Calif found them with OpenAI's GPT-5.6 Sol during an August audit funded by OpenAI, under its Patch the Planet program. Wiz confirmed them independently.

How it works

The page gives little mechanism. It says exploitation can happen before a site's own code runs, so application-level checks do not help. Calif's CEO Thai Duong told the Wall Street Journal that the bug class was flagged decades ago and dismissed as too hard to exploit. The page says AI-driven attackers can now take control of a server's memory within a few dozen requests. It does not say which PHP component or request path is involved.

Preconditions / Affected

• Fixed releases cover only PHP 8.2 and newer: 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
• Backports for 7.4 to 8.1 were only starting to roll out on the day of publication.
• The page says 27% of PHP sites run PHP 7 and 7.7% run PHP 5, with no fix planned for the oldest branches. One estimate counts more than 800,000 internet hosts on branches that "will get no fix".
• Over one-third of PHP sites were unpatched at publication.
• Cloudflare's CTO Dane Knecht reported live exploit vectors for every customer, including free plans.

What to do

• Upgrade to one of the four fixed releases listed above.
• On 7.4 to 8.1, check your distribution or host for the backport and apply it once available.
• On PHP 7 or 5, no fix is coming, so plan a migration to a supported branch.
• GoDaddy urged its customers to upgrade.
• Cloudflare applied an emergency stopgap overnight and announced further patches hours later. The page does not describe its coverage.

Caveats

Finland's state IT center took several government web services offline as a precaution. In the Netherlands, NotuBiz council sites, MijnOverheid and the Dutch parliament's site also went down. The "most severe AI vulnerability that was ever found" claim is from Wiz's co-founder. The page gives no CVSS scores, no detection guidance and no workaround for unpatchable versions.