PHP2Shell Shows How AI Accelerates Legacy Exploits | Zeniteq
Loading
Loading article
Zeniteq is now available on mobile for iPhone, iPad and Apple Watch.Download nowLearn more
PHP2Shell Shows How AI Accelerates Legacy Exploits
Researchers used AI to turn a known PHP crash into a critical exploit, exposing a gap between finding dangerous bugs and safely fixing the software behind them.
Researchers utilized AI to transform a long-standing, unexploited memory-error condition in PHP into a critical remote code execution vulnerability, identified as CVE-2026-109618 and CVE-2026-109619. By automating the complex reasoning required to chain interrupted execution paths, AI helped security teams weaponize a use-after-free flaw that had previously been dismissed as a mere crash. This development highlights a critical shift in vulnerability triage, as AI significantly lowers the barrier for turning theoretical bugs into active exploits, forcing administrators to prioritize patching the underlying PHP runtime across all server configurations immediately.
PHP had released fixes for PHP2Shell before IEEE Spectrum published its November 2, 2026 analysis. The security story now is what the discovery reveals: expert researchers used AI tools to develop a known memory-error condition into a way to execute code on a server, while repairing the underlying software required months of engineering.
The findings came from a PHP audit by security company Calif, sponsored by OpenAI, with Wiz confirming and expanding the research. The vulnerabilities were disclosed on October 21, alongside a PHP security release. PHP2Shell covers two identifiers, CVE-2026-109618 and CVE-2026-109619, encompassing several related memory-safety problems. (IEEE Spectrum, Calif)
For administrators, the immediate action is straightforward: install the relevant PHP security updates. For maintainers, the harder lesson concerns old crash reports. A bug that previously seemed too difficult to exploit may deserve another look when AI can help researchers work through its complicated consequences.
A Crash Report Was Only the Starting Point
Calif’s account gives the problem a longer history than the 2024 report highlighted by Spectrum. According to its technical write-up, a 2020 PHP bug report described an out-of-memory condition and temporary files that were not properly cleaned up. An OSTIF and Quarkslab audit revisited the issue in 2024, but exploitation was not demonstrated and the bug remained unfixed.
Calif dates the start of its OpenAI-backed project to July 30, 2026, and its first critical discovery to August 1. The researchers subsequently found additional paths and developed exploits against different PHP deployment configurations. (Calif)
That chronology changes how to interpret the AI contribution. AI did not simply discover an unknown flaw in untouched code. Researchers investigated a known failure mode and established that its consequences were much worse than a crash.
The technical distinction matters. PHP’s memory_limit controls how much memory a script may allocate. Exceeding that limit can trigger a fatal error that interrupts execution. An out-of-memory failure is not, by itself, proof that an attacker can execute code.
The dangerous behavior described by Calif occurs during interruption and cleanup:
A fatal error interrupts native PHP code. Execution stops before that code completes its normal cleanup.
Internal state survives in an inconsistent condition. Some references can remain even though the operation that created them did not finish.
Request shutdown frees memory. Surviving state may still point to those freed allocations.
Stale references become an exploitation opportunity. Under the right conditions, accessing freed or reused memory can expose data or enable memory corruption.
This is a use-after-free problem: software continues using memory after its ownership or lifetime has ended. The failure concerns PHP’s native implementation, so secure application code alone cannot remove it. (Calif, Wiz)
My reading is that the neglected signal here was incomplete cleanup, not merely a dramatic crash. A crash report involving stale state or interrupted resource handling deserves security attention even before someone supplies a working exploit. PHP2Shell shows why waiting for that demonstration can leave a dangerous issue unresolved for years.
What AI Contributed to the Exploit
Calif describes asking an AI model for help finding ways to trigger controllable memory-limit failures. One useful finding concerned getting past the smaller post_max_size barrier that would ordinarily prevent a request from creating enough memory pressure to reach memory_limit.
That was one component of a larger research problem. The team also needed interruption points that left usable stale state, ways to disclose memory, and exploit chains adapted to particular applications and server configurations. Calif reports successful exploitation involving both mod_php, which integrates PHP into Apache, and PHP-FPM, a separate process manager commonly used to serve PHP applications. (Calif)
Columbia University computer scientist Suman Jana told Spectrum that the work still demanded deep security and PHP expertise. He described the difficult part as:
“It’s just that it’s a lot of very specific reasoning that is painful to do.”
Wiz similarly says frontier models helped its researchers develop and adapt working exploits across multiple applications in hours. That is a participant’s account, not an independent benchmark of AI performance. The published evidence does not provide a controlled comparison using the same researchers, targets and time budgets with and without AI. (Wiz)
The supported conclusion is narrower, but still important: AI helped experts connect complicated pieces that had previously prevented a known bug from becoming a demonstrated exploit.
I would treat that as a change in vulnerability triage. “Exploitation looks complicated” is a weaker reason to postpone investigation when tools can reduce the reasoning cost. This case does not show that inexperienced attackers can reproduce every such result, or establish how quickly future vulnerabilities will emerge.
Why Fixing the Bug Took Longer
Spectrum reports that the patch required four engineers working for two months. Its account describes a researcher reaching an arbitrary-code-execution path within two weeks of the audit. Calif’s timeline places the first critical discovery just days after work began. Those milestones describe different stages of the investigation, so they should not be converted into a neat discovery-versus-patching speed ratio. (IEEE Spectrum, Calif)
They nevertheless reveal a practical asymmetry.
An exploit needs one reliable path through the software into an unsafe state. A repair must close that path without breaking legitimate behavior, and maintainers must investigate related paths that could fail for the same reason. Wiz describes several exploitable instances grouped under the two CVEs and ties them to long-standing architectural decisions in PHP’s fatal-error handling. (Wiz)
PHP’s deployment diversity makes that work consequential. Application behavior, PHP versions and server interfaces affect the available exploitation paths. Calif says the earliest affected path it found dates to PHP 5.4.0; that is not a claim that every version and configuration uses an identical exploit.
There is also a second clock after maintainers release a fix: deployment. Hosting providers and administrators must identify affected installations, obtain suitable packages and replace the vulnerable running software.
The practical implication is that patch-production speed and patch-deployment speed are separate security problems. AI-assisted research can increase pressure on both. A project may coordinate disclosure successfully while customers remain exposed because their production runtime has not been updated.
The Runtime Matters More Than the CMS Label
Calif reports demonstrated pre-authentication remote code execution against applications including WordPress, Drupal, Joomla, MediaWiki, Roundcube and Nextcloud. “Pre-authentication” means those demonstrated attacks did not require an attacker to log in first. Wiz also reports application-independent disclosure of PHP worker memory, which could contain credentials, tokens or other sensitive data. (Calif, Wiz)
Those examples identify demonstrated targets, not a complete inventory of exposed websites. The underlying flaws sit in PHP itself.
Deployment detail
Practical consequence
PHP runtime version and security patch level
Determine whether the installed engine contains the relevant fixes.
Server interface, such as PHP-FPM or mod_php
Can affect which exploitation paths are available.
Application behavior
Can influence how an attacker reaches vulnerable runtime behavior.
CMS, plugin and theme versions
Remain important for application security, but do not establish that PHP itself is patched.
I would put runtime verification ahead of debating whether a particular CMS appears on the demonstration list. An application update and a PHP engine update address different layers.
The supplied sources do not provide a complete fixed-version matrix for every supported PHP branch or downstream package. Administrators should therefore check their PHP distributor’s security notice, including whether a fix was backported, instead of assuming that a version number alone settles the question.
What Formal Verification Could Change
Wiz’s description points toward a deeper engineering question: can PHP guarantee that fatal-error handling leaves no unsafe references behind?
Formal verification uses mathematical methods to establish specified properties of a model or implementation. Applied to this class of problem, a useful property might be that memory freed during request shutdown cannot remain reachable through state that will later use it.
That is a proposed engineering direction, not a reported outcome of the PHP2Shell work. The sources do not show that the affected PHP paths have been formally verified.
The potential benefit is broader than blocking one exploit. A well-chosen proof could cover a defined family of execution paths, including interruption cases that are difficult to exercise comprehensively through testing. For example, maintainers could seek guarantees about ownership and cleanup when an allocation fails halfway through an operation.
The limits are substantial. Teams must specify the right property, model relevant behavior and keep the proof aligned with changing code. A proof about cleanup would not automatically guarantee correct application logic, secure deployment or the absence of unrelated vulnerabilities.
My view is that narrowly scoped verification is the credible starting point: identify a critical lifecycle boundary, state its safety requirements precisely, and verify those requirements where feasible. Trying to prove an entire mature runtime secure would be a much larger undertaking. Neither approach replaces today’s security update.
What Maintainers and Administrators Should Do Now
Johns Hopkins security researcher Matthew Green’s advice in Spectrum is to install available security updates promptly. PHP2Shell makes that advice unusually concrete because the vulnerable component sits underneath many different applications. (IEEE Spectrum)
For teams operating PHP services, a practical response is to:
Inventory production PHP runtimes. Include hosted sites, containers and older services that may fall outside the main deployment process.
Confirm the relevant security fixes are installed. Check the package provider’s guidance and the runtime actually serving requests.
Complete any required worker or service restart. Replacing files on disk is not enough if old processes continue running vulnerable code.
Use provider mitigations as a temporary bridge. Wiz reports coordinated mitigation work with infrastructure companies, but applicability depends on the provider and deployment.
Revisit deferred crash reports. Prioritize reports involving fatal errors, incomplete cleanup and stale references, especially when exploitability was the unresolved question.
For website owners without server access, the useful question for a host is specific: has the PHP runtime received the fixes for both PHP2Shell CVEs?
For maintainers, the longer-term task is equally specific. Reduce the backlog of poorly understood failure paths, and make patch delivery predictable before the next complicated crash becomes a practical exploit.
Frequently Asked Questions
3 questions
1
Is Updating WordPress Enough to Fix PHP2Shell?
Not necessarily. PHP2Shell affects the PHP engine beneath the application. Confirm that the server’s PHP runtime has received the relevant security fixes, alongside normal CMS updates.
2
Did AI Discover PHP2Shell Without Human Experts?
No. The published accounts describe expert-led research using AI tools. AI helped investigate and develop exploitation paths, while researchers supplied security knowledge, direction and validation.
3
Can Formal Verification Prevent Similar Bugs?
It could help establish specific memory-safety and cleanup guarantees. Its protection depends on what is proved and the assumptions involved; it is not a substitute for patching the disclosed vulnerabilities.
