PHP2Shell flaws draw millions of exploit attempts after AI-aided discovery
Two critical flaws in the PHP engine, which Wiz says frontier AI models made practical to exploit, were targeted millions of times, and Amazon saw an attempt four days before the patch.
Source published · In the Daily Brief of 23 October 2026
Filed under AI safety, AI industry
The PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October to fix two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution on servers handling web requests. Both stem from how PHP cleans up after fatal errors such as running out of memory, which can leave stale or half-initialised state for a later request to reuse. Wiz Research, which found them, says every PHP release back to 5.4 is affected by at least one.
Wiz says the underlying flaws were decades old but building a working exploit required a chain of steps at the edge of what human researchers could manage, and that frontier models cut that work to hours. It credited OpenAI and Calif for help with discovery and patch verification.
According to The Register, Cloudflare recorded thousands of attempts in the 10 hours before disclosure and millions since. Amazon Threat Intelligence said its honeypots caught an exploitation attempt on 17 October, while the flaws were still under embargo, and that it remains unclear how the attacker obtained the information.