PHP2Shell: AI Found a 14-Year-Old Bug in 70% of the Web #Shorts
Two critical flaws in PHP, the language behind about 70% of websites, were disclosed on Oct 21, 2026. They're nicknamed PHP2Shell, and AI helped find them.
- CVE-2026-109618 and CVE-2026-109619 can allow remote code execution with no login. The flaws are in PHP itself, not just in apps like WordPress, Drupal or Joomla (Wiz Research).
- Nearly every PHP version is affected, going back to PHP 5.4 (Wiz Research).
- OpenAI's Greg Brockman says the bug sat in PHP for 14 years. Calif, Wiz and OpenAI each found parts of it using AI models, including GPT-5.6 Sol and Gemini 4 Argon (Fortune, Wiz).
- Palo Alto Networks counted 22.6 million potentially vulnerable instances, and Cloudflare saw early attacks before the patch (Fortune).
- The NSA urged organizations to patch now, or take systems offline if they can't (India TV News). Some government sites in the Netherlands and Finland went offline as a precaution (Reuters, via Fortune).
The fix: update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.1 and older get no fix, so upgrade. On shared hosting? Ask your host whether they've patched.
Is your site patched?
Sources
- PHP Foundation, Oct 21, 2026 releases
- Wiz Research, PHP2Shell
- Fortune, Oct 21, 2026
- India TV News, NSA guidance
- All graphics made by USASIHQ. Figures as reported by each source. Not affiliated with PHP, Wiz, OpenAI or the NSA. Narration is a synthetic voice.