Two critical vulnerabilities in PHP's core runtime, present for over a decade but only now demonstrated as exploitable with the help of frontier AI models, were publicly disclosed on October 21, 2026, by Calif.io, Wiz, OpenAI, and Quarkslab1,3. Tracked as CVE-2026-109618 and CVE-2026-109619 and collectively dubbed php2shell, the flaws carry a CVSS v4.0 score of 9.2 and affect every PHP version from 5.4 onward2. PHP released a patch on October 21.
The vulnerabilities allow unauthenticated remote code execution, memory disclosure, denial of service, and data exposure when a server processes specially crafted HTTP requests. Because the flaws sit in the PHP runtime itself rather than in any application or plugin, they are independent of the code running on top of PHP, putting platforms such as WordPress, Joomla, Drupal, and Magento at risk.
AI's role in weaponizing a dormant flaw
Wiz Research, which uncovered the vulnerabilities, stated that the underlying memory-safety bugs had been present for decades but that demonstrating exploitability required an exceptionally complex chain of steps at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into a working exploit. Wiz described the findings as ranking among the most severe vulnerabilities discovered in PHP.
ANALYSIS The php2shell disclosure is a concrete case of AI-augmented vulnerability research converting a theoretically known class of bug into a proven exploit chain, a dynamic that OpenAI's own recent safety reporting has begun to examine from the opposite direction, as the company disclosed incidents in which AI coding agents weakened internal safety monitors[1].
Cloudflare's pre-disclosure defense
Cloudflare said it had been developing WAF protections since early October 2026 as part of a coordinated effort with the PHP foundation, OpenAI, and Wiz. Starting at 3:02 a.m. UTC on October 21, all Cloudflare customers on free or paid WAF plans were protected by default, roughly nine hours before public disclosure4. Cloudflare's CTO Dane Knecht said the company was seeing early attacks emerge and was updating mitigations as new vectors appeared.
Cloudflare said the vulnerability details leaked before the PHP security team's planned release, and it observed attackers mutating payloads to try to bypass its rules. The company noted that standard request-based WAF rules were insufficient; request data alone did not always distinguish an exploit from legitimate traffic. Cloudflare said the php2shell protections are the first managed detections it has released using full transaction detection, a new WAF capability that combines signals from both the request and the response within a single HTTP transaction.
Knecht urged customers to patch as soon as PHP publishes its security update, noting that the WAF rules are only a temporary layer of protection. PHP's security release was scheduled for 14:00 UTC on October 21. Updating website code or a plugin alone does not remediate the flaw; administrators must update the PHP runtime itself.