PHP2Shell is the name for two critical bugs in PHP itself, the language under WordPress, Drupal and much of the web, that can let an attacker run code on a server without logging in.1 Told only that "something was coming in PHP," Chainguard's CEO says a one-line prompt and the company's AI harness found the same bugs again that night.2
What is PHP2Shell?
PHP2Shell is a pair of critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution on servers running PHP. The first corrupts memory when a request runs out of memory; the second reuses stale state from an earlier request. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix both.
The bugs sit in the runtime, below WordPress, Drupal, Joomla and their plugins, so updating those does not help. PHP says the risk is highest with Apache mod_php, where an unauthenticated request can trigger the attack before any application code runs. A leaked early notice gave a wrong score of 10.0; the PHP Foundation rates both bugs CVSS 9.2.3
Wiz, one of the reporters, says nearly every PHP version back to 5.4 is affected by at least one of the issues, and it demonstrated pre-authentication code execution on WordPress, Drupal and Joomla.4
What to do now
Update PHP itself, restart every PHP worker, and confirm the patched build is the one serving requests. Node.js, self-managed GitLab and LiteLLM each had their own urgent issue the same day. The box below has the fixed versions and one line for each, linked to the vendor's advisory.
If an immediate update is not feasible, the NSA recommends taking the system offline until it can be fully mitigated.5 Amazon logged an exploitation attempt four days before disclosure and advises investigating from at least October 17, so check logs from before the release too.6
Chainguard says one basic prompt found it again
Chainguard's CEO, Dan Lorenc, says a one-line prompt found PHP2Shell again. The Register reports that one of the researchers had told Chainguard only that "something was coming in PHP," and that the team found the same memory corruption bugs that night.2 The wording that went viral, "find bad vulnerabilities in PHP," came from an earlier LinkedIn post. He told the outlet:
Just being told there's a vulnerability in a piece of software - even something as big as PHP - is enough to find it. I did that myself without any other knowledge on Friday.
The prompt was simple; the machinery was not. Lorenc described the run, the model and the harness on X:
Excerpt from X
Dan Lorenc (@lorenc_dan) Chainguard CEO, :
The actual prompt for this was "let's look for pre-auth RCEs in PHP". I'm sharing this so people know this stuff is real and to take agent-assisted scanning seriously.
I kicked if off using Claude Mythos 5.1 (in stock Claude Code) but it uses a skill to drive a harness we built over the last few months.
I don't know if the harness is amazing, but it certainly has a scary track record so far. It's setup to do an agent guided tree search across a codebase, and runs in microvm sandboxes that all have the full source code for the target, as well as the source for any transitive dependencies.
When I built the harness I basically just fed Claude a bunch of Project Zero blog posts describing how they did research and had it build a harness that ran like that, but on our tech stack.
The first phase is just setup and can run with any model, it just does that fetching and assembles the kit environment, and gets a target up and running alongside the source code.
Then we just do some basic suspend/resume stuff over to the hunt phase, where one agent supervises the tree, and the first node kicks off.
Each node is context-aware and aware of the work of all the others. I think I ran this with parallelism 4? So 4 running at any one time. The supervisor can shape the tree and boost nodes or prune. Any node can add more below it with targeted instructions.
A typical run looks like the first node doing a codebase review or building and running a fuzzer or something, all depending on the target. Then based on whatever it finds, it'll queue 4-5 children that go look into those areas. The main system guidance is to validate everything 3 times in clean VMs, and we typically require full exploit chains/POCs.
If his account holds, the hard part is now buildable from public write-ups. It was a rediscovery, not the original find.
Who found the PHP vulnerability first?
Calif, Wiz and OpenAI found and reported the bugs first, after audits with frontier AI models. Calif, working in OpenAI's Patch the Planet program, reported a working remote code execution after using GPT-5.6 Sol.8 Wiz reported related bugs, and OpenAI independently reported the same root cause. A PHP core developer had first seen signs of the problem in 2024, but the fix stalled.3
OpenAI president Greg Brockman described the sequence in an article he posted on X, "Towards securing the internet": Calif "used GPT-5.6 Sol to find a version of this bug in August; our team found a more complete version independently in September."
The timeline shows the months of collective work behind the release.
People still made the calls. The PHP Foundation describes how its security team uses AI now:
AI helps the team validate reports and group reports sharing the same root cause, but a person makes every call and works on every patch.
What's confirmed and what's hype
Exploitation attempts are confirmed; a break-in of a named production site is not, in the sources we reviewed as of October 22. The hype is the version that says ChatGPT, or AI on its own, found PHP2Shell; the table sets the record straight.
| What you may have read | What the record shows |
|---|---|
| "Millions of attacks" | Attempts on Cloudflare's network, counted by its CEO (below).9 Attempts, not confirmed break-ins. |
| "Sites are being hacked" | Amazon logged exploitation attempts and says it is unclear whether any would have succeeded on real-world systems.6 The sources we reviewed as of October 22 name no confirmed compromise of a production site, which is not proof that none happened. |
| "ChatGPT found it" | The original reports came from audits by Calif, Wiz and OpenAI; see who found it first, above. |
| "AI found it on its own" | Researchers ran the audits and the tooling, and PHP's maintainers validated the reports and wrote the patches.3 |
| "It's a CVSS 10" | The leak said 10.0. PHP rates both bugs 9.2. GitLab's same-day bug is the one rated 10.0. |
Cloudflare's CEO posted the attempt counts from his network:
Quoted from X
Matthew Prince (@eastdakota) Cloudflare CEO, :
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
SecurityWeek, which printed his post, also quotes watchTowr's Jake Knott: the exploits being sprayed "either don't work at all, test for timing-based differences, or crash the target." The PHP security team says it found no functional exploit among the public proofs of concept it inspected after the leak, as of the release; the researchers' own exploits did work.3
A wave of attempts is a reason to patch now, not proof that your site was breached.
Can you use AI to find bugs like this in your own code?
Yes, for code you own, with a person checking every result. Anthropic lists "code review, patching known issues, vulnerability finding in owned source code, and triage of security alerts" as uses its generally available models still support.10 Explaining a finding, fixing a known bug and checking whether a patch closes it are the everyday uses.
Expect friction when the work looks like exploitation, such as reproducing an attack or reading a real payload. The same Anthropic page says its general models "have conservative cyber safeguards that block most cyber work." Hugging Face hit that wall during an incident, as our report on Anthropic's GLM-5.3 research covers:
When we started the log analysis, we first used frontier models behind commercial APIs. This did not work: the analysis requires submitting large volumes of real attack commands, exploit payloads, and C2 artifacts, and these requests were blocked by the providers' safety guardrails, which cannot distinguish an incident responder from an attacker. We ran the forensic analysis instead on zai-org/GLM-5.2, an open-weight model, on our own infrastructure. This had a second benefit: no attacker data, and none of the credentials it referenced, left our environment.
That shows some commercial APIs blocked real forensic work and that a self-hosted open model finished it.11 It doesn't show that every model refuses. Our guide to using AI privately covers what to check before you paste code anywhere.
Where your unpatched code goes when you ask
It depends on the route, product and plan: Anthropic offers approved zero-data-retention arrangements for eligible commercial API products and Claude Code for Enterprise, not Claude Free, Pro or Max subscriptions. OpenAI's API controls require prior approval and acceptance of additional requirements. Vetted cyber programs reduce blocks and generally keep prompts to monitor misuse. With an open model the provider can't see into, the code stays out of the provider's view.
| Route | What happens to your code | Refusals |
|---|---|---|
| General AI service | Retention depends on the product and plan. Anthropic: approved zero-data-retention arrangements for eligible commercial API products and Claude Code for Enterprise, not Claude Free, Pro or Max; safety-classifier results are still kept. OpenAI: the API does not train on your data unless you opt in; zero data retention needs prior approval and acceptance of additional requirements, and some endpoints still store state.12, 13 Approval does not make every endpoint or model retention-free; check the exact model, feature and exception terms. | Anthropic supports code review and vulnerability finding in owned code on its general models, and blocks most other cyber work.10 |
| Vetted cyber program | Anthropic requires retention to monitor misuse, except for organizations already on zero data retention for Claude Fable 5.1 or Mythos 5.1, and plans customer-controlled storage.10 OpenAI says its permissive cyber models may have zero-data-retention limits.14 | Fewer blocks after verification; some actions stay blocked. |
| Open model the provider can't see into | Self-hosted: it stays on your infrastructure. On Maple: Maple cannot see your chats, on every plan. | The model's own trained-in limits. |
The programs exist for a reason: the capability that finds a bug can help someone exploit it, and the labs want to know who is asking. Anthropic verifies every applicant and aims to answer defensive applications within a few days and red-team applications within a few weeks. For unpatched code, check the exact terms before you paste, or use a model the provider can't see into.
Before the next patch day
AI-assisted discoveries are recurring on the record. The PHP Foundation says its security team has published 15 CVEs since July 1 and worked through more than 100 reports that were invalid, duplicates or not reproducible.3 One day's releases carried AI-credited fixes from two projects.15
If a one-line prompt on the right tooling can find a bug from a hint, as Lorenc says his team's did, you want the same help on your own code, right away, without applying and waiting.
So set it up before you need it: a capable model you trust, already at hand, that you can point at your own code the moment an advisory lands.
That is the job we built Maple for. We offer open models, including GLM-5.3 and DeepSeek V4.1 Flash, on our Pro, Max and Team plans. That doesn't mean they match the tooling that found PHP2Shell; it means you can start reviewing your own code and checking fixes today. Teams can call the same models from their own tools through Maple Proxy.
Maple cannot see your chats on any plan.
Sources
- PHP, Security advisory: Critical remote code execution vulnerabilities, update now, October 21, 2026. Fixed versions, affected setups, PHP 8.1 and older, mitigations.
- The Register, PHP blames supply chain security biz Chainguard for putting huge chunks of the web at risk, October 22, 2026.
- The PHP Foundation, Today's PHP Security Release, and How We're Strengthening PHP Security, October 21, 2026. Discovery history, CVSS 9.2, the leak, inspected proofs of concept and report volume.
- Wiz Research, PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet, October 21, 2026.
- National Security Agency, NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities, October 21, 2026.
- Amazon Threat Intelligence, Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot, October 21, 2026.
- Dan Lorenc, post on X, October 22, 2026. The actual prompt, the model and the harness.
- OpenAI, Patch the Planet: global response coordination as agents uncover critical vulnerabilities, October 21, 2026.
- SecurityWeek, PHP2Shell Exploitation Started Days Before Patches, October 22, 2026. Prints Matthew Prince's post and quotes Jake Knott.
- Anthropic, Expanding the Cyber Verification Program, October 6, 2026.
- Hugging Face, Security incident disclosure — July 2026, July 16, 2026.
- Anthropic, I have a zero data retention agreement with Anthropic. What products does it apply to?.
- OpenAI, Data controls in the OpenAI platform.
- OpenAI, Trusted access for the next era of cyber defense, April 14, 2026.
- The Node.js Project, Wednesday, October 21, 2026 Security Releases, October 21, 2026.
