PHP2Shell, step by step

In August 2026, security firms Calif and Wiz, using OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon, found two critical flaws (9.2 out of 10) in PHP, the code behind 69% of websites whose server language is known. On 21 October, Finland shut down its public state websites and the US NSA advised organizations that could not update at once to take systems offline.

As of 25 Oct 2026

69%
of websites with a known server language run PHP
9.2
out of 10: PHP's own severity rating for both flaws
71 days
from Calif's first report to PHP's fix
4 days
before the fix, Amazon's trap servers caught an attack attempt

Step by step

“With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work.” — Wiz Research

2024
PHP
A security audit turned up the first signs of the memory flaw. Nobody found a way to attack it, and work on a fix kept stalling.
Source: PHP Foundation
30 Jul
Calif
Security firm Calif started checking PHP for OpenAI's Patch the Planet program. By 1 Aug, working with OpenAI's GPT-5.6 Sol, it had found a way to run its own code on WordPress sites.
Source: Calif
11 Aug
PHP
Calif reported the flaw to PHP. Fixing it became the top job for the PHP Foundation's security team.
Source: PHP Foundation
19 Aug
Wiz
Wiz found the flaws on its own, using Google's Gemini 4 Argon, GPT-5.6 Sol and its own tool. By 21 Aug it could run code on Drupal and WordPress without logging in. It told PHP on 24 Aug.
Source: Wiz
18 Sep
OpenAI
OpenAI sent PHP more ways to attack the flaw.
Source: PHP Foundation
17 Oct
Attackers
Amazon's trap servers caught someone trying the attack, 4 days before it went public. It is unclear how they knew.
Source: Amazon
20 Oct
PHP
The flaws' ID numbers leaked online, so PHP moved the fix up by a day. Calif posted a video of its attack by mistake, and copies spread.
Source: PHP Foundation
20 Oct
Wikimedia
Wikimedia took its servers for volunteer tools and other services offline as a precaution.
Source: Wikimedia Foundation
21 Oct
Cloudflare
Cloudflare switched on blocking rules for customers on every plan, free included, about 9 hours before the fix went public.
Source: Cloudflare
21 Oct
Chainguard
Chainguard released fixed copies of PHP more than 6 hours early, breaking the agreed plan. Attackers could now study the fix.
Source: PHP Foundation
21 Oct
Finland
Finland's government IT centre cut off all outside traffic to state online services as a precaution.
Source: Valtori
21 Oct
PHP
PHP released the fix. The US NSA told organisations that could not update at once to take the system offline.
Source: NSA
21 Oct
ANA
Japanese airline ANA paused parts of its website and app. They came back on 23 Oct.
Source: ANA
23 Oct
PHP
PHP flagged a third, rarer flaw and a setting that blocks it.
Source: PHP

Is my site affected?

Source: PHP, Oct 2026

Yes, if your server runs a PHP version older than the safe one below. The flaws are in PHP itself, so updating WordPress or plugins does not fix them. If a host runs your site, ask it to update PHP.

Your PHP	Safe from
8.5	8.5.12
8.4	8.4.27
8.3	8.3.36
8.2	8.2.35
8.1 or older (back to 5.4)	No official update. Move to a supported version, or ask your host or Linux vendor for a patched build.

Flaw IDs: CVE-2026-109618 and CVE-2026-109619. A third, rarer flaw (CVE-2026-115560) also affects the safe versions. PHP's advice until its next release: set session.upload_progress.enabled=0.

What it meant

The same AI scored 95% on the UK's expert hacking tests

OpenAI, Jul 2026

Calif and Wiz both used GPT-5.6 Sol. On the UK AI Security Institute's expert-level hacking tasks, it solved 95%.

OpenAI: AI found it before attackers did

OpenAI, Oct 2026

“To our knowledge, frontier AI found these vulnerabilities before attackers did.” OpenAI calls it “one of the most impactful security issues in recent memory.”

AI is sending PHP far more bug reports

PHP Foundation, Oct 2026

Since 1 July, PHP's security team has published 15 flaws (CVEs) and sorted through more than 100 reports that were wrong, repeats or could not be reproduced.

PHP calls its own delay a failure

PHP Foundation, Oct 2026

PHP's team saw the first signs in 2024 but could not agree on a fix. “The delay was a structural failure.”

What came after

Sources (13)