The Proof Was the Bottleneck: PHP2Shell and AI-Found Vulnerabilities

A post with 542,000 views says we’re in “Black October”. AI agent swarms are hacking half the internet. PHP is cooked.

PHP is not cooked. But what actually happened is a better story.

What PHP2Shell Is

• Two bugs in the PHP engine. CVE-2026-109618 and CVE-2026-109619. A malformed upload pushes PHP out of memory mid-request, and cleanup runs on memory that’s already gone.
• Pre-auth RCE on default Apache mod_php. Shown in the lab against WordPress, Drupal, Joomla and Magento.
• Harder on PHP-FPM. No full exploit for the first bug there yet.
• Patched on 21 October. A day early, because the embargo leaked on Hacker News.

What It Isn’t

• Not a 10.0. That was the leak. PHP scores both 9.2.
• Not a confirmed breach. Amazon saw attempts and wrote “broadly exploited”. The same post says it’s “unclear if any of these attempts would have succeeded”. Neither CVE is on CISA’s exploited list.
• Not attackers taking sites down. Government sites in four countries went offline. Their own admins pulled them.
• Not thousands of working exploits. Someone tested the GitHub PoCs. None worked on plain PHP. “It isn’t a Log4J moment.”
• Not unmaintained. The advisories name the four people who wrote the fix.

The Bug Was Found in 2024

An audit of PHP found this exact problem two years ago. It didn’t get fixed. The team that reported it this year explains why:

Exploitation was not proven, hence the bug was not fixed.

— Calif

That’s a fair call for a small team. The fix rewires how PHP handles running out of memory. Every option broke something. Without proof of harm, leaving it alone was the safer bet.

Then proof got cheap. Calif and Wiz both found the bugs in August using frontier models. Wiz says it built working exploits “in hours”, and that one researcher did in a week what used to take a top team months.

Wiz’s model was Gemini 4 Argon, which I benchmarked a week ago. On my code it was pricey. On PHP it turned a two-year-old “maybe” into remote code execution.

Then the Humans

In May I wrote that AI makes finding bugs cheap, and fixing stays expensive. PHP2Shell is that, with names and numbers:

• 13 people. That’s the PHP Foundation’s engineering team.
• $730,534. Its donations for all of 2025.
• Two months. From the first reports to a release, mostly spent disagreeing over which fix to ship.
• 390 files. The size of the fix, by one count.
• 100+ junk reports. Invalid or duplicate, against 15 real CVEs since July.

The Foundation called the delay “a structural failure”. It changed the rules so a disagreement can’t stall a fix again, and asked the companies making money on PHP to pay for it.

The Catch

• Attackers get cheap proof too. Amazon says AI makes it cheaper to turn a patch into an exploit.
• Someone was early. Amazon logged an attempt four days before disclosure. Nobody knows who.
• The labs paid for the finding. Nobody paid for the two months after.

Closing

Every big project has old tickets marked “won’t fix, not exploitable”. That used to mean “too expensive to prove”. It doesn’t anymore.

AI didn’t find PHP2Shell. It removed the excuse for leaving it open. The fix still came from 13 people, at human speed, on less than a million dollars a year.