The two critical PHP flaws patched on 21 October, known together as PHP2Shell, were found and turned into working exploits with the help of frontier AI models, according to the research teams that reported them. Their accounts show AI shortening two steps of vulnerability work, finding the bug and building the attack, while the slowest step, deciding on a fix, stayed with a small group of people.
Who found PHP2Shell, and with what
PHP2Shell covers CVE-2026-109618 and CVE-2026-109619, memory-safety flaws in the PHP engine that the PHP Foundation says can let an unauthenticated attacker run code on servers running PHP. The fixes shipped in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
The PHP Foundation’s account gives the order of events. The Foundation brought PHP into OpenAI’s Patch the Planet program, under which the security firm Calif began auditing PHP on 30 July. On 11 August a Calif researcher reported a remote code execution flaw with the same root cause as an out-of-memory problem the PHP team had first seen during a 2024 audit. OpenAI independently reported the same root cause. Wiz reported further attack paths on 24 August and OpenAI on 18 September.
Wiz Research says in its write-up that it used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout the work, and says Gemini 4 Argon contributed to finding the flaw, building the exploit, detecting attacks and validating the patch. Raluca Ada Popa, Head of Gemini Security at Google DeepMind, is quoted in the post: “For over a decade, these critical vulnerabilities remained unaddressed because vulnerability discovery and exploitation were incredibly complex.”
Where the models saved time
The two reporting teams describe the models’ role differently.
Calif puts the weight on the researcher. Ryan Austin of Calif, who did the research and wrote it up, says the first bug came from a theory about a 2004 PHP flaw that he prompted the model to explore. “No special harness, or access to models that weren’t generally available to everyone were used in the initial bug discovery,” he writes in Calif’s research post. He adds that models tend to start from recent, well-known bugs, so a researcher who knows a target’s history has to steer them toward older patterns.
Wiz puts the weight on exploitation. Building a working attack meant chaining several flaws and adjusting to each target’s memory layout through repeated testing. “Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours,” Wiz writes. It demonstrated attacks without a login on WordPress, Drupal and Joomla, and says even a simple application on an affected PHP version can be exposed.
Both accounts agree on the result. A flaw whose roots go back to PHP 5.4 had been hard to exploit for years because of the effort involved, and the models cut that effort.
Where they did not
The PHP Foundation’s post describes the part AI did not speed up. During the 2024 audit, a core developer found the first signs of the out-of-memory problem. The security team then developed several competing fixes, each with costs in compatibility, new denial-of-service risk or changes to third-party extensions, and work stalled and restarted for months. The Foundation calls the delay “a structural failure” caused by the team’s decision process and its lack of resources.
AI also added work for maintainers. The Foundation says the PHP security team has published 15 CVEs since 1 July and worked through more than 100 reports that turned out to be invalid, duplicates or not reproducible. It uses AI to validate reports and group those with the same root cause, and says a person makes every call and works on every patch. Earlier this year it scanned PHP with Anthropic’s Claude Mythos through Alpha-Omega, and it now also uses OpenAI’s Daybreak Red to validate reports and exploits.
The window between disclosure and attack
Attackers did not wait for the release. Amazon Threat Intelligence reported an exploit attempt against its MadPot honeypots four days before public disclosure, from an IP address tied to a commercial anonymization network, and says it is unclear how the actor got exploit information. Its post says: “A 7-day or 30-day SLA assumes a delay that no longer exists.”
The disclosure itself was rushed. The Foundation says the CVE numbers leaked on 20 October with a wrong score of 10.0, the release moved forward a day to 21 October, and a proof-of-concept video that Calif published by mistake contributed to faster development of exploit code.
What it means for AI and security leaders
In our reading, PHP2Shell is a well-documented public case of AI lowering the cost of exploiting an old, complex class of bug, and it arrives as model vendors push agents deeper into engineering work. Our coverage of Gemini 4 Argon’s launch pricing and Atlassian’s survey of developer time saved with AI tracked the same tools from the productivity side.
- Plan patch windows in hours. Amazon’s guidance is to start investigations from the earliest known exploitation, 17 October in this case, and to measure patch and mitigation times in hours for critical internet-facing flaws.
- Fund the fix side. If your team runs AI-assisted code audits, budget for the people who triage the output and the maintainers who receive it. The PHP Foundation is asking companies that build on PHP to sponsor it at a level that matches their use.
- Check exploit claims before acting on them. The PHP security team inspected the proofs of concept that appeared after the leak and says it found no functional exploits at the time of release. Test unverified code in an isolated environment, if at all.
Source: Wiz Research, “PHP2Shell: AI uncovers critical RCE vulnerabilities”
