PHPocalypse: chained PHP flaws leave 70% of the web exposed

Two chained vulnerabilities in the PHP core, with a CVSS score of 9.2, allow remote code execution on standard WordPress and Drupal installations. The faulty snippet had been sitting in the language's open repository for more than a decade.

The flaw is called PHP2Shell, and it is not a metaphor. Two chained vulnerabilities in the engine that powers a large share of the web allow an attacker to execute remote code on standard, up-to-date WordPress and Drupal servers, without needing any credentials. The flaw had been inside PHP's open repository for more than ten years, in plain sight of thousands of developers, and it was found by an artificial intelligence.

## What is PHP2Shell and who is affected

PHP is neither the most modern nor the most elegant language, but it is the invisible foundation of the web. According to **W3Techs** metrics, around **75%** of websites whose server environment is known run on this ecosystem. WordPress, which powers more than **40%** of the internet, relies on it. So do Drupal, Joomla and Magento. A structural sustancia ilegal in its core stops being a technical problem and becomes a critical infrastructure incident.

The technical name of the pair is two critical chained vulnerabilities, with a **CVSS score of 9.2**, catalogued as **CVE-2026-109618** and **CVE-2026-109619**. The first exploits memory corruption caused by resource exhaustion when processing requests, opening the door to remote code execution without credentials. The second takes advantage of a stale global state residue between consecutive requests, allowing an attacker to leak process memory or consolidate control of the server.

On their own, each piece has its own logic. Together, in a very specific sequence of events, they form a single attack vector. Research teams managed to demonstrate remote code execution against standard, up-to-date WordPress and Drupal deployments. The vulnerable snippet had lived in PHP's repository since version 5.

## Three findings, a leak and emergency patches

The timeline matters because it explains the paradigm shift. In early August, analysts at the security firm **Calif** identified the first anomaly using the **GPT-5.6 Sol** model, as part of **OpenAI**'s Patch the Planet initiative. Almost in parallel, and without prior communication, **Wiz**'s research team detected the same vector in mid-month by combining their own analytical engines with **Gemini** and GPT. Two different organizations, with different frontier tools, arrived at the same flaw days apart.

The **PHP Foundation**, OpenAI, **Google**, Calif and **Cloudflare** planned a coordinated disclosure while preparing the patches. The script fell apart on **October 20**: the technical details were leaked online ahead of schedule. The response was immediate. The PHP Foundation moved up the release of its emergency versions: **PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35**. International agencies and firewall vendors issued top-priority advisories so that patches would be applied or exposed services isolated.

## Why a decade of human auditing missed it

The question begs itself: how does a flaw like this escape one of the most active developer communities on the planet? The answer lies in the nature of the error. It was not a typo or a syntax slip on a single line. The breach emerged from the cross-interaction of four subsystems: memory management when limits are exceeded, session tracking logic, fatal error handling and the internal opcode cache.

Analyzed separately, each module worked as designed. Under a specific sequence of events, they collapsed into an exploitable path. That is where the machine has the advantage: a reasoning model does not get tired, does not make assumptions out of inertia, and keeps dozens of state transitions in memory at once. The AI did not read the code line by line; it understood the systemic relationship and modeled a route that would have taken a human analyst months of nearly blind manual testing.

## The race against the clock does not end with the patch

With more than **20 million** exposed environments on the network, publishing the fix does not solve the problem overnight. It only fires the starting gun. In the hours after the leak, repositories with proof-of-concept code and test environments began to proliferate. The window between the announcement and the mass updating of servers is the usual hunting ground for attackers.

The bigger picture goes beyond this patch. The gap between identifying a flaw and having a working exploit has shrunk to a matter of hours, and the same AI that helps audit code can automate the generation of attacks. If PHP hid a critical flaw for a decade, it is reasonable to think that other essential open-source components harbor similar gray areas. The classic asymmetry remains, now accelerated: the defender needs to cover every flank and get millions of administrators to update in time; the attacker only needs one careless installation.

This time, defensive coordination arrived in time to publish the fixes before mass intrusion campaigns were recorded. Luck is not a long-term security policy. PHP2Shell does not close an incident: it opens an era in which machines find the weaknesses we left behind, and what decides the outcome will be who processes the information a few minutes earlier. If you run a PHP server, it is worth checking the installed version and applying the released updates; if in doubt, consult a security professional.