FULL STORY

PHP2Shell: From Emergency Patch to a Million Exploit Attempts

PHP's emergency fix for two unauthenticated RCE flaws affecting most of the web was followed by working PoCs, an incomplete patch, in-the-wild exploitation four days before disclosure, and over a million exploit attempts blocked by Cloudflare.

2026-10-21 ~ 2026-10-22 · 14 episodes · 149 posts

Episode 1 · AI Helps Uncover Critical PHP Flaws Affecting ~70% of Websites (2026-10-21, 92 posts)

On October 21, PHP shipped an emergency security update: versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fixed two critical vulnerabilities enabling unauthenticated remote code execution (RCE)—CVE-2026-109618 and CVE-2026-109619 (CVSSv4 9.2). All PHP deployments handling web requests (PHP-FPM, modphp, php-cgi, FrankenPHP, LiteSpeed) are affected, with modphp at highest risk—a demonstrated exploit can be triggered by an unauthenticated request before application code runs. OpenAI announced that researchers in its "Patch the Planet" program found these vulnerabilities with the help of OpenAI models; the event drew wide attention as it affects roughly 70% of websites worldwide.

Confirmed

  • PHP's official advisory confirmed the two unauthenticated RCE vulnerabilities and four patched versions; the security team had pre-announced the update for October 21 14:00 UTC, and the patch went live late on the 21st Japan time, with details relayed from the official advisory by @DanielLockyer, @cyberforecast, and others.
  • OpenAI's official posts (m1/m2) announced that its models helped discover the bugs, with fixes coordinated over the past two months alongside maintainers and security vendors—time-consuming due to major changes to the PHP engine; @YuchenjUW said the bugs were found by GPT-5.6 Sol.
  • US officials got heavily involved: the FBI's cyber division notified of the two CVEs and advised organizations unable to upgrade immediately to take systems offline; the NSA issued an immediately effective emergency directive urging prompt updates or taking systems offline until mitigated.
  • Laravel founder Taylor Otwell confirmed Laravel rolled out emergency patch adaptations across the board; the flaws originate in PHP itself rather than plugins, so plugin developers can't fix them on users' behalf, and WordPress site owners were urged to stand by for patching.
  • Supply-chain security firm lead Dan Lorenc revealed that while the bugs were still under embargo, a frontier model with a proprietary harness independently reproduced the CVE from a single prompt: "find bad vulnerabilities."
  • Wes Roth reported the Dutch central government proactively took some government websites offline as a precaution.

Unconfirmed

  • Posts vary on PHP's coverage (about 70%, 80%, or 8%); the exact share can't be verified—OpenAI's official "about 70%" is taken as authoritative.
  • @cyb3rops previously mentioned an independently confirmed CVSS 10.0 max-severity RCE bug with no patches for old versions; its relation to the two officially announced 9.2-scored vulnerabilities is unclear.
  • "Automated AI attacks within 15 minutes of patch release" is a precautionary judgment from Japan's security community; no actual in-the-wild exploitation has been confirmed.

Why it matters

  • A landmark case of AI models systematically discovering critical vulnerabilities in widely deployed open-source software: @Sriramk argued this signals AI making the internet safer by surfacing long-dormant security issues, but software supply chains need the ability to build and deploy fixes quickly, likely requiring more public-private collaboration.
  • @YuchenjUW framed it against multiple security incidents within days (such as the LiteLLM supply-chain attack), noting AI is also making attacks faster and cheaper—offensive and defensive capabilities are escalating in parallel.

72 more related posts →

Episode 2 · Researchers Predict LLM Audits Will Uncover More PHP Vulnerabilities (2026-10-21, 3 posts)

Security researcher moyix predicts researchers will point LLMs at PHP codebases and uncover dozens of additional serious vulnerabilities beyond upcoming fixes, betting on an exploitable stack overflow in recursive abbreviation-handling code.

Episode 3 · PHP RCE proof-of-concept confirmed working, but not one-click (2026-10-21, 2 posts)

Security researchers confirmed the leaked PHP RCE proof-of-concept is genuine and usable, though exploitation requires certain preconditions. Combined with the vulnerability's high severity rating, the situation remains concerning.

Episode 4 · Security's "Black October": String of Critical Vulnerabilities and Supply Chain Attacks Hits Open Source (2026-10-21, 14 posts)

In mid-to-late October, the open-source and cloud infrastructure world saw an unusually concentrated wave of vulnerabilities, dubbed "Black October" by the security community. In just the days around October 21–22, more than ten projects including PHP, Node.js, GitLab, LiteLLM, and Railway disclosed serious security issues in succession, and the oss-sec mailing list received 275 announcements between October 1 and 20. Multiple security practitioners say this level of intensity and correlation in such a short window is unprecedented.

Confirmed

  • PHP: two unauthenticated critical RCEs; per Mudit Gupta's roundup, they are already being exploited in the wild and require immediate upgrades — information relayed by HanchungLee also suggests the patches may be incomplete
  • GitLab: disclosure of a remote code execution vulnerability with a perfect CVSS score of 10.0
  • LiteLLM: PyPI and Docker releases backdoored (malicious releases)
  • Node.js: emergency RCE patches released
  • Railway: suspected leak of customer secrets/keys
  • Other named incidents: Zeabur infrastructure compromised, OpenCode AI API keys exposed, an OVHcloud-related incident, and more; one widely shared list counts at least 15 software supply-chain security incidents in October
  • The oss-sec announcement flood: DanielLockyer counted 275 messages from October 1–20, with multiple project vulnerabilities including Apache APISIX disclosed on October 1 alone; October 20's single-day announcements covered dozens of projects across the Apache Cocoon, CouchDB, Tomcat, FFmpeg, Roundcube, OpenStack, Go, NSS, and Perl ecosystems

Unconfirmed

  • Practitioners such as arthurctellis predict patching pressure will be "like a continuous hell" for the next 8 months, and that patching operations will be severely complicated over the next two weeks — personal judgment, not established fact
  • The Railway key leak remains "suspected"; its actual scope has not been confirmed

Why it matters

  • The outbreak is concentrated in widely depended-upon foundational software — PHP, Node.js, TLS-related components, GitLab — while multiple supply-chain poisoning and key leak incidents stack on top, making the attack surface far larger than a typical single-point vulnerability
  • For production ops, multiple critical RCEs landing on the same day squeezes both patch prioritization and maintenance windows; multiple posters (Josh Bickett, Mudit Gupta, etc.) are directly urging immediate upgrades

Episode 5 · POC Released for Critical Pre-Auth RCE in PHP session.upload_progress (2026-10-21, 2 posts)

A researcher disclosed two critical pre-auth RCE flaws (CVSS 9.2) in PHP's session.uploadprogress handler via the php2shell project, and the POC has leaked early. Researchers warn mitigations alone may not suffice and urge exposed servers to patch promptly.

Episode 6 · LLM-Generated Fake PHP Exploit Sparks Security Panic (2026-10-21, 2 posts)

Security researchers documented a chaotic night in which an LLM-generated fake PHP exploit PoC spread and was then 'analyzed' by other LLMs, fueling panic. They warn that critical thinking and human expertise remain irreplaceable, as LLMs are fallible.

Episode 7 · Open-source repo demonstrates HTTP-only ASLR bypass RCE in PHP 8.4.26 (2026-10-21, 2 posts)

The open-source project php2shell-bypass-aslr-exp (779 stars) demonstrates a fully remote, HTTP-only RCE against PHP 8.4.26 with Apache prefork and modphp, bypassing ASLR without writing files to the target.

Episode 8 · PHP 8.5.12 Patch Incomplete: php2shell Double-Free Still Exploitable (2026-10-22, 2 posts)

Security researchers report that PHP 8.5.12's October security fix for the php2shell double-free vulnerability is incomplete, with at least three exploitation paths confirmed still working on the patched release.

Episode 9 · php2shell Vulnerability Story Told in Hand-Drawn Comics (2026-10-22, 2 posts)

The php2shell vulnerability disclosure ships as hand-drawn comics illustrated by the researcher's wife, shunning LLM-generated content. hdmoore recommends Calif Research's comic-style long read tracing two PHP remote flaws back 20 years as the most thorough and entertaining account.

Episode 10 · PHP2Shell RCE Forces Global Emergency Patching as AI-Driven Attacks Escalate (2026-10-22, 19 posts)

Two severe unauthenticated remote code execution flaws in the PHP core, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2, dubbed PHP2Shell), prompted emergency releases 8.5.12/8.4.27/8.3.36/8.2.35 on October 22. Because details leaked early and the coordinated disclosure process broke down, publishing the patches effectively handed attackers a roadmap to the flaws — forcing a response measured in minutes, with the FBI and NSA issuing an unusually forceful global alert.

Confirmed

  • PHP shipped four emergency releases fixing two related RCE vulnerabilities; under the right conditions an unauthenticated attacker can execute code on the server, and users are urged to upgrade immediately (m5).
  • CVE-2026-109618 can be triggered when a request hits specific conditions; the flaw sits in the PHP interpreter core, not the application layer (m5, m11).
  • Fixes that were meant to be prepared privately had to be released early after the leak, and security firms warned that mass exploitation was expected within roughly 15 minutes of the patched versions going public (m2).
  • The FBI's cyber division issued a global alert, and the NSA published a rare, near-mandatory notice: organizations unable to update immediately should take systems offline until mitigated (m3, m4, m10).
  • After the disclosure, several European government sites and Japanese platforms such as pixiv and Niconico were taken down for emergency maintenance (m11).
  • Figures circulating in reposts claim PHP powers roughly 43%–80% of the web (posts variously cite 43%, about 70%, and 80%).
  • The PHP Foundation disclosed that Anthropic's Claude had scanned the PHP codebase earlier this year, and that the exploit could be verified using OpenAI's Daybreak Red (m8).

Unconfirmed

  • Figures like "about 70% / 80% of websites" come from viral explainer posts with inconsistent numbers; the precise share in official advisories is not given in the material.
  • Whether exploitation in the wild has occurred: m10 speculates it "likely already has," but the material contains no confirmation.

Why it matters

  • This is a rare "leak before patch" scenario: the fix code itself reveals the vulnerability's location, compressing a hardening window normally measured in days down to minutes — widely seen as a stress test for modern incident response.
  • AI's role stands out: APPSO noted that AI completed in a week what previously took months of vulnerability verification; Ethan Mollick (as relayed by m6) called it a visible sign of offense and defense accelerating at inhuman speed. Meanwhile teortaxesTex quipped that if autonomous agents didn't hack a third of the internet during this zero-barrier window, everyone should lower their p(doom) — half joke, half a reality check on AI risk narratives.

Episode 11 · PHP2Shell Exploited Four Days Before Public Disclosure (2026-10-22, 2 posts)

AWS MadPot honeypot telemetry shows PHP2Shell was actively exploited on October 17, four days before public disclosure, amid a scanning wave of over ten million attempts.

Episode 12 · php2shell Exploits Surge Past One Million on Cloudflare (2026-10-22, 3 posts)

Cloudflare co-founder Matthew Prince revealed that php2shell exploits reached thousands within 10 hours before public disclosure and surged past one million attacks overnight after the PoS went live on GitHub.

Episode 13 · Drupal/PHP Vulnerability Surge Keeps Security Teams Busy Hardening Sites (2026-10-22, 2 posts)

Security engineer @unixterminal reported a full day of incident response after eMudhra's intermediate certificate was compromised, with a wave of Drupal and PHP vulnerabilities—fueled by AI-driven exploits like php2shell—prompting numerous organizations to seek urgent help hardening their sites.

Episode 14 · Investor Deedy Warns Non-Technicians Can Exploit CVEs with AI (2026-10-22, 2 posts)

Investor Deedy Das says he has seen non-technical people exploit CVEs like PHP2Shell with AI models with ease, warning that global digital infrastructure faces real risk.