AI Discovers Critical PHP RCE in 5 Days; Patch Coordination Takes 58

Introduction

On October 20, a Hacker News post claimed two CVSS 10.0 remote code execution vulnerabilities in PHP. The poster offered no evidence beyond "trust me." Hours later, security firm watchTowr confirmed the vulnerabilities were real. The incident, dubbed PHP2Shell, forced PHP to release emergency patches on October 21, ahead of the planned October 22 schedule.

Vulnerability Details

PHP powers approximately 69.3% of websites with known server-side languages (W3Techs, October 2026), including WordPress, Drupal, Joomla, and MediaWiki. The two vulnerabilities are:

CVE-2026-109618 : Request initialization exhausts memory mid-process; internal data structures are only half-built when cleanup code trusts them.

CVE-2026-109619 : Cross-request residual state points to memory no longer owned; the next request follows the stale data.

Both are memory-management flaws in the PHP interpreter (written in C). They reside in the PHP kernel, beneath the application layer, meaning even carefully written application code is exposed. In Apache mod_php configurations, exploitation can occur before the user's business code runs. PHP rates them CVSS 9.2; watchTowr rates one 10.0. Exploitation can leak passwords, tokens, API keys, and potentially grant full server control.

Timeline Analysis

Wiz Research published the following timeline:

August 19: Vulnerability discovered.

August 24: Reported to PHP security team (5 days after discovery).

September 21: PHP acknowledges and begins coordination (28 days after report).

October 21: Patch released and publicly disclosed (30 days after acknowledgment; 58 days after report; 63 days after discovery).

Wiz states: "A single researcher completed in a week what previously took world-class teams months." The article notes that while AI compressed the discovery phase to 5 days, the subsequent 58 days (report to patch) remained unchanged.

Why Patching Is Slow

The delay is not due to maintainer laziness. Fixing such vulnerabilities requires coordinated disclosure across many parties: PHP upstream, distribution packagers, cloud providers, WAF vendors, CDNs. Wiz lists pre-disclosure mitigation partners: Automattic, Akamai, AWS, Cloudflare, Fastly, Google, Imperva, Microsoft, Vercel. Any premature action could tip off attackers, so all must release simultaneously. This is a coordination cost, not a technical cost, and coordination relies on people.

Additionally, the PHP Foundation is under-resourced. The root causes of these vulnerabilities have lain in the code for over a decade. PHP is widely mocked yet runs ~70% of websites, akin to aging underground water pipes that only attract attention when they burst.

Attribution Dispute

Three conflicting accounts exist:

Wiz : Wiz Research discovered the vulnerabilities on August 19 using proprietary Wiz Atlas plus Google DeepMind's Gemini 4 Argon and OpenAI's GPT-5.6 Sol; Argon is credited as the primary contributor across discovery, exploit development, detection, and patch verification.

watchTowr : Researchers from Calif discovered the vulnerabilities and reported them to PHP.

OpenAI : Announced on social media that this is part of their "Patch the Planet" program, with models helping researchers find critical PHP flaws.

All three narratives coexist; each may emphasize different phases or participants. The article argues this ambiguity illustrates a growing problem: when AI participates, "who discovered the vulnerability" becomes blurred, undermining the reputation-based economy of security research.

Implications: Asymmetric Acceleration

The real shift is not "AI finds vulnerabilities" — that has been proven repeatedly. The shift is that attack-side efficiency has been dramatically increased while defense-side efficiency has not. Previously, many old vulnerabilities remained dormant for decades because discovery was expensive (only a few hundred experts worldwide, months of effort). AI collapses that cost, turning every unmaintained legacy system (decade-old backends, forgotten admin panels, PHP 5 intranets) into viable targets. Defense, however, still requires human coordination, verification, and maintainers waking up to push releases — bottlenecks AI cannot yet alleviate.

Actionable Advice for PHP Site Operators

If you run PHP sites:

Confirm version and upgrade to the patched releases released October 21:

8.2.x → 8.2.35

8.3.x → 8.3.36

8.4.x → 8.4.27

8.5.x → 8.5.12

Restart PHP workers after patching; otherwise the fix does not take effect.

Versions 7.4, 8.0, 8.1 are EOL; only distribution or LTS vendor patches are available. PHP 7.3 and earlier (including PHP 5) have no official fix; the only recommendation is to upgrade to a supported version.

watchTowr's honeypot network shows in-the-wild exploitation starting October 21.

Conclusion

The most important takeaway is not "AI is impressive" but that it has illuminated a structural wall. AI can accomplish in a week what used to take months. But it cannot complete the steps that require human coordination, judgment, and accountability. Discovering a vulnerability is a technical problem; fixing it is an organizational problem. The safety of the ~70% of websites running PHP ultimately depends on who is willing to fund the maintainers who push patches in the middle of the night.

References

Wiz Research: PHP2Shell technical analysis and timeline

watchTowr: CVE-2026-109618 / 109619 FAQ

Huntress, Unit 42, The Hacker News: vulnerability disclosure coverage

W3Techs: October 2026 PHP usage statistics