PHP2Shell exposes the vulnerability acceleration problem: AI is outpacing patch capacity

Vulnerability discovery powered by artificial intelligence is reshaping the security landscape. The PHP2Shell incident demonstrates that legacy runtime environments cannot operate safely without aggressive, forward-looking patch management strategies.

This past week, public infrastructure across multiple European nations went dark. Germany disabled federal websites, France took prefecture portals offline, Belgium's foreign ministry shut down its web presence, and the Netherlands pulled public-facing systems as a protective measure. Similar responses rippled through organizations globally.

All these entities were waiting for patches that had not yet been released.

The culprit was PHP2Shell: CVE-2026-109618 and CVE-2026-109619. Though the PHP community responded with speed—releasing fixes for all actively maintained PHP versions on October 21 morning—a deeper challenge persists. An estimated 40% of PHP deployments rely on versions no longer receiving official support, even as machine learning has dramatically increased the pace of CVE discovery.

What happened this week was different, and it's the first shot of what promises to be an ongoing battle across the open-source ecosystem.

The speaker has spent more than two decades in open-source development, leads the Laminas Project, serves as Principal Product Manager for Perforce Zend and OpenLogic, and sits on the PHP Foundation Board—a vantage point from which to observe emerging security threats across the ecosystem.

Understanding PHP2Shell

CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, create remote code execution vulnerabilities triggered by the interaction of out-of-memory conditions and PHP's error-handling mechanisms. Every PHP version from 5.4 onward is vulnerable to at least one of these flaws. The severity stems from their location in the PHP runtime itself rather than in application code, frameworks, or content management systems—meaning no workaround exists outside of deploying patched PHP binaries.

Wiz Research determined that these vulnerabilities could permit remote code execution or leak sensitive data stored in process memory, such as passwords, session tokens, API credentials, and cryptographic certificates. This exposure operates independently of whatever application logic runs on top of PHP.

Datadog Security Labs independently verified the vulnerabilities and discovered that application-layer authentication cannot block the attack because PHP processes the malicious request before application code executes. In testing CVE-2026-109618, researchers found that the request "never reaches the target application's code."

Even with solid application security practices, your applications could still be exposed because the vulnerable behavior happens below the application, in the PHP runtime itself.

Patching is the only solution.

Coordinated response across the ecosystem

Once the full scope emerged in August, the PHP Ecosystem Security Team, the PHP Foundation, and release managers coordinated a fix across every supported PHP version. In a rare cross-vendor initiative, they worked with long-term support providers such as Zend to ensure simultaneous patch releases.

This level of coordination marks the first instance in over 20 years of such a unified effort, and the community's commitment to this approach deserves recognition. The initiative meant that organizations still running unsupported PHP versions (8.1 and earlier) could obtain security updates against these newly disclosed vulnerabilities without any protection gap.

The coordination did face a test when CVE numbers leaked on October 20, forcing all releases forward by a day. However, by 14:00 UTC on October 21, all community-maintained PHP versions had received updates. Zend and other long-term support vendors also delivered patches for end-of-life PHP versions.

While additional comprehensive measures will emerge in coming weeks, these patches will protect critical infrastructure—government systems, hospitals, financial networks, educational institutions—during the interim period.

AI reshaping vulnerability research economics

PHP2Shell exemplifies what occurs when artificial intelligence makes sophisticated security research more accessible—and the risks that accompany democratized knowledge.

Through OpenAI's Patch the Planet initiative, Calif identified a critical PHP vulnerability using GPT-5.6 Sol. PHP's maintainers led the remediation and release process, with researchers and security vendors providing testing, technical guidance, and coordination prior to public disclosure.

We've always raced vulnerability disclosure, patch availability, and exploitation. PHP2Shell demonstrates just how uncomfortable and hard-won that race can, and likely will, become.

The significant shift lies in potential magnitude. OpenAI reports these represent only a subset of major vulnerabilities it has identified and is addressing, and predicts similar discoveries will "increase sharply in the coming months."

End-of-life open source and rising vulnerability pressure

The straightforward recommendation following a PHP2Shell-class vulnerability is immediate upgrading. Operational reality presents complications.

PHP 8.1 and earlier versions receive no updates from the PHP project itself, though certain distributions and long-term support vendors backport security patches. For production-critical systems, transitioning to a newer runtime often demands updates to dependent frameworks, libraries, extensions, and application code, plus comprehensive testing to prevent production disruption.

This gap widens as AI advances vulnerability discovery capabilities, making this a challenge extending far beyond PHP. PHP merely represents the first major case study for what lies ahead across most widely-used open-source technologies. Recent months have seen a surge in Spring vulnerability disclosures, while Node.js and Python reported critical flaws the same day as PHP2Shell. Linux kernel maintainer Linus Torvalds has also noted that the Linux security mailing list is becoming overwhelmed by AI-generated bug reports.

Through experience with open-source and PHP at Perforce Software, long-term support has emerged as a bridge toward modernization. It enables teams to continue addressing security threats while planning, testing, and executing transitions to supported releases. As vulnerability discovery accelerates, indefinite reliance on unsupported software becomes progressively harder to defend.

Organizations must maintain current versions where feasible and establish deliberate security strategies for systems that cannot be upgraded immediately. The velocity of vulnerability discovery makes this approach increasingly critical.

Looking ahead

For PHP deployments, the near-term objective is clear: move to a patched release or secure appropriate security updates for an otherwise unsupported version. The longer-term picture requires deeper consideration.

It would be tempting to interpret PHP2Shell as evidence of declining PHP security, but that conclusion would be incorrect. The coordinated community and vendor response this week demonstrates otherwise. Instead, the security mindset itself must evolve, as vulnerabilities of this type will proliferate.

Yes, our capacity to find difficult security problems has improved. But our ability to respond needs to keep pace.

Artificial intelligence is transforming which security investigations become feasible and how rapidly they can be executed. This development carries genuine value when researchers collaborate with projects and the broader ecosystem to resolve vulnerabilities. Yet it simultaneously demands more from organizations: understanding their software inventory, staying on supported releases whenever possible, implementing clear vulnerability-response procedures, and maintaining contingency plans for applications that cannot be upgraded in the near term.