AI-found PHP2Shell flaws are under active attack, CISA says — and now chained to root firewalls

Update, November 5, 2026: Since CISA's October 26 listing, the picture has worsened. On October 27 CISA also added the Brotli flaw fixed in PHP's Windows rebuilds, CVE-2026-111497, to its exploited list (due November 10). On October 28 it added the Linux kernel flaw Fragnesia, CVE-2026-46300, noting it "can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root" (KEV feed). On October 29 Palo Alto Networks' Unit 42 said PHP2Shell is "actively exploited against PAN-OS management interfaces that are exposed to the internet," in a campaign that chained it with a Linux kernel privilege-escalation bug to gain root. As of November 5, php.net lists no newer PHP release than the October 21 fixes and the October 26 Windows rebuilds.

See also: A custom PHP2Shell exploit rooted 25 Palo Alto firewalls — on branches that had no hotfix yet, our analysis of the PAN-OS campaign reported by Dream Research and verified by Unit 42.

The two critical PHP flaws known as PHP2Shell, found this summer by researchers working with AI models and fixed on October 21, 2026, were added on October 26 to the US Cybersecurity and Infrastructure Security Agency's (CISA) catalog of vulnerabilities exploited in real attacks. US federal civilian agencies had until October 29 to fix them. Everyone else running PHP should treat it the same way: update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or your vendor's patched package), restart PHP, and on Windows install the rebuilt "-1" packages released on October 26.

What happened, in plain English

PHP is the programming language behind a large share of the web. WordPress, Drupal, Joomla, Magento, Laravel and thousands of in-house applications all run on top of it. PHP2Shell is not a bug in any of those applications. It is in PHP itself, the engine underneath, so one fix matters to a very large number of sites at once. PHP also runs inside appliances: Palo Alto Networks confirmed that the web management interface of its PAN-OS firewall software was affected.

Both bugs are about PHP losing track of its own memory. In the first, CVE-2026-109618, running out of memory at the wrong moment leaves half-built internal data behind, and the cleanup code then treats it as valid. In the second, CVE-2026-109619, data from one web request survives into the next request handled by the same worker process. It is like a hotel room handed to the next guest before housekeeping has been in. The PHP project rates both 9.2 out of 10 on the CVSS v4.0 (Common Vulnerability Scoring System) scale. It warns that with Apache's mod_php, "an unauthenticated request can trigger the attack before any application code runs." Well-written application code therefore offers no protection.

What makes this a story about AI is how the bugs were found. Three teams reported them independently. Calif's researcher used an AI agent to look again at an idea from 2004 PHP research. OpenAI's Codex Security team reported the same root cause, and Wiz said it used its Atlas system together with Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol.

The October 26 listing in CISA's KEV (Known Exploited Vulnerabilities) catalog is what raised the stakes. CISA adds a bug to that list only when it has evidence of active exploitation.

Are you affected? What to do now

If you run, host or manage anything on PHP that answers web requests, yes. PHP's advisory covers "all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed." Calif says the bugs are "always exploitable under default configurations," and that the earliest affected code it found dates back to PHP 5.4.0.

• Find every PHP install. That includes control panels, vendor appliances, intranet tools, old marketing sites and Docker images. The PHP version your web server uses is not always the one php -v shows on the command line.
• Update. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released October 21. On Linux distributions and managed hosting, install your vendor's package instead. Vendors received the patches in advance, and a backported fix may not change the version number.
• Appliances: follow the vendor, not php.net. Devices that embed PHP, such as PAN-OS firewalls, need the vendor's own hotfix. Keep their management interfaces off the internet.
• Restart PHP-FPM and Apache. Workers that are still running keep the old code in memory.
• Patch the kernel too. CISA lists the Linux kernel flaw CVE-2026-46300 (Fragnesia) as exploited and chainable with PHP2Shell to reach root. Install your distribution's kernel update on PHP servers and reboot.
• Windows: install the October 26 rebuilds (8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1). They bundle Brotli 1.2.1, which fixes a separate compression flaw, CVE-2026-111497, which CISA added to its exploited list on October 27. PHP says the bug can only be reached through the cURL extension when automatic response decompression is turned on. That is off by default, but some libraries turn it on.
• PHP 8.1 or older: the PHP project no longer supports these versions. It has published minimal source backports for 7.4, 8.0 and 8.1. Otherwise ask your long-term support vendor, or take the system off the internet. PHP 8.2 itself reaches end of life on December 31, 2026.
• Turn off session upload progress until the next PHP release. On October 23 the PHP team advised setting session.upload_progress.enabled=0 because of a third, "unlikely" route to code execution, CVE-2026-115560. It only affects applications that switch the session serializer at runtime, and a full advisory will come with the next regular release. If you already set this as a PHP2Shell mitigation, leave it in place.
• Look back to October 17, not October 21. Amazon recommends starting investigations from at least October 17. Review web server logs and look for unexpected processes or file changes on web servers. Amazon also suggests searching form-upload POST requests for the string PHP_SESSION_UPLOAD_PROGRESS. Wiz lists warning signs such as repeated HTTP 500 errors after unusual multipart requests, oversized or malformed PHPSESSID cookies and unexplained PHP worker restarts.
• IOCs (indicators of compromise): Amazon published six IP addresses. It notes they belong to shared anonymization infrastructure and should be investigated rather than blocked outright.

The configuration workarounds in PHP's advisory "reduce exposure to specific attack paths but do not make an installation safe." Amazon agrees that no configuration-only change covers both bugs. Updating is the only complete fix.

The expert view

Both bugs are lifecycle errors, not input-parsing mistakes. The first is an error path: an out-of-memory condition interrupts initialization, and cleanup code then assumes initialization finished. The second is state meant to last for one request that actually lasts as long as the worker. That class of bug only exists because production PHP now runs mostly in long-lived worker pools (FPM, mod_php, FrankenPHP). Such bugs are hard to find but, once found, tend to be reliable to exploit, and the 9.2 rating reflects that.

The AI angle needs to be stated precisely. None of the primary sources describe an autonomous discovery. Calif's write-up says its researcher "focused on something I had a background in" and "asked my LLM companion for help." It says the first finding came days into an audit that began on July 30, with no special harness and no models unavailable to the public. Wiz names Gemini 4 Argon and GPT-5.6 Sol and says one researcher did in a week what "would have taken a world-class team months"; that is the authors' own claim. The PHP Foundation describes the other side of the process. AI-assisted research has increased the number of reports it receives. It now uses AI to validate reports and group duplicates, "but a person makes every call and works on every patch." The pattern is an expert pointing a model at a well-chosen hypothesis, and that is what makes it repeatable. A known 2004 bug class held more undiscovered siblings than two decades of manual review had found.

The timeline shows how short the window for defenders has become. The bugs were reported on August 11 and fixed on October 21. During that time, the PHP Foundation says, Calif mistakenly published a video showing its proof of concept, and the CVE IDs leaked with a wrong score on October 20. Amazon's MadPot honeypots logged an exploitation attempt on October 17. Amazon says it is unclear how the attacker got exploit information before disclosure. Public proof-of-concept exploits were then hitting its sensors within hours of the release. Amazon's CISO, CJ Moses, argues that AI-assisted analysis makes turning a patch or advisory into a working exploit cheaper, and that patch timelines for critical internet-facing bugs should be measured "in hours rather than days."

Several things remain unknown or disputed. CISA's KEV entry confirms exploitation but does not say where it happened or how widely, and its "known ransomware use" field reads "Unknown." Amazon reported attempts, not confirmed compromises. The first publicly verified compromises came on firewalls rather than websites: Unit 42 said on October 29 that it had independently verified the tooling and results of a PAN-OS campaign reported by Dream Research. Palo Alto Networks' Unit 42 counts more than 22.6 million potentially vulnerable exposed instances. On October 23, Unit 42 linked a separate intrusion at a European government agency to PHP2Shell and described agentic AI tools used after the break-in. On October 25 it retracted that update, saying it was "unable to confirm that initial access is associated with the specific PHP2Shell CVEs." Treat claims of AI-driven PHP2Shell intrusions with caution until a vendor publishes evidence.

Official sources

• CISA Known Exploited Vulnerabilities Catalog. CVE-2026-109618 and CVE-2026-109619 added October 26, 2026, due date October 29, 2026; CVE-2026-111497 (Brotli) added October 27; CVE-2026-46300 (Linux kernel) added October 28 (machine-readable feed)
• PHP security advisory, releases and October 23 / 26 notices. PHP Group (fixed versions, mitigations, CVE-2026-115560 note, Windows Brotli rebuilds)
• GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619)
• Today's PHP security release and how we're strengthening PHP security. The PHP Foundation, October 21, 2026
• Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot. AWS Security Blog, October 21, 2026 (updated October 22)
• PHP2Shell. Calif, October 21, 2026
• PHP2Shell: PHP RCE. Wiz Research, October 21, 2026
• Threat Brief: Critical Vulnerabilities in PHP. Palo Alto Networks Unit 42 (October 25 retraction note; October 29 PAN-OS campaign update)

Coverage: BleepingComputer (Amazon findings, Dataminr view); The Hacker News (CISA KEV, October 27).