On October 21, 2026, the PHP team released emergency security updates for two critical vulnerabilities that could let attackers take control of vulnerable web servers without logging in. Both scored 9.2 out of 10 on the CVSS severity scale. PHP powers WordPress, Drupal, Joomla, and a substantial portion of the web, so this wasn’t a minor bug in some obscure library.
Here’s the uncomfortable part: signs of one underlying problem had already been identified in 2024. Researchers knew something was wrong but hadn’t demonstrated a practical attack. AI-assisted security research helped change that.
The vulnerabilities, collectively known as PHP2Shell, offer a useful look at what’s happening in cybersecurity. AI is no longer just identifying suspicious code. It’s helping researchers turn difficult theories into working evidence, sometimes in software that’s been examined for decades.
That’s impressive. It also creates a problem we’re not particularly well prepared for: finding vulnerabilities is getting faster, but fixing them isn’t keeping pace.
PHP2Shell: The Bug That Shows What Has Changed
The PHP Foundation’s October 21 report describes two related vulnerabilities:
- CVE-2026-109618: A memory corruption issue involving out-of-memory handling. Under certain conditions, PHP could treat partially initialized internal data as valid.
- CVE-2026-109619: A stale-state vulnerability where internal references could survive after the memory they pointed to had been freed.
Both could lead to remote code execution (RCE), meaning an attacker might run commands on the affected server.
The vulnerabilities exist in PHP itself, not in a particular WordPress plugin or Drupal module. Updating your website’s plugins wouldn’t fix a vulnerable PHP runtime.
What makes this case especially interesting is the discovery history.
During a 2024 security audit, a PHP developer found early signs of the memory-handling problem. A possible exploit was discussed, but the team couldn’t identify a concrete attack vector. The proposed fixes also introduced difficult compatibility and performance trade-offs.
Then came the AI-assisted investigations.
Researchers at Calif, working through OpenAI’s Patch the Planet initiative, used GPT-5.6 Sol in their research. Wiz independently investigated the flaws using tools including Gemini 4 Argon and GPT-5.6 Sol.
In its technical report, Wiz described demonstrating remote code execution against WordPress, Drupal, and Joomla installations.
AI didn’t invent the underlying bug, and it didn’t eliminate the need for skilled researchers. What it helped do was make complex exploitation research practical enough to demonstrate the danger.
That distinction matters. A theoretical bug can sit in a backlog. A reproducible critical vulnerability demands a response.
How AI Vulnerability Discovery Actually Works
Traditional security scanners are good at recognizing known dangerous patterns. Static analyzers can flag unsafe function calls, suspicious data flows, and common programming mistakes. Fuzzers bombard software with unusual inputs to see what breaks.
These tools remain valuable. But many of the hardest vulnerabilities don’t come from one obviously dangerous line of code.
Consider a program where one request fails midway through memory allocation. An error handler then performs incomplete cleanup. A later request unexpectedly uses leftover state.
Individually, the functions might look reasonable. Together, they create a security problem.
This is where AI agents offer something different.
1. Understanding the Software
An AI agent can examine functions, dependencies, control flow, and the relationships between components. It can investigate where untrusted data enters an application and how that data moves through the system.
Unlike a scanner looking only for predefined signatures, a language model can form hypotheses about unintended behavior.
That doesn’t mean it understands every program correctly. It means it can investigate more kinds of suspicious interactions.
2. Turning Suspicions Into Tests
Finding potentially dangerous code is only the beginning.
An agent can generate test inputs, compile instrumented builds, run debuggers, inspect crashes, and adjust its investigation based on the results.
The useful part isn’t merely writing a test. It’s the feedback loop.
If a suspected vulnerability doesn’t reproduce, the agent can investigate why. Maybe the code path is unreachable. Maybe another component prevents exploitation. Or maybe the original hypothesis was simply wrong.
This makes AI particularly useful when paired with established testing tools rather than used as a replacement for them.
3. Producing Reproducible Evidence
Google’s PageBreak security research is a good example.
PageBreak uses AI agents to investigate Google’s web applications, but it doesn’t blindly trust their conclusions. Specialized validators attempt to reproduce suspected vulnerabilities against running systems.
Google reported discovering more than 500 cross-site scripting (XSS) vulnerabilities using this approach.
The crucial design decision is that unverified findings don’t automatically become reports sent to product teams.
An AI suggesting that a vulnerability might exist is interesting. An independently reproducible security failure is something engineers can actually fix.
And This Is Happening at a Much Larger Scale
PHP2Shell wasn’t an isolated demonstration.
Several major technology companies published significant AI-assisted security research results during 2026.
| Organization | Reported results | What the numbers represent |
|---|---|---|
| Microsoft | 140 Windows CVEs, May–September 2026 | Vulnerabilities discovered with help from its FORGE research initiative |
| Anthropic | 6,157 disclosed findings across 591 open-source projects | Findings reported to maintainers as of October 2, 2026 |
| More than 500 XSS vulnerabilities | Findings identified through its PageBreak system |
Sources: Microsoft FORGE, Anthropic’s disclosure dashboard, and Google PageBreak.
These aren’t directly comparable benchmarks. They cover different software, verification processes, vulnerability types, and reporting stages.
Anthropic’s figures deserve particular attention. Of the 6,157 disclosed findings, the company knew of 516 patched upstream as of October 2. Its disclosure process includes independently reviewed findings and reports sent directly to maintainers without the same external validation.
In other words, 6,157 reported vulnerabilities doesn’t mean 6,157 independently confirmed, exploitable, unpatched security holes.
But even allowing for those limitations, the scale is difficult to ignore.
The Problem Nobody Can Automate Away So Easily
Finding a vulnerability and fixing it are completely different jobs.
An AI agent might identify a memory-management problem in minutes or hours. Fixing it could require changing code that thousands of other projects depend on.
The patch must address the root cause without breaking legitimate functionality. Maintainers need regression tests, compatibility reviews, release engineering, and coordination with downstream distributors.
Sometimes the correct fix is obvious. Sometimes every available solution has an unpleasant trade-off.
PHP2Shell exposed exactly that problem.
The PHP Foundation acknowledged that its earlier response to the underlying memory issue had stalled partly because of limited resources and difficult technical decisions. AI-assisted research made the danger clearer, but experienced PHP engineers still had to produce and coordinate the fixes.
There’s another problem: false positives.
A language model can confidently report a security vulnerability that disappears once someone examines the full execution path. Multiply that by thousands of automated reports and you can overwhelm an open-source project with work that produces little security value.
Google’s emphasis on reproducible validation isn’t just good engineering. It’s a practical necessity.
The scarce resource may no longer be the ability to identify suspicious code. It may be the engineers who can decide what matters and safely repair it.
AI Is Helping Attackers, Too
There’s no reason to assume these capabilities will remain exclusive to defenders.
An attacker can benefit from much of the same research automation: investigating complex code, searching for vulnerable paths, examining published patches, and adapting tools to different software versions.
That doesn’t mean every AI model can autonomously compromise a hardened server. Real-world exploitation still depends on conditions such as configuration, reachability, permissions, and available attack paths.
But AI can reduce the specialist effort required for parts of the process.
The consequence is a shorter window between discovering a vulnerability and the possibility of widespread exploitation.
Security teams have always raced to release patches before attackers could take advantage of the underlying weakness. AI potentially accelerates both sides of that race.
It also makes coordinated vulnerability disclosure more important. Maintainers, security researchers, operating-system distributors, hosting providers, and infrastructure companies may need to cooperate before the full details become public.
A discovered vulnerability isn’t a security improvement until people can actually deploy the fix.
What Developers and Website Owners Should Do
You don’t need a frontier AI model running security research against your infrastructure to benefit from this shift.
The practical priorities are fairly familiar, but their importance is growing.
- Track the software beneath your application. Your framework dependencies matter, but so do runtimes, system libraries, container images, and operating-system packages.
- Make security updates routine. Critical vulnerability announcements shouldn’t be the first time you investigate how to upgrade production infrastructure.
- Test the fixes, not just the features. Regression tests, security checks, and reproducible vulnerability tests should be part of the development process.
- Use AI security tools carefully. They’re useful for code review, suspicious data-flow analysis, and generating tests. Require reproducible evidence before accepting a serious security claim.
- Know who owns the response. If a critical issue appears in a runtime or third-party package, somebody needs responsibility for assessing exposure, deploying the patch, and confirming that it worked.
If You’re Running PHP Right Now
The PHP project’s security advisory identifies these fixed upstream releases:
| PHP branch | Security release |
|---|---|
| 8.2 | 8.2.35 |
| 8.3 | 8.3.36 |
| 8.4 | 8.4.27 |
| 8.5 | 8.5.12 |
Install the relevant update or a vendor package that includes the security backport. PHP 8.1 and older no longer receive normal upstream support, although some vendors provide patched packages.
Don’t assume that php -v tells the whole story, either. The command-line PHP interpreter can differ from the version actually serving your website. Confirm the web runtime or hosting environment.
There’s also an important update from October 23. PHP published an additional advisory concerning an uncommon session-handling configuration, tracked as CVE-2026-115560. Until a subsequent bugfix release addresses it, the PHP team suggests setting session.upload_progress.enabled=0. Check the official advisory for the specific conditions and implementation guidance.
And remember: updating WordPress doesn’t automatically update PHP.
Finding More Bugs Is Only Half the Victory
I see the PHP2Shell incident as evidence of a genuine improvement in what AI can contribute to security research.
A long-standing weakness that was difficult to exploit became demonstrably dangerous through a combination of human expertise, AI models, and traditional security tools. That prompted a coordinated response and fixes for a widely used software runtime.
That’s the good news.
The uncomfortable part is what happens when vulnerability discovery scales faster than the people responsible for maintaining the software.
Open-source projects already struggle with funding, compatibility decisions, and limited security resources. Handing them thousands of additional vulnerability reports doesn’t solve those problems.
AI can make us much better at finding what is broken.
Whether that makes software safer depends on how quickly, carefully, and sustainably we can fix it.
