Internet est en feu… et l'IA l'a détecté

PHP2Shell, two critical bugs in PHP found with AI, puts 70% of the web at risk, and here is what I did in my own company and what I tell my clients

Today my feeds were full of PHP. There was a new PHP incident with attacks already running, and apparently there is a security gap in PHP itself, the engine under a huge part of the web [1][2]. Interestingly, it was discovered with the help of AI, by researchers working with AI models [3][4]. PHP is very old, but it's everywhere: websites, WordPress sites and applications all over [5][6]. In Germany, the Charité in Berlin took its websites offline today as a precaution, together with the Berlin fire brigade, the police online station and several universities [7], so this is a major, major incident. Reason enough for me to look deeper into what it is.

The facts: CVE-2026-109618 and CVE-2026-109619, rated critical, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 [1][8].

What Actually Broke in PHP

The bug sits in PHP itself, so it doesn't really matter how good your own website code is. When PHP ends a request in a strange way, it can leave some garbage in its memory, and an attacker can send a request that uses exactly this garbage to run their own code on your server, without any login [8][9]. That's basically it, you don't need to know more than that as a manager. Wiz says every PHP version of the last ten years has at least one of the two bugs [3], and CERT-EU writes that attack code is already going around [8].

How AI Helped Find the PHP Bugs

When I read the posts this afternoon it sounded like a model found it all by itself, and that's not quite how it went. Ryan Austin from the security firm Calif found the first bug in August, working with OpenAI's GPT-5.6 Sol, in a project OpenAI pays for called Patch the Planet [4][10]. Wiz Research found the bugs on its own with their tool Wiz Atlas plus Gemini 4 Argon and GPT-5.6 Sol, and they reported it to the PHP team on 24 August [3]. OpenAI posted about it [11] and Peter Steinberger, the OpenClaw guy, made it a one-liner [12].

OpenAI, 21 Oct 2026 [11]. https://x.com/OpenAI/status/2112907856018309586

Peter Steinberger, 21 Oct 2026 [12]. https://x.com/steipete/status/2112913060709228764

Calif itself is a lot more careful than the headlines, by the way. They say they only used models everybody can use, and that knowing the history of PHP mattered more than the model [10]. I like that, because it's the real story. A person who knows where to look plus a model that can dig through a huge codebase for days, that combination is new.

Timeline from the Wiz report and the PHP advisory [1][3], attack time from Sansec [2].

PHP Runs Most of the Web, Like It or Not

I'm honestly not a big PHP fan, and a lot of people see it as kind of archaic. But the numbers are crazy. PHP runs 69.3% of the websites where W3Techs can see the server language [5], and WordPress alone, which is built on PHP, runs 39.6% of all websites [6]. VirusTotal counts more than 5.1 million PHP servers you can reach from the internet [9]. The researchers showed the attack on WordPress, Drupal, Joomla, Magento and Nextcloud [2][3]. And then there's all the PHP nobody remembers, in some admin panel, an old internal tool or a device in the basement [13].

Source: W3Techs, 21 Oct 2026 [5][6].

Log4Shell, xz, regreSSHion and Now PHP2Shell

We have seen this movie a few times now. Some small old building block sits under millions of systems, two or three people maintain it in their free time, and nobody really looks at it until somebody does. In December 2021 it was Log4Shell, a hole in a little Java logging library, and basically every big company was running around for weeks [14]. In March 2024 Andres Freund, a developer, noticed his logins were about half a second slow, and he found a backdoor that somebody had built into xz over years [15][16]. xz is a small compression tool, and it almost went into the big Linux distributions. Then in July 2024 Qualys found regreSSHion in OpenSSH, the thing admins use to log into servers, and it was an old bug from 2006 that simply came back [17].

AI Makes Finding Bugs Cheap, for Both Sides

What changed now is the price of looking. Google's Big Sleep agent found a real bug in the SQLite database in 2024 before it even shipped [18], and in 2025 the AI tester XBOW was number one on HackerOne's US ranking of bug hunters [19]. Then you also have the other side, Daniel Stenberg from curl wrote that around 20% of the bug reports he got in 2025 were AI slop, stuff that looks real and is made up [20].

The attack side is the part I think about. Wiz writes that building a working attack from bugs like this used to need top people, and with AI that's not really the barrier anymore [3]. OpenAI even says it expects findings like this to "increase sharply in the coming months" [4]. So you have hours now between a bug going public and the first attacks, not weeks, and most patch processes I see are built for weeks.

What I Did Today and What I Tell My Clients About PHP

Chez JadenX I work with many companies, and internally I upgraded all our IT and every app we have as fast as I could today. But I do know that in larger organizations this takes a lot longer, and here that's really critical. And usually the update isn't the slow part. Nobody has a list of where PHP runs, and then every change waits for some approval board.

So this is what I tell my clients today, and it's basically what the PHP team and the agencies say too [1][8][13][21]:

• Find out where PHP runs. Ask your IT or your agency for a list, websites, internal tools, devices, and also the stuff someone else hosts for you.
• Update today. Not next sprint. Every PHP system gets the new version, and then a restart, otherwise the fix isn't active.
• Get it in writing. If a hoster or an agency runs your website, ask them by email to confirm they patched.
• A firewall only buys you time. The PHP team says only the update really fixes it [1][9].
• Check if somebody is already in. A patch doesn't undo a break-in. And if a system on the internet can't be patched right now, take it offline like the Charité did [7][8][21].

FAQ

Am I affected if I don't run WordPress? Probably yes, if you run PHP anywhere. The bug is in PHP itself, so any PHP application on an old version can be at risk [3].

Is a firewall enough? No. It can buy you some hours, but the PHP team says only the update fully fixes it [1].

Did AI really find the PHP bugs? People at Calif and Wiz found them with help from GPT-5.6 Sol and Gemini 4 Argon. The models did a lot of the digging, but people who know PHP pointed them in the right direction [3][10].

Références

[1] PHP Security Team, "RCE via OOM corruption (GHSA-w8hw-w9fx-j79w)", GitHub, 21 Oct 2026. https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

[2] Sansec Forensics Team, "PHP2Shell: Critical PHP RCE (CVE-2026-109618, CVE-2026-109619)", Sansec, 21 Oct 2026. https://sansec.io/research/php2shell

[3] Sagi Tzadik, Shir Tamari, Nir Ohfeld, Tomer Schwartz, "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet", Wiz, 21 Oct 2026. https://www.wiz.io/blog/php2shell-php-rce

[4] OpenAI, "Patch the Planet: global response coordination as agents uncover critical vulnerabilities", OpenAI, 21 Oct 2026. https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities

[5] W3Techs, "Usage statistics of PHP for websites", W3Techs, 21 Oct 2026. https://w3techs.com/technologies/details/pl-php

[6] W3Techs, "Usage statistics and market share of WordPress", W3Techs, 21 Oct 2026. https://w3techs.com/technologies/details/cm-wordpress

[7] Tilmann Warnecke, Simon Röhricht, Silvia Perdoni, "Zahlreiche Berliner Webseiten wegen schwerer IT-Sicherheitslücke vorsorglich offline", Tagesspiegel, 21 Oct 2026. https://www.tagesspiegel.de/berlin/zahlreiche-berliner-webseiten-wegen-schwerer-it-sicherheitslucke-vorsorglich-offline-16183702.html

[8] CERT-EU, "Critical Vulnerabilities in PHP (Security Advisory 2026-018)", CERT-EU, 21 Oct 2026. https://cert.europa.eu/publications/security-advisories/2026-018

[9] Sergiu Gatlan, "PHP ships emergency patches for critical PHP2Shell flaws", BleepingComputer, 21 Oct 2026. https://www.bleepingcomputer.com/news/security/php-ships-emergency-patches-for-critical-php2shell-flaws/

[10] The Next Web, "PHP rushes out emergency patches for two critical bugs AI found first", The Next Web, 21 Oct 2026. https://thenextweb.com/news/php2shell-php-rce-ai-openai-wiz

[11] OpenAI (@OpenAI), "OpenAI models helped researchers ... discover critical security flaws in PHP", X, 21 Oct 2026. https://x.com/OpenAI/status/2112907856018309586

[12] Peter Steinberger (@steipete), "That PHP vulnerability that's gonna cause havoc this week was found with… GPT-5.6 Sol.", X, 21 Oct 2026. https://x.com/steipete/status/2112913060709228764

[13] Swiss National Cyber Security Centre (NCSC/BACS), "Critical vulnerabilities in PHP: Install security updates immediately", BACS, 21 Oct 2026. https://www.bacs.admin.ch/en/warnung-php-en

[14] CISA, "Apache Log4j Vulnerability Guidance", CISA, 2022. https://www.cisa.gov/news-events/news/apache-log4j-vulnerability-guidance

[15] NIST, "CVE-2024-3094 Detail (xz-utils)", National Vulnerability Database, 29 Mar 2024. https://nvd.nist.gov/vuln/detail/CVE-2024-3094

[16] Andres Freund, "backdoor in upstream xz/liblzma leading to ssh server compromise", oss-security mailing list, 29 Mar 2024. https://www.openwall.com/lists/oss-security/2024/03/29/4

[17] Qualys Threat Research Unit, "regreSSHion: Remote Unauthenticated Code Execution Vulnerability in OpenSSH server", Qualys, 1 Jul 2024. https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server

[18] Google Project Zero, "From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code", Google Project Zero, 1 Nov 2024. https://googleprojectzero.blogspot.com/2024/10/from-naptime-to-big-sleep.html

[19] XBOW, "How XBOW Ranked #1", XBOW, 2025. https://xbow.com/blog/top-1-how-xbow-did-it

[20] Daniel Stenberg, "Death by a thousand slops", daniel.haxx.se, 14 Jul 2025. https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-slops/

[21] UK National Cyber Security Centre, "Critical security issue affecting PHP", NCSC, 21 Oct 2026. https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php

À propos de cet article : je travaille avec un workflow de dictée. Je dicte mes idées, et plusieurs agents IA m’aident à rechercher des sources et à transformer ma dictée en brouillon. Je relis et corrige chaque ligne avant publication. Les opinions sont les miennes. JadenX has no commercial relationship with OpenAI, Google, Wiz or Calif.

If you're not sure where PHP runs in your company or how fast your patch process can really move, talk to me at JadenX and we'll look at it together.