PHP Runs 70% of the Web. AI Just Found a Critical Bug in It (PHP2Shell, Explained)

Описание: On 21 October 2026 the PHP project shipped an emergency security release for two critical, unauthenticated remote-code-execution bugs — CVE-2026-109618 and CVE-2026-109619, together nicknamed PHP2Shell. The flawed code had been in PHP for more than a decade. What changed was not the code. It was that frontier AI models made a once-impractical exploit practical.

This is a calm, systems-diagram walkthrough of how the bug works, why it hid for so long, and why three security teams reached remote code execution within weeks of each other in 2026.

The short version:
A PHP worker handles one request, cleans up, and forgets. When a request runs out of memory at the wrong moment, it can die before cleanup finishes and leave a pointer into memory that then gets freed.
The same worker serves the next visitor. It can read that freed memory before the state is reset — a use-after-free. That leaks worker memory (passwords, tokens, API keys) or is steered into running attacker code, with no login, before the site's own code runs.
PHP scores each bug 9.2 (CVSS 4.0); the NVD scores them 9.8 (CVSS 3.1). PHP runs about 70% of websites whose server-side language is known (W3Techs), including WordPress, Drupal, Joomla and the software behind Wikipedia.
Finding the weakness was never the hard part; building a reliable exploit was. AI changed who could do that work. This time the defenders found it first and shipped a fix at the root.

The only complete fix is to update: PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12 (or later in your branch).

Chapters:
00:00 A PHP worker that forgets
00:38 How a request dies: out of memory
01:00 Use-after-free across requests
01:26 What the freed memory buys an attacker
01:57 Why this touches 70% of the web
02:25 The two CVEs
03:08 Why nobody weaponized it for a decade
03:35 What changed in 2026: AI
04:05 Not magic: knowing the target
04:29 It almost surfaced in 2024
04:51 This time, defenders moved first
05:19 The fix is at the root
05:39 The words the field uses
06:08 Patch now

Sources:
NVD: https://nvd.nist.gov/vuln/detail/cve-... and https://nvd.nist.gov/vuln/detail/cve-...
PHP security advisories: https://github.com/php/php-src/securi... and https://github.com/php/php-src/securi...
PHP Foundation: https://thephp.foundation/blog/2026/1...
PHP release: https://www.php.net/archive/2026.php
Wiz Research (PHP2Shell): https://www.wiz.io/blog/php2shell-php...
Calif write-up (Ryan Austin): https://calif.io/php2shell/
OpenAI (Patch the Planet): https://openai.com/index/coordinated-...
Usage share: https://w3techs.com/technologies/deta...

Graphics are drawn in code. Narration voice: ElevenLabs. This video explains publicly disclosed, already-patched vulnerabilities at a conceptual level for defenders; it contains no exploit code. Update your PHP.