A PHP flaw stalled for two years was fixed ten weeks after AI-assisted researchers showed it could take over servers

“We won’t pretend otherwise: the delay was a structural failure.” That is the PHP Foundation, writing on 21 October, the day PHP shipped versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical flaws that can let an attacker run code on an unpatched server without logging in.

The foundation’s account starts two years earlier. In 2024 PHP had its first external security audit in years, and while fixing one of the reported issues, a core developer paid by the foundation spotted the first signs of the problem: if a request hits PHP’s memory limit at exactly the wrong moment, PHP can leave half-initialised internal data behind and later treat it as valid. Someone theorised that it might be exploitable, but nobody found a concrete way in. There were several possible fixes, each with a cost: breaking compatibility, or forcing changes on a large number of third-party extensions. The security team decided by consensus and had few people who knew that part of the engine, so the fix “stalled and restarted repeatedly over months”.

What changed it was August. The security firm Calif began auditing PHP on 30 July and on 11 August reported an unconditional remote-code-execution path with the same root cause. The cloud-security company Wiz found a related flaw on 19 August and confirmed a remote takeover of Drupal the next day; OpenAI’s security team independently reported the same root cause and added further attack paths in September. From 11 August, fixing it was the foundation’s top security priority. The patch came ten weeks later.

All of them used AI. Wiz says it worked throughout with its own vulnerability-research tool, Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol, and that Gemini made “an invaluable contribution” to finding the flaw, building the exploit and validating the patch. Calif’s researcher writes that his first step was to ask “my LLM companion” for a way to push PHP past its memory limit. Wiz is specific about what AI did: the vulnerable code had sat in PHP for more than a decade, and “what AI changed was the ability to understand the weaknesses and turn them into a working exploit”. One researcher, it says, did in a week what would once have taken a world-class team months.

That fits the foundation’s account. The flaw had been seen; what was missing was proof that it could actually be broken, a step that used to take experts a great deal of time and that AI now helps with by trying, failing and adapting to different versions and configurations. Wiz’s post also carries praise from the head of Gemini security at Google DeepMind, who says the work shows why frontier AI changes cyber defence. It does not mention that Google completed its $32 billion purchase of Wiz on 11 March: the company praising Gemini is a Google subsidiary.

Wiz named the bugs “PHP2Shell” and headlined them as affecting 70% of the internet. The figure is W3Techs’: of websites whose server-side language it can identify, 69.3% use PHP. That measures how common PHP is, not how many sites can be broken into. PHP’s own advisory ranks the risk: every PHP installation serving web requests is affected, and Apache with mod_php is most exposed, since there an attack has been shown to work before any application code runs.

Version is the other thing that decides exposure. PHP 8.1 and older are out of support and got no official release this time, only minimal source patches for people who build PHP themselves. WordPress’s own statistics show 34% of WordPress sites still on 8.1 or older, 15% on 7.4 alone. Patching has also been fast: the scanning company Melurna rechecked sites that advertise their PHP version 24 hours after the release and found 23% updated, with some hosts moving more than 90% of their sites within a day. Version numbers are only a guide, since distributions such as Ubuntu backport fixes without changing them.

Real-world attacks, for now, look milder than the headline. Bojan Zdrnja of the SANS Internet Storm Center went through the proof-of-concept code circulating online and found “an unbelievable amount of AI generated – erm, slop”. The one that works has several preconditions and is “almost cheating”, he writes, and a universal, reliable one-click exploit looks “quite difficult”. The release itself was brought forward a day, to 21 October, after the CVE numbers leaked on the 20th and a container-image company published patched images more than six hours before the coordinated release.

If you only visit websites, there is nothing to do. If you run a blog or shop on shared or managed hosting, your host usually handles it; check in your control panel that PHP is on one of the four versions above. If you run your own server, update it yourself, and if you are on 8.1 or older, get a backported fix from your distribution or long-term-support vendor, or move to a supported version. For those who cannot update yet, php.net lists temporary settings, but says they only reduce exposure: “updating is the only safe choice”.

The foundation ends with its own tally. Since 1 July the PHP security team has published 15 CVEs and worked through more than 100 reports that were invalid, duplicates or could not be reproduced, many from AI-assisted research. “Tools now find bugs faster than ever, for defenders and attackers alike,” it writes. “What tools cannot do is decide on the right fix for a long-standing design decision in the engine, weigh the compatibility trade-offs, and review the patch.”