PHP2Shell (CVE-2026-109618): Pre-Auth RCE Threatening 70% of the Web Discovered by GPT-5.6 Sol

The fourth week of October 2026 marked both a historic milestone and an urgent wake-up call for global cybersecurity. The core PHP development team shipped emergency out-of-band releases to patch twin Pre-Authentication Remote Code Execution (Pre-Auth RCE) vulnerabilities—CVE-2026-109618 and CVE-2026-109619—collectively dubbed “PHP2Shell” and rated CVSS 9.2 (Critical).

What makes this advisory extraordinary is not only its massive footprint across roughly 70% of websites on the internet powered by PHP (including WordPress, Laravel, Drupal, and Magento), but also how it was uncovered: the multi-year bugs in PHP’s underlying C codebase were found by an autonomous AI security agent.

How GPT-5.6 Sol Uncovered “PHP2Shell”

CVE-2026-109618 and CVE-2026-109619 were first discovered by security research firm Calif leveraging GPT-5.6 Sol under OpenAI’s “Patch the Planet” initiative—a defensive program focused on auditing critical open-source infrastructure before threat actors can weaponize latent bugs. Researchers at Wiz also independently discovered the same vulnerability path.

Unlike traditional coverage-guided fuzzers that rely on random input mutation, the GPT-5.6 Sol agent performed cross-module dataflow reasoning across thousands of lines of C code inside the SAPI request parser (php-fpm and mod_php) and internal environment variable handlers executed prior to userland PHP scripts.

“The ability of frontier reasoning models to trace subtle interactions between the Zend Engine memory allocator and the HTTP SAPI state machine proves that AI-driven zero-day discovery is no longer a theoretical projection—it is an operational reality today.”

Technical Impact & Why Active Exploitation Emerged So Quickly

Both flaws in the PHP2Shell family trigger during the request initialization phase (pre-authentication), meaning an attacker needs no credentials or valid session to exploit them. By sending a crafted sequence of HTTP packets to any exposed PHP endpoint, a remote attacker can:

1. Corrupt internal parser state before the application script begins execution.
2. Inject directives or alter per-request runtime configuration in the php-fpm worker memory space.
3. Execute arbitrary operating system shell commands under the web server user account (www-data or nginx).

Shortly after the patches landed and the C commit diffs became public, AWS security telemetry detected widespread scanning and active exploitation attempts across public internet endpoints. In response, CISA (United States) alongside national cybersecurity agencies in Japan (JPCERT/CC) and Europe (ENISA) issued emergency cross-border warnings.

Affected PHP Branches & Patched Versions Matrix

All four actively maintained PHP release branches are affected by CVE-2026-109618 and CVE-2026-109619. Verify your fleet against the minimum safe versions below:

PHP Release Branch	Support Status	Affected Versions	Patched Version
PHP 8.5.x	Active Support	< 8.5.12	8.5.12
PHP 8.4.x	Active Support	< 8.4.27	8.4.27
PHP 8.3.x	Security Support	< 8.3.36	8.3.36
PHP 8.2.x	Security Support	< 8.2.35	8.2.35
PHP <= 8.1.x	End-of-Life (EOL)	All versions	Upgrade to >= 8.2.35 immediately

Remediation Checklist for System Administrators & DevSecOps

Because active exploitation is already underway in the wild, system administrators should patch and verify their servers immediately:

# Check currently running PHP CLI and PHP-FPM versions
php -v
php-fpm -v

# On Debian / Ubuntu (using official distro or Ondrej PPA repositories)
sudo apt-get update && sudo apt-get install --only-upgrade php8.4-fpm php8.4-cli php8.4-common
sudo systemctl restart php8.4-fpm

# Confirm the runtime version is >= 8.4.27 or >= 8.5.12
php -r "echo PHP_VERSION . PHP_EOL;"

In addition to upgrading the PHP binaries, perform these post-incident checks:

• Audit PHP-FPM Access & Error Logs: Look for anomalous worker process crashes (SIGSEGV or unexpected exit codes) in php-fpm.log dating back to October 21, 2026.
• Inspect Child Processes: Use EDR tooling or ps auxf to verify that php-fpm workers have not spawned unexpected child processes such as /bin/sh, curl, wget, or outbound reverse shells.
• Harden disable_functions in php.ini: As a defense-in-depth measure, disable process execution functions (exec, passthru, shell_exec, system, proc_open, popen) if your application does not explicitly require them.