PHP2Shell engine flaws draw mass attack attempts after disclosure
First merged summary.
Two PHP-engine flaws, PHP2Shell, are public; Cloudflare reports millions of attempts while successful compromise is unconfirmed.
Researchers disclosed two PHP-engine memory-corruption flaws, collectively called PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, in handling of out-of-memory conditions and fatal errors. They affect PHP applications broadly, with reported pre-authentication remote code execution against WordPress, Drupal, and Joomla. OpenAI says Calif found bugs with GPT-5.6 Sol under Patch the Planet after about two months of private coordination; Wiz independently reported the flaws. Cloudflare deployed WAF rules as a stopgap and later counted millions of attempts. The PHP Foundation says it has not seen successful exploitation, and whether compromises succeeded is not established.
- CVEs are CVE-2026-109618 and CVE-2026-109619 in the PHP engine, not a plugin.
- Help Net Security says Calif found one flaw; Latent Space says both parties found both.
- TechCrunch says humans found the bugs and used AI to exploit them.
- Cloudflare WAF rules cover known vectors, including the free tier.
- PHP Foundation reports no confirmed successful exploitation; many exploits appear ineffective.
- OpenAI outlined a five-stage multi-party response based on the PHP case.
What each outlet adds
beyond the shared facts- Latent SpaceNames both CVEs, AI tools used, and the two-month coordination.
- Help Net SecurityCalif found one flaw; details OpenAI’s five-stage disclosure process.
- WIREDMillions of attempts; PHP Foundation sees no successful exploitation.
- TechCrunchCorrects discovery to human researchers; cites an embargo break.
Coverage
oldest first · one row per article · UTC- · 8d ago
Help Net SecurityFirst report
OpenAI outlines a five-stage response plan for AI-found critical bugs
The plan follows a two-month PHP response in which Calif and Wiz independently found the flaws.
- · 8d ago
Latent Space
Core PHP PHP2Shell bugs enable unauthenticated RCE, two teams report
Calif, using GPT-5.6 Sol, and Wiz independently found CVE-2026-109618 and CVE-2026-109619 after about two months of private coordination.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |