> ## Content Index
> Fetch the complete content index at: https://www.bushletter.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# AI found PHP's worst flaw in years, and attackers have the same tools
- URL: https://www.bushletter.com/php2shell-shows-ai-changed-the-economics-of-software-flaws/
- Published: 2026-10-21T15:12:12.000Z
- Updated: 2026-10-21T15:34:55.000Z
- Description: The researchers say AI turned these PHP flaws into working exploits in hours. Any business left unpatched this week should act as if someone got in.
- Author: Bushletter Newsroom
- Tags: Opinion, AI Security

TLDR

The worst PHP flaws in years were found with AI, and the researchers who found them say AI turned them into working exploits in hours. Attackers have the same tools. No break-in has been confirmed yet, but any business whose PHP server sat unpatched this week should assume someone tried, and act as if they succeeded.

KEY TAKEAWAYS

01Wiz says frontier AI models let it develop and adapt working PHP2Shell exploits across multiple applications in hours.

02Details leaked before the fix, so attackers and defenders started at the same time.

03Patchstack reported exploitation attempts against hosting companies hours before PHP released its patch.

04No successful compromise has been confirmed, but attackers do not announce their wins.

05About 18 per cent of WordPress sites run PHP 8.1 or older, which gets no official fix.

## The researchers said the quiet part out loud

The two PHP flaws that sent governments scrambling this week were not found by a lone genius working through the night. Wiz Research said it found them with frontier AI models, working alongside Calif and OpenAI, and that "a single researcher completed in a week what previously would have taken a world-class team months of work".[\[1\]](https://www.wiz.io/blog/php2shell-php-rce?ref=bushletter.com) The flaws, CVE-2026-109618 and CVE-2026-109619, are rated 9.2 out of 10 and let an attacker run code on a web server without a password.[\[2\]](https://www.php.net/?ref=bushletter.com)

The more important line in Wiz's write-up is about what happened next. Frontier models were "enabling us to develop and adapt working exploits across multiple applications in hours", the company said, and it demonstrated attacks against WordPress, Drupal and Joomla test sites.[\[1\]](https://www.wiz.io/blog/php2shell-php-rce?ref=bushletter.com) Wiz said "Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit", and that "LLMs can help adapt an exploit to different PHP versions, configurations and memory layouts".[\[1\]](https://www.wiz.io/blog/php2shell-php-rce?ref=bushletter.com) Wiz is a defender describing its own capability, and nothing in that capability is unique to defenders.

## The head start is gone

The old bargain of security was time. A researcher finds a flaw, tells the vendor privately, and the public learns about it alongside the fix, giving administrators days or weeks before attackers catch up. PHP2Shell broke that bargain twice. Details leaked before the patch existed, and Joviane Jardim, senior security researcher at Detectify, said "the flaws became public before the fix did, so both sides are starting at the same time".[\[3\]](https://therecord.media/php-script-vulnerabilities-warnings?ref=bushletter.com)

The attacks came quickly. Patchstack reported exploitation attempts against hosting companies on the morning of 21 October, UK time, hours before PHP published its fix.[\[5\]](https://patchstack.com/articles/php-major-vulnerability-alert-10-2026/?ref=bushletter.com)[\[6\]](https://www.precursorsecurity.com/blog/php2shell-critical-php-rce-vulnerabilities?ref=bushletter.com) Finland and the Netherlands switched off government services rather than wait. The US National Security Agency told organisations that could not update to "take the system offline until it can be fully mitigated".[\[NSA\]](https://x.com/NSACyber/status/2112903220209098897?ref=bushletter.com)[\[6\]](https://www.precursorsecurity.com/blog/php2shell-critical-php-rce-vulnerabilities?ref=bushletter.com) Jardim said attackers can build a working exploit in under an hour with AI.[\[3\]](https://therecord.media/php-script-vulnerabilities-warnings?ref=bushletter.com)

## Assume someone got in

No successful compromise has been publicly confirmed. Huntress said on 21 October: "Huntress has not yet seen in-the-wild exploitation of these vulnerabilities across our partner base."[\[4\]](https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities?ref=bushletter.com) watchTowr's Jake Knott said "Whilst nobody has been successful to date, we don't expect that will last long."[\[4\]](https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities?ref=bushletter.com)[\[3\]](https://therecord.media/php-script-vulnerabilities-warnings?ref=bushletter.com)

Knott's own forecast is cold comfort. Successful intruders do not file reports, and the first sign of a breach is often a data leak months later. A flaw that hands over a web server without a password, on software that runs most of the internet, published before the fix and attacked within hours, is exactly the opportunity criminal gangs and state-backed hackers are built to exploit. Criminal gangs and state-backed hackers are unlikely to have sat this one out. Bushletter cannot prove that any site has been compromised and does not claim it as fact. A responsible business should still behave as if its unpatched servers were.

The exposure is not evenly spread. About 18 per cent of WordPress sites and nearly 24 per cent of Joomla sites run PHP 8.1 or older, which gets no official update.[\[6\]](https://www.precursorsecurity.com/blog/php2shell-critical-php-rce-vulnerabilities?ref=bushletter.com) Those sites tend to belong to small businesses, councils, clubs and charities. Detectify's Jardim put it bluntly: "Those sites haven't been updated in years, which usually means nobody is watching them either."[\[3\]](https://therecord.media/php-script-vulnerabilities-warnings?ref=bushletter.com) A business web server often holds customer records, contact forms, order histories and the passwords that connect it to everything else.

## What boards and owners should do

Boards should treat PHP2Shell as a business risk. Every board should ask today who runs its web servers, whether PHP has been updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and who checked.[\[2\]](https://www.php.net/?ref=bushletter.com) Any server that sat unpatched should be checked for signs of compromise as well as patched. Businesses that cannot get a straight answer from their host should take the site offline until they do, as governments in Europe have.

The longer lesson is about speed. If AI lets a single researcher do months of work in a week, the gap between a flaw being found and a flaw being used will keep shrinking. Patch cycles measured in weeks will not survive that change. Bushletter's news report has the full checklist and live updates: [Governments pull websites offline as hackers target critical PHP flaws](https://www.bushletter.com/php-patches-two-critical-rce-flaws-affecting-69-of-websites/).

*This is an opinion piece and reflects Bushletter's view.*

**Important:** This article is general information only. It is not legal, technical, cyber security or professional advice, and it does not take account of your systems or circumstances. Details of these vulnerabilities, affected versions and fixes are changing quickly and are drawn from the public sources cited, which Bushletter has not independently tested. Before acting, check the current guidance from the PHP project, ASD's Australian Cyber Security Centre and your software and hosting providers, and get advice from a qualified security professional. Bushletter accepts no liability for any loss arising from reliance on this article, and nothing in it is an assurance that any step will secure a system. This is an opinion piece. Statements about likely compromises and the intentions of criminal or state-backed groups are Bushletter's assessment, not established fact.

If you believe your organisation has been compromised, contact ASD's ACSC on 1300 CYBER1 (1300 292 371) or report through ReportCyber at cyber.gov.au.

SOURCES & CITATIONS

1. [PHP2Shell: critical PHP remote code execution, Wiz Research](https://www.wiz.io/blog/php2shell-php-rce?ref=bushletter.com)
2. [PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 security releases, PHP.net](https://www.php.net/?ref=bushletter.com)
3. [Hundreds of websites taken offline as concern grows over two PHP vulnerabilities, The Record](https://therecord.media/php-script-vulnerabilities-warnings?ref=bushletter.com)
4. [PHP2Shell: leaked critical PHP vulnerabilities, Huntress](https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities?ref=bushletter.com)
5. [Major security alert: PHP vulnerable to critical RCE, attacks ongoing, Patchstack](https://patchstack.com/articles/php-major-vulnerability-alert-10-2026/?ref=bushletter.com)
6. [Live blog: PHP2Shell critical PHP RCE vulnerabilities, Precursor Security](https://www.precursorsecurity.com/blog/php2shell-critical-php-rce-vulnerabilities?ref=bushletter.com)

FREQUENTLY ASKED QUESTIONS

How was AI used to find PHP2Shell?

Wiz Research said it used frontier AI models, working with Calif and OpenAI, to find the flaws, and that the models helped it develop and adapt working exploits across multiple applications in hours.

Have websites already been hacked through PHP2Shell?

No successful compromise had been publicly confirmed at the time of writing. Patchstack and Cloudflare reported exploitation attempts, and watchTowr said it did not expect attackers to stay unsuccessful for long.

Why should businesses assume compromise?

The flaws allow a server takeover without a password, details were public before the fix, and attacks began within hours. A server that was unpatched during that window should be checked for signs of compromise as well as updated.

What should a board ask its IT team or host?

Who runs the organisation's web servers, has PHP been updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or a vendor build that fixes both CVEs, who confirmed it, and has anyone checked the servers for signs of compromise.