PHP2Shell: AI accelerates the patch race and SMBs fall behind

PHP2Shell: when the hole is in the language, not in your application

Last week, several European public administrations shut down their websites. Germany temporarily removed several federal portals, France did the same with prefecture sites, Belgium disabled those of the Ministry of Foreign Affairs, and organizations in the Netherlands took down customer-facing services. It was not an ongoing attack, but a precautionary measure in response to two newly disclosed vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619, dubbed PHP2Shell. The problem: there was no mitigation available at that time.

The community reacted quickly and the PHP project released patches for all supported versions on the morning of October 21. But the underlying issue remains unresolved: an estimated 40% of PHP users run unsupported versions, just as AI is multiplying CVE detection.

For an SMB, the lesson is uncomfortable: if your web application runs on PHP, the flaw is not in your CMS or your framework, but in the interpreter itself. And that completely changes the rules of the game.

What makes PHP2Shell different

The two vulnerabilities allow remote code execution (RCE) and exposure of sensitive information in memory. According to Wiz Research, an attacker could read passwords, authentication tokens, API keys, and certificates. Most concerning is that the flaw is triggered by a combination of out-of-memory (OOM) conditions and PHP's error handling, and affects all versions from PHP 5.4 onward, at least for one of the two CVEs.

Datadog Security Labs, which independently reproduced the flaws, confirmed that application-level authentication does not stop the attack: PHP processes the malicious request before the application code executes. In their tests with CVE-2026-109618, the request "never reaches the target application code." In other words: even if you have a robust login and a WAF, if the runtime is vulnerable, you are exposed.

"Even with good security practices in the application, your applications can remain exposed because the vulnerable behavior occurs below the application, in the PHP runtime itself."

The only real answer is to patch. And here comes the first warning for the unwary: there is no magic mitigation outside a patched version of PHP.

Mass patching and the race ahead

The coordinated effort was remarkable. The PHP ecosystem security team, the PHP Foundation, and the maintainers of the different branches worked with long-term support providers (such as Zend) to release all patches at once. It is the first time in more than 20 years that something like this has been seen, according to the author of the original article. Thanks to this, those still on versions without official support (PHP 8.1 or earlier) were able to protect themselves without gaps, provided they contract extended support.

But trust was also put to the test: the CVE numbers leaked on October 20 and all releases were moved up by a day. By 14:00 UTC on October 21, all community versions had an update. LTS providers covered the EOL versions.

The message for an SMB is clear: if your hosting provider or your internal team does not have a plan for unsupported versions, you are playing Russian roulette. And we are not only talking about PHP: any critical component of your stack can fall out of support before you realize it.

AI accelerates vulnerability research

PHP2Shell is an example of what happens when AI makes security research more accessible. Under OpenAI's Patch the Planet initiative, a researcher identified a critical flaw in PHP using GPT-5.6 Sol. PHP maintainers led the fixes and the release, with researchers and security vendors contributing testing and coordination.

What is striking is the change in scale: OpenAI states that these are already several of the significant flaws it has found and that it expects similar findings to "increase sharply in the coming months." We have always been running a race between disclosure, patch availability, and exploitation. PHP2Shell shows how uncomfortable and tough that race can become.

For an SMB, this means that the patching pace is no longer linear. AI not only helps attackers; it also helps researchers and maintainers. The result is a steady stream of critical CVEs that demands a mature patch management process, not panic reactions.

What do we do with unsupported versions?

The easy advice is "update now." The operational reality is more complicated: migrating from PHP 8.1 to a higher version may require updating frameworks, libraries, and your own code. In an SMB with a custom application, that can take weeks or months. Meanwhile, there are intermediate options:

• Contract extended support (LTS) for EOL versions while you plan the migration. Providers such as Zend or others offer backported security patches.
• Prioritize Internet-facing systems. An internal backend is not the same as a customer portal.
• Review your PHP inventory: versions, dependencies, and end-of-support dates. If you do not have one, start there.
• Establish a patching process with defined windows and automated testing. AI can help generate tests, but it does not replace discipline.

At ForgeNEX we have seen how generative AI accelerates development, but also how it introduces risks if it is not controlled. In the case of the OpenAI AI that goes off script, we already warned about the need for oversight. Now the pattern repeats itself in security: the same technology that finds flaws at record speed can also be used to exploit them. The difference lies in preparation.

It is not about being afraid of AI, but about assuming that the vulnerability lifecycle has been compressed. SMBs that depend on PHP —and there are legions of them— need a runtime maintenance plan, not just an antivirus and a firewall. The patch race has already begun, and AI has just stepped on the accelerator.

Source: The New Stack. Analysis and adaptation: ForgeNEX.