How to patch PHP2Shell: versions and steps

AI did not discover PHP2Shell. A PHP developer found early signs of the flaw by hand in 2024, and an independent researcher reported an exploit path in mid-2026 before large language models were used to speed up weaponisation. The two critical remote code execution bugs are real, patched on 21 October 2026, and exploitable without login, but the story about how they surfaced is messier than the headlines.

What are the PHP2Shell vulnerabilities?

PHP2Shell is the nickname for two critical remote code execution flaws in PHP, the server-side scripting language used by a large share of websites, for which the PHP project shipped emergency fixes on 21 October 2026 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both bugs let a crafted web request make the server run attacker-supplied code without any credentials, which is why the nickname pairs the language with a shell.

The PHP project publishes these fixes through its official release announcements, and the security team's account of the disclosure is the best primary record of what shipped and when. The flaws are in PHP's own request handling, not in a framework, CMS or user application. That distinction matters for the fix: replacing WordPress, Drupal or a plugin leaves the vulnerable engine underneath untouched.

Severity scoring in the 9.x range is often reported as a round 10 out of 10. That detail was wrong in early chatter. Treat the exact CVSS score as a detail to read from the advisory itself rather than from social posts.

How does PHP2Shell turn a memory failure into code execution?

The PHP2Shell bug class starts when a request exhausts its memory limit mid-execution, leaving a PHP worker in a partially cleaned state that the next request on the same worker can steer. Each PHP worker handles requests in sequence: it reserves memory, does the work, frees the allocation and moves to the next visitor. The flaw appears when the allocation fails partway through.

When a request runs out of memory, PHP aborts mid-step. Some internal bookkeeping is half-written, and some pointers still reference memory that has already been released. A later request served by that same worker can encounter those leftovers. An attacker who shapes what lands in that reused memory can redirect execution instead of merely crashing the process.

This is why the mitigation is a restart, not just a file copy. A patched binary that has not replaced its running workers still has processes in the old code path. Restarting PHP-FPM, mod_php or whatever process manager is in use is part of applying the fix.

Wiz Research, a cloud security vendor, published its analysis of the flaws under the PHP2Shell name and reported working exploits against fresh installs of WordPress, Drupal and Joomla with no login. Wiz also described a quieter variant that reads credentials and keys out of server memory. Those results belong to Wiz's testing; the underlying memory-management flaw belongs to the PHP project.

Which PHP setups are actually exploitable?

Exposure depends on the server integration and on how memory limits are configured, and reach extends to PHP 5.4, a release line from 2012 that never received these fixes. Older Apache deployments running mod_php with default settings are the most direct path, according to the Wiz analysis. Modern PHP-FPM setups are also affected, but more conditions have to line up for an attacker.

The practical checklist for administrators looks like this:

1. Identify the PHP version and the SAPI in use (PHP-FPM, Apache mod_php, CGI) on every host that serves PHP.
2. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 from the official release, or to your distribution's rebuilt package carrying the same fix.
3. Restart every PHP worker process so no request is served by pre-patch code.
4. Ask any managed host which PHP build it runs and when it applied the update.
5. For hosts stuck on PHP 8.1 or older, plan a migration, since no official fixed build exists for those lines.

The long tail is the real risk. Sites still running PHP 7 or earlier cannot install an official fix at all, and that is where opportunistic scanning tends to concentrate after a disclosure. A web application firewall can reduce noise, but it does not repair the engine.

Did AI find PHP2Shell?

No. AI did not discover PHP2Shell first, and the disclosure record shows a human PHP developer spotting early signs of the flaw by hand in 2024, an independent researcher reporting an exploit path in mid-2026, and several teams converging on the same root cause within weeks. Large language models entered the story as acceleration for exploit development, not as the original discovery.

A PHP developer auditing the codebase while fixing something else found the first signs of the memory-handling problem in 2024. Nobody could demonstrate exploitability at the time, so the fix stalled for roughly two years. The PHP Foundation has described that delay as a structural failure, citing too few security hands and disagreement over the right remediation.

The first team to report the issue in mid-2026 was an independent researcher working with a small firm, and that researcher has said a human pointed the way and that no special model was involved. The same account notes that major AI labs had already run audits over PHP and expected nothing critical. Wiz Research, OpenAI's security team and the independent firm all reported related findings inside about two weeks, which is a convergence pattern rather than an AI-first discovery.

What did the AI models actually contribute?

The models compressed the exploit-development grind. Wiz Research reported that it used Google's Gemini and OpenAI's GPT models and stated that a single researcher accomplished in a week what a world-class team would previously have needed months to do. That is a vendor-reported claim about Wiz's own workflow, not an independent measurement of AI capability.

Spotting a suspicious memory bug is the easy half. Turning it into a reliable attack across servers with different allocator layouts, extensions and memory limits requires repeated test, crash, adjust loops. Wiz attributes much of that iteration to the models. The same tooling can serve defenders, but only where someone has the time and authority to act on the findings.

The disclosure timeline added its own pressure. The fixes were planned for a Thursday, then pulled forward a day after vulnerability identifiers circulated online with an incorrect severity score on the Tuesday afternoon. One research team also published an attack video by mistake before removing it, and copies circulated. Cloudflare reported seeing exploitation attempts before the patch was broadly available, while the PHP team said it had no working public exploit in hand at release time.

What should PHP administrators do now?

Update PHP itself to a fixed release and restart every worker. Updating a CMS, theme or plugin will not close PHP2Shell because the vulnerable code sits in the PHP runtime. Managed hosting customers should get a written answer from their provider about which build runs and when it changed.

• Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, per the PHP project's release announcement.
• Not fixed: PHP 8.1 and older, which have no official patched build.
• Restart required: apply the binary and recycle PHP-FPM or mod_php workers.
• CMS updates: necessary for other reasons, irrelevant to this flaw.
• Verification: confirm the running version with php -v and check the SAPI in phpinfo() output.

Distributions that backport security fixes should be checked against their own advisories rather than assumed current. If a host cannot move off an unsupported branch quickly, network filtering and short request timeouts reduce exposure while a migration is scheduled.

What does PHP2Shell say about AI-assisted security research?

PHP2Shell did not surface a bug nobody knew about. It made a known but hard-to-exploit memory flaw cheap to turn into a working weapon. That is the shift worth tracking: flaws that sat in backlogs as too difficult to weaponise became practical targets once model-assisted iteration lowered the cost of exploit development.

The same leverage applies to defenders. Audits that were once too expensive to attempt become feasible, but the bottleneck moves to remediation capacity. The PHP Foundation's own account of the delay, and the two-year gap between the 2024 finding and the 2026 fix, point to staffing and decision-making as the constraint rather than detection.

FAQ

• Does updating WordPress fix PHP2Shell? No. The vulnerable code is in PHP itself, so a CMS or plugin update leaves the exposure in place. You must update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and restart the PHP worker processes.

• Is PHP2Shell exploited in the wild? Cloudflare reported attack traffic before the patch was broadly available, while the PHP team said it had no working public exploit when the fix shipped. Treat exposure as real and patch rather than waiting for confirmation of wide exploitation.

• Did an AI model discover the flaw? No. A PHP developer found early signs by hand in 2024, and an independent researcher reported an exploit path in mid-2026. Wiz Research used Gemini and GPT models to speed up exploit development, which is a different contribution.

• Does PHP2Shell affect all PHP sites? It affects PHP installations on the vulnerable versions, with severity depending on the server integration and memory configuration. Older Apache mod_php setups with default settings are the most directly exposed; PHP-FPM deployments are also affected but need more conditions to line up.

Source video