On 21 October, the PHP project shipped emergency releases for two critical flaws in the language's core engine. The bugs had been sitting in PHP for more than a decade. What changed this year was not the code but the tools: researchers at Wiz and Calif, working with frontier AI models, turned a set of obscure memory-handling errors into working, unauthenticated remote code execution against default installations of WordPress, Drupal and Joomla. Within hours, governments and public bodies were taking websites offline rather than risk running them unpatched.
The incident, which Wiz has named PHP2Shell, is worth studying closely. It is one of the clearest signs yet that AI is changing the economics of finding and exploiting vulnerabilities, and it carries a specific lesson for anyone who keeps secrets, including private keys, on systems connected to the internet.
What was found
According to the PHP security advisory, the two vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. The first comes from out-of-memory handling that can interrupt PHP while internal request data is only partly initialized, so the cleanup step treats invalid data as valid. The second lets request-owned internal state survive after its memory has been freed, so a later request handled by the same worker can use that stale state. PHP lists every installation serving web requests as at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and considers the risk highest for mod_php, where an unauthenticated request can trigger the attack before any application code runs.
The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive updates from the project, although the security team published minimal source backports for 7.4, 8.0 and 8.1. The advisory is direct about the alternatives: configuration changes reduce exposure to specific attack paths, but "updating is the only safe choice."
Wiz's technical write-up adds two details that matter beyond the patch. First, the flaw is in PHP itself, so "even a simple 'Hello World' application running on an affected PHP version can be vulnerable." Second, apart from code execution, the researchers showed that an attacker could read the PHP process's memory, which "may contain passwords, authentication tokens, API keys and certificates belonging to other requests or the server itself."
Why AI is the real story
Memory bugs like these are not new. What kept them unexploited was effort. An exploit had to chain several flaws and adapt to the memory layout of each PHP version, configuration and application, with repeated testing and debugging for every target. Wiz describes that work as "at the edge of what human researchers could practically achieve" before AI. With frontier models, the team says it could "develop and adapt working exploits across multiple applications in hours."
That cuts both ways. In this case, defenders got there first. Wiz reported the issues to PHP on 24 August, and OpenAI, whose Patch the Planet programme gave Calif access to its models, describes the result as a "Defender's Window" in which fixes and protections could be prepared before disclosure. But the window was shorter than planned. The BBC reported that details leaked on social media the day before release, forcing an earlier announcement, and quoted Cloudflare's chief technology officer as "seeing early attacks emerging." OpenAI also says it expects similar findings "to increase sharply in the coming months."
The practical conclusion is uncomfortable. Complexity used to be a quiet layer of protection: a bug that was too hard to exploit was often treated as low priority. As AI lowers that barrier, old code everywhere needs to be judged by what a capable tool could do with it, not by how difficult it once looked.
A lesson about where secrets live
The memory disclosure part of PHP2Shell deserves particular attention in our industry. Many crypto services run on web stacks, and many of those stacks hold valuable secrets in memory while they work: exchange API keys, signing service credentials, database passwords and, in poorly designed systems, hot wallet keys. A bug that leaks process memory to an unauthenticated visitor turns every one of those secrets into a possible target, even if the application code itself is flawless.
No team can promise that its servers will never have a vulnerability like this. The defensible goal is to make sure that when one appears, the most valuable secrets are not there to be read. That leads to a few concrete habits:
- Know where your runtime is. As Don Smith of Sophos told the BBC, the hard part is often not installing the patch but finding every place where PHP is running. Keep an inventory that includes control panels, appliances and third-party products that bundle a runtime without advertising it.
- Patch at the speed of the new attackers. If exploits can be adapted in hours, update plans measured in weeks are no longer enough. Where patching is not possible, the ENISA joint statement advises isolating exposed applications from public networks until fixes are applied.
- Treat exposure as possible compromise. After patching, rotate credentials that lived on exposed servers and check for signs that an attacker gained a foothold before the update.
- Keep signing keys off web-facing machines. A key that is never loaded into a networked process cannot be read out of that process's memory.
How we approach it
The last point is the principle behind XColdPro, our air-gapped cold storage security platform. XColdPro runs on a computer that stays offline. Transactions are prepared on an online device, signed in the isolated environment and carried back as signed data, so private keys never reach a networked machine. A flaw like PHP2Shell, however severe, has no path to keys that were never on the server in the first place.
The same thinking applies across our work. AI is now one of the most capable tools on both sides of security, and we expect more decade-old flaws to surface quickly. Our response is to design systems that assume some layer will eventually fail, and to keep the things that matter most out of the layers most exposed to the internet.
