PHP2Shell: AI-found PHP flaws, global precautionary shutdowns

The chain

The report, the responsible party’s response, the fix they claimed, whether anyone independent checked, and where it stands. A company saying it fixed something and evidence that the fix worked are different rows.

1. Reported Aug 11, 2026

   Calif, working with OpenAI's GPT-5.6 Sol under OpenAI's 'Patch the Planet' program, reported the flaw to the PHP security team on Aug 11; Wiz independently found it with AI assistance (Aug 19) and reported it Aug 24. PHP acknowledged and began a coordinated fix Sep 21. The CVE IDs, a proof-of-concept video and a pseudonymous forum post leaked on Oct 20, a day before the planned release. source

2. Response Oct 21, 2026

   The PHP Foundation moved the release up a day, shipped fixes on Oct 21 (~14:00 UTC), and publicly blamed the leak; it said Chainguard 'unilaterally broke the embargo' by publishing fixed images six hours early (Chainguard disputes this). It acknowledged the underlying issue had surfaced in 2020 and in a 2024 audit, called the delay a structural failure and asked companies and governments for sustained security funding. CISA, NSA, the UK NCSC and other national agencies issued same-day patch-or-go-offline advisories. source

3. Claimed fix Oct 23, 2026 partial

   Fixed releases PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 address CVE-2026-109618 and CVE-2026-109619; branches before 8.2 get no official fix (Qualys counts about 110 million instances, 71%, on end-of-life versions; Censys still counts 34.4 million vulnerable services). On Oct 23 PHP flagged a third, narrower code-execution bug (CVE-2026-115560) and said it will fix it in the next regular release because 'the issue can only occur under an unusual combination of configuration and application code'; the interim advice is to disable session upload progress. source

4. Independent check Oct 23, 2026 partial

   No independent party has reported a way around the Oct 21 patch. VulnCheck says it has a working exploit against the recommended production configuration of unpatched hosts, kept to paying customers, and 'We are not aware of any other public or commercial exploit that achieves RCE on multiple versions of PHP.' Hunt.io, Wordfence, SOCRadar and Sansec report millions of attempts but no confirmed compromise; Sophos corrected its one claim of a successful exploit. Nobody has published an independent review of the patch's completeness, and CISA has not added either CVE to its Known Exploited Vulnerabilities list. source

5. Where it stands Oct 23, 2026 ongoing

   Day three after the patch: a Mirai variant is trying to recruit servers, a production-grade exploit exists but is held by one vendor, a third PHP bug is unpatched by design, most exposed hosts run versions that will never be fixed, and no organization has confirmed a breach. source

What would change the verdict

A confirmed in-the-wild compromise (or a CISA KEV listing), or a public way around the Oct 21 patch, would turn precautionary disruption into real damage.