Agentic
Loading
← All articles
Security·4 November 2026·By Umut Ucak·8 min read

php2shell: A Real Vulnerability, But a Distorted Framing

php2shell: A Real Vulnerability, But a Distorted Framing

On October 20th, social media was set on fire with the ahead-of-schedule leaking (1) of critical vulnerabilities in PHP (a popular programming language that is used to build websites), alongside proof-of-concept demonstrations (2) of the discovery, named php2shell. The news spilled into the daily conversation very quickly with mainstream media coverage (3) (4) (5). Headlines were made, doomsdays were prophesied, and AI was discussed extensively (6) (7). So, here at Arcas, we want to disclose our take on the topic; what happened in the week of October 20th, what did not happen, and what we think all this means.

What really happened

We will base our sources on The PHP Foundation’s (TPF) own report (8) that gives a technical overview of the discovered vulnerability, as well as what was happening inside TPF before, during, and after the discovery from a logistical and operational perspective. What we understand happened, in order:

  • In 2024, a problem was found regarding how PHP was handling parts of the code that would try to use resources that simply are unavailable. If mishandled, unexpected behaviour emerges. By the security team, an exploit “was theorized, but no concrete vectors were found.”
  • On July 30th, 2026, as part of a vulnerability discovery program called Patch the Planet, a California-based security firm that specialises in AI-driven vulnerability research, Calif, began their audit of PHP, and on August 11th, reported an issue where an attacker, without any interactions from the server’s side, can infiltrate the server and run any arbitrary code they want. This puts data, service availability, and any other devices and systems connected to the server at risk.
  • On August 24th and September 18th, independent reports on the same root cause were delivered by OpenAI and another security company, Wiz.
  • On October 20th, the vulnerability was leaked (1). In response, TPF moved up its release timeline, as well as making a pre-release statement (9).
  • On October 20th, Calif “mistakenly” released a video showing their proof-of-concept (10). They quickly deleted it, but it already started spreading across the internet.
  • On October 21st, a software supply-chain security company, Chainguard, violates the release embargo and ships their fix six hours ahead of schedule (11), allowing attackers to study the fix in binary form before all other users received their releases, “disregarding weeks of work by many parties toward a coordinated disclosure.”

Calif (12), Wiz (13), and OpenAI (14) all made their own posts disclosing their ends, and Chainguard CEO explained why they broke the embargo (15). Ryan Austin (the researcher at Calif who found the vulnerability in August) also reports how this vulnerability was discovered. In chapter How did we find this? of (12) he discloses his use of AI:

No special harness, or access to models that weren’t generally available to everyone were used in the initial bug discovery. I focused on something I had a background in, knew its vulnerability history well, and held a theory that specific bugs lurk within the codebase. This shows that “know your target” is still as applicable as ever, even in the LLM dominated VR age. No model is simply capable of unearthing “all bugs” with simple prompts. At least for now.

So far so good. Confirmed: this was a real and impactful vulnerability that genuinely put machines on the internet at risk at a large scale. Parties involved all disclosed the technical details and operational steps clearly and when all put together, paint a very stable picture. This was a real vulnerability, found by cybersecurity researchers with AI assistance; the earliest path they found dates to PHP 5.4.0, released in 2012 (12) (16), and failed at different stages of communication to deliver a well coordinated patch. Let’s see if the mainstream impact of this story is scaled appropriately.

What was said

There are a few talking points floating around, which seem quite scary and important. Let’s take a look at them:

70% of the internet is at risk

This headline makes one believe “Oh no, 70% of my internet presence is at risk”, which is simply untrue. This data comes from sources like Web Technology Surveys (W3Techs) (17). They do in fact report that “PHP is used by 69.2% of all the websites whose server-side programming language we know.” However, that does not mean 70% of internet interactions go through PHP: W3Techs counts websites, not traffic, and its Market Position chapter compares PHP’s popularity against its traffic as two separate measures.

Out of the popular sites using PHP; let’s focus on WordPress (18): 39.5% of all websites, and a popular blogging platform that anyone can set up themselves. WordPress is commonly used to set up business or personal sites, the latter of which often does not even contain confidential information or run on critical infrastructure. When such a site runs in a container with technologies like Docker (19) (which any responsible sysadmin should be using anyway), an attacker who achieves remote code execution has little to gain beyond the site itself: there is no confidential information on the system, and escaping a correctly configured Docker container is a completely separate challenge on its own. Looking at the problem from a proper technical perspective, we slowly trim down the 70%.

The point being: yes, 70% is a real statistic, but not what you think it means. To put things into perspective, numbers can deceive in the same way elsewhere too: did you know that about 76% of incorporated places in the US have fewer than 5,000 people, and almost 42% of those have fewer than 500? (20) Counting places and counting people answer different questions, just as counting websites and counting traffic.

The biggest vulnerability in the history of the internet

Wiz’s write-up ranks the findings among the most severe vulnerabilities discovered in PHP, “and arguably in software history” (13). Here are six other PHP memory-safety vulnerabilities of varying severity, in the same class as php2shell: CVE-2026-6722, CVE-2026-17544, CVE-2026-7258, CVE-2026-7261, CVE-2026-7568, CVE-2026-6104. All of these are from 2026 alone.

Below is a non-exhaustive list of other vulnerabilities in 2026 for popular tech stacks. All of them are listed by CISA as exploited in the wild (21); each can be reached over the network by an attacker with no account, lets that attacker either run code on the target or bypass authentication to take control of it, and scores 8.6+ on CVSS:

Apart from Reuters’ reporting on Oracle’s CVE-2026-35273 (22), our research could not yield any mainstream media coverage for any of these vulnerabilities. Although these vulnerabilities do not exist in “70% of the internet”, these are still complete-takeover or arbitrary remote code execution vulnerabilities present in unavoidable business tech stacks, and we would hardly consider them dismissible. These bugs rarely make the headlines unless they cause outages the public can see or arrive with a strong narrative, php2shell had both. Governments took websites offline (23), and Wiz’s own write-up carries the largest possible framing (“affecting 70% of the Internet” in its title and “arguably in software history” in its text), alongside calls to action for its own products (13). Wiz became part of Google Cloud in March 2026 (24). Security vendors have a commercial interest in how a vulnerability is framed, and in our view, much of the coverage amplified that framing instead of testing it, with headlines such as “What’s the PHP coding flaw that could pull down 70 percent of the internet?” (23). Exposing php2shell to the mainstream makes it seem like these vulnerabilities are rare, which is far from the truth.

Here are some quick points (with their references, as we’d like to distance ourselves from the popular coverage consisting of vague and untraceable claims):

  • At the time of peak media coverage, authorities reported attempts to exploit the flaw yet no confirmed compromises (25). On October 26th, it was added to CISA’s list of known exploited vulnerabilities. (26)
  • In 2024, a PHP vulnerability was actually exploited in the wild (27), yet our searches found no mainstream media coverage (28) (29).
  • The chaos that took place in the week of October 20th had nothing to do with AI, and everything to do with how humans failed to orchestrate a successful execution of patches. If someone who had not been told of the embargo had not leaked it (30), if Calif had not “mistakenly” published its proof-of-concept video, and if Chainguard had not broken the embargo with an uncoordinated release (8), much of the chaos would have been completely avoided.

AI is hacking the unhackable

Andrew Chang on CBC News talks about the PHP vulnerability (31) with headlines like “hacking the unhackable”. He states that this discovery was “found and powered by the most powerful frontier AI systems”, and that it goes beyond human capabilities of codebase analysis.

There is some truth here. The modern neural-network-powered AI models are truly great pieces of technology, reaching levels of data processing never seen before. However, as Ryan Austin said: No special harness, or access to models that weren’t generally available to everyone were used in the initial bug discovery.

In Calif’s case, no model made this discovery autonomously; it was human domain experts driving very capable, generally available tools, which is not what we are reading in the news.

Unsurprisingly, humans are still the key

There is no denying the following: AI-powered cybersecurity operations are here and are not going anywhere. This isn’t particularly a good or a bad thing; it’s how technology has always progressed. It is the same arms race that humans have been in the loop of for our entire existence. AI agents can now scrape online services, run probes without a person at the keyboard, and be pointed at attack as easily as at defence. The same technology is being used for vulnerability research, as in the case of php2shell.

The PHP Foundation’s report shows what this looks like from the maintainers’ side; AI-assisted research means the PHP security team now receives far more reports than before, and in this case it had to work through more than a hundred that turned out to be invalid, duplicates, or not reproducible. The same report says AI also helps the team validate reports and group those that share a root cause. Both effects are real, and neither removes the people: someone still has to decide which reports are genuine, which fix is correct, and when to disclose.

The discovery itself points the same way. In Calif’s account, the bug was found by a researcher who had a background in the codebase, knew its vulnerability history, and held a theory about where bugs lurk, using models that were generally available to everyone (12). AI assisted a researcher who already knew where to look; it did not replace them. Human expertise is still the key, which is the opposite of the picture painted in the headlines. So the way to push back on the fear is the unglamorous one: educate ourselves about what these tools can and cannot do, read the primary reports, and keep experienced humans in the loop.

References

  1. Hacker News, “Tell HN: 2x PHP RCE CVEs with CVSS 10.0 Incoming”, https://news.ycombinator.com/item?id=50167754, accessed 26.10.2026
  2. Twitter/X, php2shell proof-of-concept video, https://x.com/k_firsov/status/2112641845926989944, accessed 26.10.2026
  3. The Guardian, “‘Black October’: cybersecurity experts sound the alarm over new era of AI-enabled hacking”, https://www.theguardian.com/technology/2026/oct/23/cybersecurity-ai-hacking-php-vulnerability, accessed 26.10.2026
  4. CNBC, “AI’s ‘Black October’: Critical PHP flaws set off global security scramble”, https://www.cnbc.com/2026/10/23/php-vulnerabilities-ai-cybersecurity.html, accessed 26.10.2026
  5. WSJ, “Cyber Responders Strained By ‘Black October’”, https://www.wsj.com/pro/cybersecurity/cyber-responders-strained-by-black-october-e259ea25, accessed 31.10.2026
  6. BBC News, “A flaw in PHP is taking down websites. Is the internet at risk?”, https://www.youtube.com/watch?v=Ubl1mxoYe64, accessed 26.10.2026
  7. Breaking Point, “‘BLACK OCTOBER’: AI Cybersecurity NIGHTMARE As BANKS Infiltrated”, https://www.youtube.com/watch?v=vZD4PmureWM, accessed 26.10.2026
  8. The PHP Foundation, “Today’s PHP Security Release, and How We’re Strengthening PHP Security”, https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/, accessed 26.10.2026
  9. The PHP Foundation, “Upcoming Critical PHP Security Release”, https://www.php.net/archive/2026.php#2026-10-20-1, accessed 26.10.2026
  10. Twitter/X, Calif’s php2shell thread, https://x.com/calif_io/status/2112905223929049457, accessed 26.10.2026
  11. Twitter/X, Chainguard’s PHP patch release, https://x.com/chainguard_dev/status/2112910754672185842, accessed 26.10.2026
  12. Calif, “A tale of two PHP remote vulnerabilities”, https://calif.io/php2shell/, accessed 26.10.2026
  13. Wiz, “PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet”, https://www.wiz.io/blog/php2shell-php-rce, accessed 26.10.2026
  14. OpenAI, “Patch the Planet: global response coordination as agents uncover critical vulnerabilities”, https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/, accessed 26.10.2026
  15. Hacker News, Chainguard CEO embargo-break comment, https://news.ycombinator.com/item?id=50176735, accessed 26.10.2026
  16. LWN.net, “PHP 5.4.0 released”, https://lwn.net/Articles/484832/, accessed 31.10.2026
  17. Web Technology Surveys, “Usage statistics of PHP for websites”, https://w3techs.com/technologies/details/pl-php, accessed 27.10.2026
  18. Web Technology Surveys, “Usage statistics and market share of WordPress”, https://w3techs.com/technologies/details/cm-wordpress, accessed 27.10.2026
  19. Docker, “What is Docker?”, https://docs.docker.com/get-started/docker-overview/, accessed 27.10.2026
  20. United States Census Bureau, “America: A Nation of Small Towns”, https://www.census.gov/library/stories/2020/05/america-a-nation-of-small-towns.html, accessed 27.10.2026
  21. CISA, “Known Exploited Vulnerabilities Catalog”, https://www.cisa.gov/known-exploited-vulnerabilities-catalog, accessed 31.10.2026
  22. Reuters, “Google says ShinyHunters hackers targeting education sector via Oracle exploit”, https://www.reuters.com/legal/government/google-says-shinyhunters-hackers-targeting-education-sector-via-oracle-exploit-2026-06-11/, accessed 31.10.2026
  23. Al Jazeera, “What’s the PHP coding flaw that could pull down 70 percent of the internet?”, https://www.aljazeera.com/news/2026/10/22/whats-the-php-coding-flaw-that-could-pull-down-70-percent-of-the-internet, accessed 31.10.2026
  24. Google (press release via Scoop), “Google Completes Acquisition Of Wiz”, https://www.scoop.co.nz/stories/BU2603/S00191.htm, accessed 31.10.2026
  25. The Guardian, “Websites across world hit by millions of attempts to exploit PHP code flaw”, https://www.theguardian.com/technology/2026/oct/22/websites-across-world-hit-by-millions-of-attempts-to-exploit-php-code-flaw, accessed 31.10.2026
  26. Rapid7, “CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP”, https://www.rapid7.com/blog/post/etr-cve-2026-109618-and-cve-2026-109619-critical-unauthenticated-remote-code-execution-in-php/, accessed 31.10.2026
  27. Twitter/X, TellYouThePass ransomware post, https://x.com/censysio/status/1800989855192658413, accessed 31.10.2026
  28. DuckDuckGo, search results for “php tellyouthepass 2024”, https://noai.duckduckgo.com/?q=php+tellyouthepass+2024&noai=1&ia=web, accessed 31.10.2026
  29. Google, search results for “php tellyouthepass 2024”, https://www.google.com/search?q=php+tellyouthepass+2024, accessed 31.10.2026
  30. Hacker News, “Tell HN: I unknowingly broke the PHP RCE embargo. I am sorry”, https://news.ycombinator.com/item?id=50193416, accessed 26.10.2026
  31. CBC News, “PHP flaw: How AI just hacked an unhackable part of the internet | About That”, https://www.youtube.com/watch?v=WiEXPHYA6xM, accessed 25.10.2026
Talk to usMore articles