PHP2Shell is a warning for any company letting agents write its code

Last Wednesday, October 21, the PHP project shipped emergency fixes for two flaws that let an attacker run code on an unpatched server without any credentials, according to watchTowr’s running FAQ. The pair, CVE-2026-109618 and CVE-2026-109619, is now known as PHP2Shell. Both are rated 9.2 on the CVSS v4 scale.

Cloudflare saw tens of thousands of exploit attempts within 45 minutes of the news spreading and millions by that evening, Fortune reported. Palo Alto Networks counted 22.6 million potentially vulnerable instances in its first pass. Amazon said it had seen exploitation about a week before the patches came out and told defenders to look for signs of it starting October 17, per TechCrunch. Yesterday, CISA added CVE-2026-109618 to its catalog of known exploited vulnerabilities, watchTowr noted.

If your website runs on WordPress, Drupal or Joomla, you run PHP. Patch first. Then read the rest of this, because PHP2Shell says something about the next few years that goes well beyond one language.

TimelineHow PHP2Shell unfolded

1. Aug 1Calif finds the first issue
2. Aug 19Wiz finds it independently
3. Oct 17Earliest exploitation flagged
4. Oct 21PHP ships emergency fixes
5. Oct 26CISA lists it as exploited

AI found the flaw, and attackers moved in minutes

According to Fortune, the flaws sat in PHP for about 14 years. Calif, a security firm, found the first issue on August 1 using an OpenAI model, and Wiz found it independently on August 19 using models from Google and OpenAI. Wiz said AI’s biggest contribution was making it far easier to understand the weakness and turn it into a working exploit.

Calif was more measured in TechCrunch’s account. It said AI helped, but most of the work came from its researchers’ existing knowledge of PHP. No model finds every bug from a simple prompt, it wrote, at least not yet.

Both things can be true, and together they describe the new situation. Skilled people with AI tools can now find and weaponize old flaws faster than before. The same tools are available to the people attacking you. OpenAI made the same point to Fortune: the capability that finds a flaw can help an attacker build an exploit quickly. The window between “a fix exists” and “someone is using this against you” is now measured in minutes.

The scale made it worse. Wiz told Fortune that 70% of the internet was affected, and Fortune cited Reuters reporting that some agencies in the Netherlands and Finland took websites offline as a precaution. TechCrunch reported that banks, retailers, hospitals and some government agencies also pulled servers offline to patch.

The big organizations had help. The PHP Foundation shared details and patches with large companies and web hosts under embargo before the public release, per TechCrunch. Smaller IT teams and solo developers got the news with everyone else, and TechCrunch warned that some of them will patch slowly and some legacy systems will never be updated at all. If you run a company of 30 or 300 people, you are probably in that second group. You most likely heard about PHP2Shell from the news, by which point attackers were already using it, and your patch speed depends on whoever manages your servers, often an outside developer or a hosting plan nobody has looked at in a year.

Agents are writing a growing share of your code

Now put that next to how software gets written in 2026.

Veracode’s 2026 GenAI Code Security Report, released in July, says AI now generates roughly half of all committed code. Across more than 100 models, the average security pass rate was 56%, nearly unchanged from the year before. Models produced code that compiled almost every time and failed security tests about 44% of the time when nobody asked them to think about security. Java was the worst language at 30%.

Veracode’s tests used raw models without the guardrails or human review a real team would add. That caveat matters. It also points straight at the fix. Veracode’s chief security evangelist put it this way: “AI-generated code needs to be treated like any unreviewed code.”

By the numbers

56%

average security pass rate for AI-generated code across more than 100 models

I’m not arguing against agents writing code. At FinalPeace, agents write product fixes alongside the marketing work, and I approve what ships. I’d make the same choice again. My point is that the review and patching habits most small companies have today were built for a world where people wrote code slowly and attackers needed weeks. Neither is true anymore.

What changes when agents write and run your code

Here is what I’d put in place at any company where agents now commit code or run scripts.

Every agent change gets a security check before it merges. Run automated scanning on every pull request, and have a person approve the merge. The person doesn’t need to read every line. They need to see the scan result and know what the change touches.

You know what you run. TechCrunch notes that PHP also sits inside developer tools and components of routers, storage devices, firewalls and VPNs, so you can run it without ever having chosen it. Keep a list of the languages, frameworks and versions in production, including what your agents pulled in. If an agent added a dependency, it should show up on that list.

Patching is measured in hours. For anything rated critical and exposed to the internet, decide in advance who patches it and how fast. watchTowr’s guidance for PHP2Shell is a good template: inventory every PHP system, match each to its fixed release, update, restart the PHP workers so the fix actually loads, and cut internet access to anything you can’t update right away.

Agents run with the least access they need. An agent that runs code should do it in a sandbox, with credentials scoped to the one job. If it gets something wrong, the damage should stop at the edge of that job.

Old systems get an owner or a shutdown date. watchTowr lists no official fixed release for PHP 7.4, 8.0 and 8.1, only vendor packages, source backports or an upgrade, and no fix at all for 7.3 and older. If you have a server like that, it is now one of the easiest ways into your company.

What to do this week

ChecklistPHP2Shell, this week

• Every PHP system inventoried
• Patched to the fixed release
• PHP workers restarted
• Logs checked back to Oct 17
• Unpatchable systems cut off

1. Ask your web host or developer, in writing, which PHP version each of your sites runs and whether it has been updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, the fixed releases watchTowr lists.
2. Confirm the PHP workers were restarted after the update. A patch that isn’t loaded doesn’t protect you.
3. Have someone check server logs back to October 17 for signs of exploitation.
4. List every place an AI agent can commit code or run scripts in your company, and make sure each one has a scan and a human approval before anything reaches production.
5. Write down who patches critical internet-facing flaws and how many hours they have to do it.

Sources

• PHP2Shell (CVE-2026-109618 & CVE-2026-109619) FAQ (watchTowr, October 20, 2026, updated October 26, 2026)
• AI helped discover the PHP vulnerability that could take down 70% of the internet (Fortune, October 21, 2026)
• PHP-ocalypse: How two critical web bugs almost broke the internet (TechCrunch, October 24, 2026)
• Veracode Finds AI-Generated Code Security Has Barely Improved Since Last Year (SD Times, July 28, 2026)