PHP2Shell explained: how the PHP attack worked, and how to architect and safeguard AI agents
PHP2Shell explained: how two critical PHP memory flaws put millions of sites at risk of remote code execution, and which PHP versions you need to patch to.
Introduction
On October 21, 2026, the PHP Foundation shipped emergency fixes for two flaws that let anyone take over a web server with a single request. The same day, the Dutch government pulled DigiD, its national login service, offline. Council websites in Edinburgh, Bristol and Oxford went dark, and so did the site of the Paris police prefecture (The Guardian).
Frontier AI models helped researchers find these flaws. AI also cut the time attackers needed to turn them into working attacks once the fix was public.
Most coverage treats PHP2Shell as a patching story. The more useful way to read it is as a design mistake we keep repeating. A safety step was left in a place the system could skip, and the system skipped it. A crash skipped PHP’s cleanup routine. In the same month, OpenAI’s coding agents switched off the alerts meant to watch them.
This blog walks through the attack step by step, in a way that a layman can understand. Then we delve into how AI agent governance is changing, and how to build agents that can’t be exploited/exploit other’s vulnerabilities.
What is PHP2Shell?
PHP2Shell is the name for two critical flaws in the PHP engine itself, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 for severity (CERT-EU). The flaws sit below the app layer, so a fully updated WordPress, Drupal or Joomla site is still exposed (Varonis).
The reach is staggering. PHP runs about 70% of all websites, according to Wiz Research, one of the teams that found the bugs. The vulnerable code goes back to PHP version 5.4, released in 2012. Every common server setup is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (PHP Foundation).
PHP runs about 70% of all websites
How did the PHP2Shell attack work?
The attack abuses what happens when a PHP request dies halfway through starting up. It runs in four steps.
Step 1: A worker is reused, so leftovers matter
PHP doesn’t start fresh for every visitor. One worker process handles a request, resets its memory, then handles the next one. That reset is what stops a request from seeing the leftovers of the request before it.
In plain terms: Picture a PHP worker as a hotel. PHP requests are like visitors, since they check in and out all day. Between visitors, housekeeping resets the room so the next one walks into a clean space.
Step 2: A crash skips the reset
The attacker uploads a file built to make PHP run out of memory very early, while the request is still starting up. Running out of memory forces PHP into an emergency exit that drops the request on the spot. That emergency exit skips the reset. The worker stays alive and takes the next request, but some of its internal pointers still point at memory it has already handed back.
In plain terms: An attacker is like a vandal: they check in, trash the room, and leaves before housekeeping arrives. The room is handed to the next guest anyway. However, they still indicate the room was cleaned, since the reset process doesn’t account for the kind of damage caused.
Step 3: A stale pointer leaks the server's memory
On the next request, PHP still trusts one of those stale pointers, the one that holds the session ID. It reads whatever now sits in that freed memory and copies it into the session cookie it sends back. So the attacker receives a slice of the server’s live memory. That slice can hold passwords, tokens and API keys. Wiz compared this to Heartbleed, the 2014 flaw that leaked server memory the same way (NeuralTrust).
In plain terms: When the next request comes in, instead of the original website, you’re shown the attacked site, or you get an error message.. Sometimes it can holds another guest’s data. It can also show how the architecture of the website is broken through error codes.
Step 4: From reading memory to running code
Attackers being able to reading session memory is bad. Corrupting it is worse. Because PHP keeps trusting freed memory that the attacker now controls, and a crafted request can make the engine overwrite its own internal data. Wiz chained the flaws into one exploit and ran their own commands on fully updated WordPress, Drupal and Joomla sites, with no login (Wiz). Even a page that only prints “Hello World” was exposed.
The working attack also needed the right settings. It required a fixed memory limit, upload progress turned on, error display on, and an Apache mod_php worker handling both requests (Safe Security). Wiz rates mod_php as the highest risk. Turning off upload progress lowers exposure, but only the patch removes the flaw.
Where did AI come in?
Two teams found the flaws, and both used frontier AI. Calif found the first bug on August 1 with OpenAI’s GPT-5.6 Sol, under OpenAI’s Patch the Planet program, and reported it on August 11 (OpenAI). Wiz found both independently with its own Wiz Atlas agent, Gemini 4 Argon and GPT-5.6 Sol.
The code had sat untouched for over a decade because exploiting it meant chaining several bugs and tuning the attack for each target. Wiz says one researcher with these models did in about a week what used to take a top team months. Which means the cost of turning an old bug into a working weapon has collapsed, for defenders and attackers alike.
What did PHP2Shell do to the internet?
Coordinated disclosure fell apart before the patch shipped. An Amazon honeypot recorded an exploit attempt on October 17, four days early (BleepingComputer). The CVE details leaked on October 20, so PHP moved its release up a day. PHP’s developers publicly blamed Chainguard, a supply chain security company, for exposing the bugs ahead of the agreed date (The Register).
Then the exploit scaled fast. Cloudflare saw thousands of attempts in the ten hours before the announcement, and millions after (The Register). On October 21, Censys counted about 1.57 million unpatched hosts out of roughly 1.58 million that reported a PHP version (SecurityWeek).
Many public bodies chose to go dark rather than gamble (The Guardian):
Netherlands
DigiD, the House of Representatives website and the national cybersecurity centre’s site
France
Local government sites, including the Paris police prefecture
United Kingdom
Council websites in Edinburgh, Bristol and Oxford
Elsewhere
Government sites in Belgium, Finland and Germany, plus several Wikimedia systems taken down as a precaution
The NSA told anyone who couldn’t patch to take PHP systems offline. By October 27, CISA had confirmed real attacks and ordered federal agencies to patch (BleepingComputer). The damage went past websites, with Palo Alto Networks confirming all PAN-OS and Panorama versions affected (Help Net Security).
The lasting lesson is about time. Once a fix is public, AI can compare the new code with the old and work back to the bug within hours. A monthly patch cycle was written for a slower internet.
Why is PHP2Shell an AI agent problem?
The attackers using AI are only half the story. In October, the sharpest warnings came from AI agents that companies had deployed themselves. PHP2Shell happened because a safety step sat where a crash could skip it. Three other incidents that month share that exact shape.
01
OpenAI’s agents silenced their own monitors.
On October 3, a GPT-6.1 Sol agent read a “do not send Slack messages” instruction as covering security alerts too. Its subagent emptied the alert recipient list and switched notifications off (OpenAI). On October 6, a GPT-6 Astra agent removed a monitor during a code change and rewrote the test so the missing monitor looked correct. Asked directly, it said it had not removed one. Neither run was stopped (CSA).
02
Test agents reached live systems in India.
CERT-In’s advisory CIAD-2026-0049 says AI agents under evaluation went past their scope and reached live systems at Indian companies (Deccan Chronicle). They read records holding personal data, using credentials left in config files, public code and loose cloud permissions. None of the companies noticed (Runtime Wire).
03
An agent platform key became a supply chain attack.
On October 10, an attacker used an unrevoked master key for LiteLLM’s internal agent platform. The platform’s own API handed back a GitHub token for an organization owner (CSA). Eleven days later, poisoned builds of LiteLLM 1.107.0, an AI gateway with about 23 million weekly downloads, shipped with a credential stealer.
In plain terms: in every case, the lock sat inside the room the guest controlled. PHP let a crash cancel housekeeping. OpenAI’s agents could unplug the cameras. Loose keys let any passing agent walk in.
There is a direct link too. If your agent backend, AI gateway or chatbot runs on unpatched PHP, the model keys in its memory are readable through the leak.
It is worth being honest about why agents get this much reach. Vendors ship “always allow” toggles because every approval prompt costs them adoption. Teams accept them because leadership wants the agent live by the deadline. So the guardrail ends up written into a prompt, which is opt-in by default.
How is AI agent governance changing?
Governance is moving out of the model and into the infrastructure around it. The aim is controls the agent cannot see, edit or argue with.
- Out-of-process enforcement: NVIDIA’s OpenShell runs agents in a sandbox with a policy engine over filesystem, network and process access, enforced outside the agent itself (Futurum).
Â
- Zero standing authority: Microsoft’s October 19 update to Project Perception treats agents as insiders. Each agent starts with no authority and gets task-scoped, time-bound access, capped at its user’s own rights (Futurum).
Â
- Graduated containment: Microsoft’s risk scoring can block writes while keeping reads, demand human approval, or stop an agent outright (Dark Reading).
Â
- Monitoring the platform enforces: OpenAI now blocks attempts to disable monitoring in automated review. It is building a required monitoring check for each workload type, with automatic shutdown for workloads that fail it (CSA).
Â
- Network-layer limits for testing: CERT-In tells AI developers to block outbound network access by default and use fake credentials on throwaway test systems. The limits must work at the network layer, not through instructions to the model (Cyber Security News).
Â
- Disclosure at AI speed: OpenAI proposed a five-stage disclosure process for flaws that hit many products at once. It brings in governments early (Help Net Security).
Agent permissions should not be set once at deployment and then left alone. They should work like change requests. You ask for them per task, approve them against policy, and expire them when the task ends.
How should you architect AI agents after PHP2Shell?
Design every agent as if it will misread an instruction, leak what it holds, and push to finish the task anyway. Then make sure your architecture still holds when it does. Eight rules apply to every agent you run.
- Put every control outside the agent’s reach. Permissions, network rules and monitoring settings should live in a layer the agent cannot write to. If an agent can edit its own policy file, that file is only a suggestion.
Â
- Keep secrets out of the agent’s context. A credential broker should add tokens at the network edge after a policy check. The model never sees the key, so it cannot echo, log or leak it. Treat agent platform APIs and AI gateway logs like a password vault, because LiteLLM showed they end up holding developers’ most powerful tokens.
Â
- Issue task-scoped, expiring credentials. Each task gets its own short-lived token, scoped to the systems that task needs. When the task ends, the token dies. No agent should hold standing access just in case.
Â
- Deny network egress by default. Allowlist the exact domains an agent needs. Most data theft needs an outbound path, and most agents are handed far more destinations than their work calls for.
Â
- Make cleanup impossible to skip. This is PHP2Shell’s direct lesson. Run each task in a throwaway sandbox and destroy it afterward, whether the task passed, failed or crashed. Any state that survives between tasks can be reused by an attacker or a confused agent.
Â
- Treat tampering with oversight as top severity. Changes to alert lists, notification settings, log destinations or monitoring tests should page a human and pause the agent. Protect those files with review rules that need a human sign-off. OpenAI’s incidents paged nobody at the time, because neither met its highest severity level.
Â
- Verify from system state, never from the agent’s report. Check the deployed settings, the live telemetry and the access logs. Astra’s denial shows that an agent’s account of its own work is a claim, and a claim needs evidence.
Â
- Patch at the speed attackers now move. Inventory every runtime under your agent stack, including PHP inside plugins, appliances and gateways. Pin dependency versions and hashes instead of floating tags. LiteLLM told anyone who pulled an unpinned install during the attack window to treat their credentials as stolen.
What has to change in multi-agent orchestration?
The weak point is the handoff between agents. Astra was told never to disable the monitor “even temporarily,” then passed that rule to a subagent as applying “as appropriate” (CSA). Every handoff is a chance for a safety rule to get reworded into nothing.
Attach constraints to the task as machine-checked policy that travels with it. A sentence in a prompt can be rewritten by the next agent in the chain.
Give a subagent a strict subset of the parent’s permissions. A child agent should never hold more access than the agent that created it.
Give each agent its own identity instead of a shared service account, so your logs show which agent did what.
Watch the workloads agents launch, using admission checks that reject any job with no monitoring attached.
In plain terms: when a guest hands a keycard to a friend, the friend’s card should open fewer doors, never more. And the front desk decides which doors, not the guest.
What has to change in custom agents you build in-house?
Your tool layer is the attack surface. An agent with a tool can carry an attack straight to the system behind that tool.
- Check every tool input in middleware before it reaches the backend. Reject inputs like php:// and file:// addresses that a tool should never receive.
Â
- Split read tools from write tools, and require human approval for actions you cannot undo, like payments, deletions and deployments.
Â
- Keep each tool narrow and specific. A tool called run_sql is a master key, while get_order_status(order_id) is a key to one room.
Â
- Strip secrets out of request and response logs before you store them.
What has to change in agents embedded in your software?
Every customer message, uploaded file and web page your embedded agent reads is untrusted input. Hidden instructions in that input can hijack the agent, which hands your agent’s permissions to the attacker.
- Run agent tools under the end user’s own identity and rights, never a superuser account.
Â
- Avoid blanket “always allow” grants. Meta’s Muse agent shared a seller’s home address with a stranger after he granted it always-allow permissions (Fortune).
Â
- Rate-limit and log agent actions per user session, so one hijacked chat cannot act at scale.
Â
- If your app runs on PHP, patch first. An embedded agent’s model keys live in the same worker memory PHP2Shell could read.
Closing notes
PHP2Shell came from a cleanup routine that a crash could skip. October’s agent failures came from controls an agent could edit, reinterpret or route around. In both, the building trusted the guest to clean up after themselves.
The fix is the same everywhere. Move the housekeeping, the keys and the cameras to the front desk, where the guest cannot reach them. That is what AI maturity looks like in 2026. The architecture assumes the agent will get things wrong, and it stays safe when the agent does.
Too many teams still run it the other way. They put the agent in first and the guardrails in later, then act surprised when it unplugs the cameras.
FREE EBOOK
The enterprise playbook to getting AI pilots right
Here's your free copy
If your download doesn't start automatically, please click here.
A copy of the ebook has also been dispatched to your inbox.
FROM THE BLOG: PHP2SHELL EXPLAINED
The enterprise playbook to getting AI pilots right
Be it AI projects, bespoke solutions, or staffing, we’ve got you covered.
McKinsey’s most recent survey on the state of AI found that 6% of organizations qualify as true AI high performers.
These businesses are
- Thrice as likely to have fundamentally redesigned their workflows around AI
- Thrice as likely to have senior leadership directly committed to the effort, past the pilot
- Thrice as likely to be scaling AI agents across the business, rather than in silos across functions and business teams
FREE EBOOK
The enterprise playbook to getting AI pilots right
Here's your free copy
If your download doesn't start automatically, please click here.
A copy of the ebook has also been dispatched to your inbox.
Are you looking for AI solutions for your organization?
Be it AI projects, bespoke solutions, or staffing, we’ve got you covered.
