Security Breach or Opportunity to Improve?

In this post

October 2026 saw talk of several security breaches: the TLS certificates with weak keys from eMudhra (eMudhra), the critical GitLab vulnerability (GitLab), the FortiMail zero-day (FortiMail) and the credential compromise at ConnectWise Cloud Backup (ConnectWise). The one that interests me most, for what it teaches about defensive work, is PHP2Shell: CVE-2026-109618 and CVE-2026-109619, two flaws in the PHP engine that allow unauthenticated remote code execution (PHP advisory).

The story does not begin with an attack. It begins with an audit. And that difference, finding the flaw before anyone exploited it, is the opportunity I want to talk about.

1. What was discovered

The two CVEs are memory bugs in the PHP core. CVE-2026-109618 corrupts state when a request exhausts memory_limit. CVE-2026-109619 leaves global state pointing to memory that has already been freed. Both have a CVSS 4.0 score of 9.2 and affect unpatched versions going back to PHP 5.4. The complete fix is PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 (PHP advisory).

The impact is RCE with the worker's privileges, memory disclosure and denial of service. But what makes PHP2Shell special is not just the CVSS score: the flaw is in the engine, not in WordPress, Drupal, Joomla or a plugin. Updating the CMS was not enough (Wiz).

2. How it was discovered

2.1 A twenty-year-old lead

The story goes back to 2004, when Stefan Esser documented the first PHP vulnerability based on the memory limit. In 2020, bug #78876 reported that certain long variables could cause an OOM and leave temporary files uncleaned. In 2024, the audit by OSTIF and Quarkslab rediscovered the problem: an exploit was theorized, but no concrete vector was found and the matter was left pending (Calif, PHP Foundation).

2.2 The 2026 audit

In 2026, OpenAI invited Calif to its Patch the Planet initiative, and PHP was chosen as a high-impact target. Calif began the audit on July 30. By August 1 it had already found the first fatal OOM error and the first of the interruption points that, chained together, allowed RCE. On August 11 it reported the first flaw to PHP. On the 14th it shared an RCE PoC, and on the 15th PHP confirmed it worked (Calif, PHP Foundation).

The research was not an isolated stroke of luck. Calif used language models to review the code, generalize the pattern and search for variants. Wiz got there independently with Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, and confirmed RCE against Drupal on August 20 and against WordPress on the 21st. On the 24th it reported both flaws to PHP. OpenAI also reported the same root cause and sent additional vectors in September (Wiz, PHP Foundation, OpenAI).

2.3 It was not an attack

This is worth stating precisely: the breach was not discovered because a criminal group was exploiting it. It was discovered before that. As far as the public record shows, it was AI-assisted research teams who found the flaws and reported them in a coordinated way. That is the difference between a breach discovered through an incident and one discovered through an audit: the first arrives too late. The second opens a window.

When Calif, Wiz and OpenAI converged on the same root cause, PHP stopped treating it as just another report. The security team and the PHP Foundation made the fix a priority and worked on several branches at once (PHP Foundation).

3. The opportunity: the defender's window

OpenAI calls this a Defender's Window: a period in which defenders know about the flaw before attackers turn it into a working exploit (OpenAI, Defender's Window). With PHP2Shell, that window was about two and a half months: from the initial report on August 11 to the release of the patches on October 21. It was not a gift. It was the result of finding the flaw first.

During that window, PHP prepared patches for four branches and backports for 7.4, 8.0 and 8.1. Distributions, extended-support vendors, clouds, CDNs and WAFs received the patch before disclosure so they could prepare packages and rules. CISA coordinated with critical infrastructure. That is what buys time: not just a patch, but an ecosystem ready to ship it the same day.

3.1 The window narrowed

The coordination did not go perfectly. On October 20, a day before the planned date, the CVE identifiers began circulating on forums and social media with the wrong publication time and a fake CVSS score of 10.0. PHP moved up the advance notice and the release from the 22nd to the 21st. Calif mistakenly published a video showing a PoC. Although it was deleted, copies circulated. On October 21, at 07:41 UTC, Chainguard published patched images before the coordinated announcement, and within minutes attack attempts were being reported (PHP Foundation, Sansec).

The first documented attempt, however, came earlier: Amazon Threat Intelligence detected it on October 17, four days before disclosure, from an IP associated with a commercial anonymization network (AWS). No specific group has been publicly attributed, but the message is clear: someone was already looking for the flaw before a patch existed. That does not make the window useless. It makes it finite.

4. When the window closed

On October 24, Adel Karimi of Perplexity recorded evidence in honeypots of RCE confirmed through PHP2Shell. The attackers used memory exhaustion and disclosure, and then tried to contact external servers with PHP, curl and wget. No additional malware was downloaded (BleepingComputer). On October 26, CISA added both CVEs to its catalog of exploited vulnerabilities and set October 29 as the deadline for US federal agencies (CISA, Rapid7).

By then there was already a high volume of attempts, although many were probes or PoCs that did not work against every target. Exploitation still depends on the version, the SAPI, the configuration and the memory layout. But the important part is no longer the probability: it is that the flaw stopped being theoretical.

References

The sources were consulted on October 28, 2026. Links open in a new tab.

1. eMudhra (2026). eMudhra Statement on Recent Certificate Security Incident. eMudhra. View online.
2. GitLab (2026). GitLab Critical Patch Release: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13. GitLab Docs. View online.
3. Abrams, L. (2026). Fortinet warns of critical FortiMail flaw exploited in zero-day attacks. BleepingComputer. View online.
4. ConnectWise (2026). Cloud Backup (formerly SkyKick) Service Interruption. ConnectWise Trust Center. View online.
5. PHP (2026). Security advisory: Critical remote code execution vulnerabilities, update now. PHP.net News Archive. View online.
6. The PHP Foundation (2026). Today's PHP security release and how we're strengthening PHP security. The PHP Foundation Blog. View online.
7. OpenAI (2026). Patch the Planet: global response coordination for critical PHP vulnerabilities. OpenAI. View online.
8. OpenAI (2026). The Defender's Window. OpenAI. View online.
9. Austin, R. (Calif) (2026). PHP2Shell: A tale of two PHP remote vulnerabilities. Calif Research. View online.
10. Tzadik, S., Tamari, S., Ohfeld, N., and Schwartz, T. (Wiz Research) (2026). PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet. Wiz Blog. View online.
11. AWS (2026). Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot. AWS Security Blog. View online.
12. Sansec Forensics Team (2026). PHP2Shell: PHP RCE (CVE-2026-109618, CVE-2026-109619). Sansec Research. View online.
13. Toulas, B. (2026). PHP2Shell security flaws now successfully exploited in the wild. BleepingComputer. View online.
14. CISA (2026). Known Exploited Vulnerabilities Catalog. Cybersecurity and Infrastructure Security Agency. View online.
15. Rapid7 (2026). CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP. Rapid7 Blog. View online.

Further reading

• Patch the Planet: OpenAI's initiative to find and close critical vulnerabilities before they are exploited.
• OpenAI's PHP version checker: checks whether an installation is exposed.
• CISA's Known Exploited Vulnerabilities Catalog: the reference for prioritizing patches.

Scripture quotations are from the ESV® Bible (The Holy Bible, English Standard Version®), copyright © 2001 by Crossway, a publishing ministry of Good News Publishers. Used by permission. All rights reserved.