Hackers, 1995: “Hack the Planet!” Good old times. OpenAI, present day: “Patch the Planet.”…and here we go again, my friends, with another internet-wide security scare, serious enough to get Japan’s prime minister talking about PHP on X.
The not-so-brand-new ( will come to this later, just like the PHP team did ) PHP2Shell is actually two CVEs, rated 9.2 by PHP’s own team. A severity of 10.0 spread during the leak and stuck in a few places, but PHP and watchTowr both put the real figure at 9.2 from the start, affecting versions from PHP 5.4 through 8.5. That’s most of the PHP released since 2012, powering a language used by roughly seventy percent of websites whose server-side technology is known.
Calif, a security research firm, uncovered the flaws in August with help from OpenAI’s GPT-5.6 Sol, under its Patch the Planet program. Wiz independently found related vulnerabilities using its Atlas tooling, Google’s Gemini 4 Argon, and GPT-5.6 Sol.
Now, PHP’s own developers had already identified the underlying out-of-memory problem back in 2024, during work connected to a security audit. They investigated fixes but couldn’t agree on an approach without potentially breaking compatibility or introducing other problems. There was no demonstrated exploit at the time, so the work stalled and, well, let the future “us” deal with it. I really hope someone said “famous last words” in one of those meetings.
The bugs themselves are almost mundane. PHP can corrupt its internal state when a request dies from an out-of-memory error at precisely the wrong moment. In other cases, a request finishes but leaves behind references to memory that has already been freed. A later request can then stumble into that stale state instead of starting clean. Wiz demonstrated four ways to exploit these problems, grouped into two CVEs. The consequences range from reading sensitive information, including passwords and API keys, from server memory to unauthenticated remote code execution on WordPress, Drupal and Joomla. Parts of the vulnerable code have been sitting there for well over a decade!
But back in the day, chaining these bugs into a working exploit for a particular PHP version and memory layout could have taken an expert team months. Wiz says one researcher managed it in about a week, with AI helping adapt and retest the exploit between attempts.
And then someone dropped the ball…or the exploit, I might say.
Information about the vulnerabilities leaked through Hacker News and a watchTowr post on X. Calif accidentally published a proof-of-concept video, and Chainguard released patched images before the agreed disclosure time, giving people a chance to inspect the fixes before everyone else could update. PHP brought the release forward by a day, but the internet had already entered Defcon 1 and up to 11 mode. Government services in the Netherlands, Denmark, Finland and France went offline as a precaution. The NSA advised organizations that couldn’t patch quickly enough to consider doing the same. Wikimedia pulled supporting services offline, 4chan and Something Awful restricted access, and Japanese online games started suspending services. Even Final Fantasy XIV temporarily stopped accepting new logins.
Japan’s Prime Minister Sanae Takaichi posted about the vulnerabilities herself, shortly before the scheduled 11 p.m. Tokyo release, telling website operators to prepare for the patch and that taking their sites offline was a reasonable option if they couldn’t update in time.
A prime minister, personally reminding people to patch PHP. It’s not every Wednesday you see that.
