PHP2Shell: Gemini 4 Argon and GPT-5.6 Sol Uncovered the Massive Security Flaw

Two critical flaws in PHP forced a string of websites offline in Austria and elsewhere on Wednesday. The bugs, nicknamed PHP2Shell, can let an attacker run code on a web server without logging in. That’s the sort of problem that turns a routine update into a panic button.

The reach is enormous because PHP still powers about 70 percent of websites worldwide, according to Wiz. The two CVEs, 2026-109618 and 2026-109619, sit deep in PHP’s memory management. If a request hits the memory limit or trips a fatal error at just the wrong time, internal state can be left broken. A later request can then abuse that state and, in the worst case, execute arbitrary code. CERT.at says every PHP installation that handles web requests is affected.

The fixes landed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older versions do not have official patches. The PHP Foundation rates the issue 9.2 out of 10 and says the 10-point score that circulated online was wrong. Wiz says the bugs had been sitting in the code for more than a decade and affect practically every version back to PHP 5.4.

Austria saw the fallout quickly. According to oe24 and MeinBezirk, affected sites included the University of Vienna, Vienna University of Economics and Business, TU Wien, BOKU, the Medical University of Vienna, Johannes Kepler University Linz, voestalpine, Novomatic, the Burgenland state portal, the Chamber of Labor, the Austrian Economic Chamber, ÖAMTC and APA-OTS. Several of those came back later in the evening after updates were applied.

Anexia, the Carinthia-based hoster, took the hard line. It took all managed PHP services offline at 3:45 p.m. local time, a quarter of an hour before the patch was released, saying the known workarounds were not enough and that a working exploit would likely appear right away. After the 4 p.m. release, it rolled out the new versions and brought systems back in stages. About two-thirds were running again by early evening, and the Anexia Engine customer portal was fully available.

The discovery story is messy in the way good security stories often are. Wiz says its Atlas tool, which uses Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol among others, found the first flaw in August. A few days later it used the same setup to take over Drupal and WordPress sites without logging in, mainly by speeding up the boring part of adapting exploits across PHP versions and configurations. Separately, Calif and OpenAI reported the same root cause to the PHP team, and a PHP Foundation developer had noticed an early sign of the problem in 2024 during an external audit.

The foundation is not pretending this went smoothly. It says the long delay after the 2024 warning was a structural failure, tied to decision-making and too few experienced engineers who know the whole codebase. The release itself was also chaotic: the CVEs and a wrong severity score leaked the day before, Calif accidentally posted a proof-of-concept video, and Chainguard shipped patched container images before the embargo lifted. The message from PHP now is plain enough: update immediately, or keep PHP offline until you can.