AI-found PHP2Shell flaws under mass exploitation as PHP ships emergency patches
PHP released versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12 on October 21 to fix two memory flaws collectively called PHP2Shell, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0. The PHP Foundation said security firm Calif used OpenAI's GPT-5.6 Sol on August 11 to confirm the bugs could yield unauthenticated remote code execution, while Wiz independently found the first flaw using Gemini 4 Argon and GPT-5.6 Sol. Hadrian reported mass exploitation attempts, mainly through PHP's session upload-progress mechanism, about two and a half hours before the patches appeared, and Amazon said attackers tried to exploit the flaws four days before public disclosure.
OpenAI said that given the flaws' severity and PHP's ubiquity it considers this one of the most significant security issues in recent years, and that to its knowledge frontier AI models found the vulnerabilities before attackers did.
圖片來源:
Wiz
PHP重大漏洞PHP2Shell已出現大規模攻擊嘗試。資安公司Hadrian周三（10/21）在官方報告中指出，已於實際環境觀察到大量針對PHP2Shell的攻擊嘗試。Palo Alto Networks旗下Unit 42則估計，全球逾2,260萬個對外曝露的實例可能受到影響，至少一個歐洲國家政府網站已預防性下線，但未透露是哪個國家。
PHP2Shell涉及CVE-2026-109618及CVE-2026-109619兩項重大記憶體漏洞，CVSS v4.0嚴重程度均達9.2分。其中，CVE-2026-109618與記憶體不足（OOM）時的錯誤處理有關，可能讓攻擊者在Apache mod_php預設環境下，無須身分驗證即可遠端執行程式碼；CVE-2026-109619則涉及程式釋放記憶體後仍繼續存取的問題，同樣可能導致遠端執行程式碼。
PHP基金會表示，在2024年進行安全稽核時，PHP核心開發人員就已發現CVE-2026-109618背後的記憶體處理問題，並懷疑可能遭到攻擊者利用，只是當時並未找到具體攻擊途徑。直到今年8月11日，資安公司Calif才利用OpenAI的GPT-5.6 Sol模型，證實該漏洞可被用來遠端執行程式碼，並通報PHP團隊。
#PHP#PHP Foundation#Calif#Wiz#OpenAI#GPT-5.6 Sol#Google#Gemini 4 Argon#Cloudflare#Hadrian#Palo Alto Networks Unit 42#National Security Agency