PHP2Shell: how AI-found PHP flaws took bank websites offline

What PHP2Shell is

PHP is the programming language behind about 70% of websites, including WordPress, Drupal, Magento, Laravel and Symfony sites, and billing systems such as WHMCS.^{2, 3} PHP2Shell is a pair of flaws in the PHP engine itself, not in any one application built on it.

Both flaws come from how PHP handles a fatal error, mainly running out of memory. When that happens, PHP can leave corrupted state behind, and a later request can reuse it. One flaw (CVE-2026-109618) turns the corrupted memory into code execution; the other (CVE-2026-109619) does the same through stale global state, a use-after-free bug.^{1, 2} PHP's own team rates both 9.2 out of 10 under the CVSS v4.0 scale.¹

The reach is wide. Wiz found that every PHP version of the last decade, back to PHP 5.4 from 2012, carries at least one of the two bugs. Apache servers running PHP as a module (mod_php) are at the highest risk, but PHP-FPM, php-cgi, FrankenPHP and LiteSpeed set-ups are affected too. The memory problem can also leak data from other users' requests, including passwords, tokens, API keys and certificates.²

Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP's team says updating is the only complete fix.¹ Bitsight found that only about a third of PHP servers showing their version run a branch that receives the fix; PHP 7.4, which is out of support, is the most common.⁸

How AI found it

The flaws were not new in origin. A related out-of-memory bug was reported in PHP in 2004, another in 2020, and a 2024 audit of PHP rediscovered the problem, which was left unfixed because no one had proved it could be exploited. The PHP Foundation has called that delay a structural failure in how it decided and resourced fixes.^{1, 3}

What changed in 2026 was the tooling. Calif found its first issue on 1 August using OpenAI's GPT-5.6 Sol under OpenAI's Patch the Planet programme, and reported it to PHP on 11 August.³ Wiz found its first flaw on 19 August using Google's Gemini 4 Argon, GPT-5.6 Sol and its own Wiz Atlas, confirmed unauthenticated code execution on Drupal and WordPress within two days, and says one researcher did in about a week what would have taken a world-class team months.² OpenAI reported the same root cause on 18 September, and its Codex Security team found further routes to exploit it.¹

How much of the work the AI did is disputed. OpenAI presents the find as AI-led. Calif says it used no special harness or restricted model access, and that its researcher steered the model with his knowledge of PHP's bug history.^{3, 9} Both can be true: the models made a known class of bug far cheaper to chase down to a working exploit.

How the disclosure unfolded

What banks and regulators did

Japan. On 22 October MUFG Bank halted some online banking transactions, Mizuho Bank and Daiwa Securities ran emergency maintenance, Shizuoka Bank disabled its online banking app, and Aomori Michinoku, Yamanashi Chuo and San-in Godo banks paused services. The Japanese Bankers Association said the interbank settlement network showed no impact.⁴

Nepal. Nepal Rastra Bank told banks, payment operators and remittance firms to harden their systems and take websites offline where needed. The Nepal Bankers' Association said QR payments and mobile banking worked normally.⁵

New York. The New York State Department of Financial Services sent an industry letter on 22 October telling every regulated firm to find all PHP in use, including at third parties, patch internet-facing systems first, take unpatchable systems offline and watch their logs. It added that a web application firewall is no substitute for patching.⁶

United Kingdom. The National Cyber Security Centre published six actions on 21 October.¹² In the House of Lords, the government said 32 of its services were unavailable and 4 partly unavailable, and council and Metropolitan Police sites were unavailable.^{11, 13} The reports reviewed for this article show no disruption at any specific UK bank.¹¹

Exploitation. Amazon says the flaws are now broadly exploited, and Cloudflare counted millions of attempts. The US cyber agency CISA had seen no exploitation on 21 October, and Germany's BSI, the Dutch cyber agency and Japan's government reported no successful attacks.^{7, 10, 14} As of 23 October no breach had been confirmed.⁷

What it means for agentic transactions

Agentic transactions are payments an AI agent starts and completes for a person or a business. PHP2Shell did not touch the card networks or the interbank systems. It hit the layer agents depend on most. This is our reading of what the week shows.

1. The web front end is the weak point

The core rails held in Japan and Nepal while customer portals, apps and merchant sites went dark.^{4, 5} An agent books, buys and pays through exactly those front ends and their APIs. When a bank portal or a merchant checkout goes offline for patching, it goes offline for every agent using it too. Agent payment flows need fallbacks and a clear way to tell the person when a payment cannot be completed.

2. Secrets held in memory are in scope

The memory disclosure can leak tokens, API keys and credentials from other users' requests.² Many merchant and billing systems that agents pay through run on PHP, Magento and WHMCS among them.³ Any agent credential or payment token held by such a system should be treated as possibly exposed until it is patched and the secrets are rotated. Tokens that are scoped narrowly, such as Stripe's shared payment tokens limited to one merchant and one basket total, are worth far less to an attacker than a stored card or a reusable key.¹⁵

3. Patching is now measured in hours

Amazon's threat team says AI-assisted analysis makes it cheaper to turn a published fix into a working exploit, so the window between disclosure and attack shrinks to hours, not the 7 or 30 days many patch policies allow.¹⁰ Every system in an agent's payment path, including suppliers' systems, now sits on that clock.

4. AI is on both sides

The same month that AI models helped defenders find PHP2Shell, South Korea's financial regulator confirmed breaches at 16 financial firms, which reports link to an AI penetration-testing agent called ARTEX.¹⁶ No source ties those breaches to PHP. In mid-October JPMorgan said it blocks services that rely on customers sharing their passwords and backs access the customer authorises through open banking instead, and on 22 October major US banks were reported to be blocking third-party AI agents from customer accounts.^{17, 18, 19} The direction is the same: agents get narrow, verified access, not the keys to everything.

What to do now

For anyone running PHP, the NCSC's six actions are the checklist:¹²

1. Find every PHP installation, including ones bundled inside other products.
2. Update to a fixed version.
3. Apply temporary mitigations where you cannot update straight away.
4. Take systems offline if they cannot be updated or mitigated.
5. Check for signs of compromise.
6. Track vendors that ship PHP inside their products until they confirm a fix.

For teams building or accepting payments made by AI agents, we would add four steps of our own:

• Map which PHP systems sit in an agent's payment path: checkout, billing, webhooks and order systems.
• After patching, rotate the API keys, tokens and certificates those systems held.
• Prefer single-use or narrowly scoped payment tokens for agents over stored cards and long-lived keys.
• Log every agent action with its mandate, so a disputed or unexpected payment can be traced.

What is still uncertain

• Severity. PHP rates both flaws 9.2 under CVSS v4.0. A score of 10.0 that circulated before the release was wrong, PHP says.¹
• Exploitation. Amazon reports broad exploitation; CISA and several national agencies reported none succeeding in the first days.^{7, 10, 14} Who attacked before disclosure, and how they knew, is unknown.¹⁰
• Exposure. Counts vary by method. Palo Alto Networks' Unit 42 counted more than 22.6 million internet-facing systems that could be vulnerable.¹³
• The leak. The PHP Foundation says a mistaken proof-of-concept video and an early publication of patched images sped up attackers' work; the company that published the images denies there was a leak.¹

This article will be updated as the facts settle.

This site's own domain, agentictransactions.ai, is for sale by open auction. See the live auction.