⏱️ Reading time: 9 min
A NASA server and a Wikipedia server ran, for weeks in October, code that any attacker could hijack with the right exploit. The cause: a memory error in PHP that nobody classified as serious since it was reported in 2024. The PHP2Shell vulnerability turned that minor bug into a door for reading sensitive data and executing code on the server.
📑 En este artículo
The discovery didn’t come from a traditional pentester, but from a researcher at Calif, a firm funded by OpenAI, who used AI to chain the flaw together in two weeks. The patch shipped before a real attacker had the exploit, IEEE Spectrum reported on November 2, 2026.
TL;DR
- The PHP2Shell vulnerability allowed reading data and executing remote code on NASA and Wikipedia sites.
- The underlying bug was a memory error reported to the PHP Foundation since 2024, not considered serious.
- Calif, a security firm funded by OpenAI, turned it into remote code execution in two weeks using AI.
- Researchers reported the flaw and the patch shipped before real attackers could exploit it.
- Matt Suiche, from startup Tolmo, warns that AI is exposing 40 years of technical debt in legacy software.
What Is PHP2Shell
PHP2Shell is the name the security community gave to a chain of flaws in the PHP interpreter that allows arbitrary code execution on the server starting from a simple memory error. The PHP2Shell vulnerability affected sites on WordPress, Drupal, and platforms like those of NASA and Wikipedia.
It isn’t a product or a tool that someone launched to market: it’s the nickname the community gave to a real flaw in PHP, the language created in 1994 that still runs behind WordPress, Drupal, and much of the web, as Wikipedia documents.
What Happened
In late October 2026, several cybersecurity issues surfaced at the same time, but none as big as the PHP2Shell vulnerability. The flaw exposed any site built on WordPress, Drupal, or other software running PHP without the latest patch, including those of NASA, Wikipedia, and the White House, to exploits capable of reading sensitive data and executing malicious code on the server hosting the site.
According to the IEEE Spectrum report, as far as is known, disaster was averted: cybersecurity researchers found the flaw in PHP, reported it to the PHP Foundation, and the organization released a patch before any malicious actor had the exploit in hand.
The discovery came through an unusual path. In early 2026, cybersecurity firm Calif offered to independently audit PHP, sponsored by OpenAI. In less than two weeks, a Calif researcher, assisted by AI tools, found a way to use PHP’s memory bug to execute arbitrary code on the server.
“One of the phenomena we’re seeing now is that all the legacy software people wrote over the last 40 years is getting exposed,” Matt Suiche, head of AI security research at startup Tolmo, told IEEE Spectrum. “Now it’s time to pay off that technical debt.”
sequenceDiagram
participant R as Calif Researcher
participant AI as AI Tool
participant F as PHP Foundation
participant A as Attackers
R->>AI: analyzes the memory bug reported in 2024
AI-->>R: suggests a viable exploit chain
R->>F: reports the PHP flaw
F-->>R: confirms the finding and prepares a patch
F->>A: publishes the patch before it can be exploited
Note over R,F: two weeks between discovery and reportContext and History
PHP was born in 1994 under the name “Personal Home Page,” created by Rasmus Lerdorf to generate simple dynamic pages, as Wikipedia notes. More than three decades later, the language is still the engine behind WordPress, Drupal, and much of the most visited sites on the planet, including those of institutions like NASA and the White House.
The bug that ended up enabling the PHP flaw wasn’t a secret. It was reported to the PHP Foundation back in 2024, but nobody treated it as a priority: the report described an insufficient memory allocation error, the kind of flaw that normally just makes a program crash without leaving any other trace.
“If you look at any given moment, there’s always a ton of bug reports waiting to be fixed that are just crashes. Most people don’t take them very seriously,” explained Suman Jana, associate professor of computer science at Columbia University, to IEEE Spectrum. “It’s that they require very specific reasoning that’s painful to do. And AI, I think, has done a very good job at that.”
That statement sums up the underlying shift. What used to stay buried in a low-priority bug backlog can now be systematically reviewed by an AI model, which can find the path toward remote code execution.
Technical Details
The class of bug behind the PHP2Shell vulnerability is well known in security: an insufficient memory allocation error occurs when a program reserves less space than it ends up needing to store a piece of data. In the vast majority of cases, that translates into a controlled crash: the program shuts down and that’s it, with no way for an attacker to exploit it. That’s why this type of report almost never moves up in priority on a bug backlog.
What made this case different was chaining that memory error with other conditions in the PHP interpreter until the crash, instead of ending the process, corrupted a memory region controlled by the attacker. That corruption opens the door to executing arbitrary instructions on the server: the jump from broken memory to someone else’s code running with the process’s permissions is exactly what the name PHP2Shell describes.
Finding that chain by hand requires manually reviewing hundreds of code paths to see which of them, in combination, allow control over what gets written into the corrupted memory. It’s mechanical, repetitive work, the kind of task where an AI model can try far more combinations than a person in the same amount of time, which is exactly what both Jana and Calif’s own team described.
⚠️ Heads up: a “harmless” memory error isn’t harmless by definition, it’s only harmless as long as nobody invests the time to chain it with another flaw. AI has drastically lowered that time cost.
To confirm whether your PHP installation already has the patch, run php -v on the server: the output shows the exact version, something like PHP 8.3.x (cli). Compare that number against the official changelog the PHP Foundation publishes for this flaw, and if your version predates the one marked as fixed, update before reading any further.
Impact and Analysis of the PHP2Shell Vulnerability
The case leaves a pattern that will likely repeat: AI labs funding audits of software that has been in production for decades, and finding in weeks what generations of developers missed. OpenAI sponsored Calif’s audit of PHP; it’s no coincidence that the same companies building reasoning models are now funding their use to uncover technical debt in the infrastructure that holds up much of the internet.
The risk isn’t just that there’s one more bug. It’s that there are probably thousands of similar reports, logged as simple crashes, sitting dormant in the bug trackers of projects just as old as PHP. Each one of those reports is, in theory, a candidate to become next year’s version of the breach Calif found, just in a different language or framework.
The encouraging part is that this time the process worked as it should: a responsible audit, a private report to the PHP Foundation, and a patch before the remote execution flaw reached a real attacker’s hands. The uncomfortable part is that this outcome depended on a company voluntarily deciding to pay for the search, not on the PHP ecosystem having the resources to do it on its own.
What’s Next
More AI-assisted audits of decades-old open source projects can be expected: Apache, OpenSSL, the Linux kernel, and other components that, like PHP, accumulate unreviewed minor bug reports. If Calif’s pattern repeats, each of these projects could receive, within weeks, the equivalent of years of manual auditing.
For teams maintaining WordPress or Drupal sites, the practical recommendation doesn’t change: keep PHP updated and subscribe to the PHP Foundation’s security advisories. For the rest of the industry, the PHP2Shell case serves as a warning that AI isn’t just useful for writing new code, it’s also getting better and better at finding the errors buried in old code.
Try it yourself: run php -v on your server right now and compare the result against the official changelog from the PHP Foundation before reading anything else.
Frequently Asked Questions
What is the PHP2Shell vulnerability and why does it worry experts?
It’s the name the security community gave to a chain of flaws in the PHP interpreter that allows going from a simple memory error to arbitrary code execution on the server. It worries experts because PHP runs behind a huge portion of the web, including sites belonging to institutions like NASA and the White House.
Which sites were at risk from the PHP flaw?
Any site built on WordPress, Drupal, or other PHP-based software without the corresponding patch, including those of NASA, Wikipedia, and the White House, according to the IEEE Spectrum report.
Who discovered the remote execution flaw in PHP and how?
A researcher at cybersecurity firm Calif, funded by OpenAI, found it in less than two weeks with the help of artificial intelligence tools, starting from a memory bug the PHP Foundation had on record since 2024.
Was the PHP memory bug ever exploited before the patch?
As far as is known, no. The researchers reported the finding privately to the PHP Foundation, which released a patch before any malicious actor had access to the exploit.
What role did AI play in uncovering the breach Calif found in PHP?
It allowed systematic review of code paths that normally nobody prioritizes, because they only produced crashes with no apparent consequence, and finding among them the exact combination that turns a crash into code execution.
References
- IEEE Spectrum: original report on the PHP2Shell vulnerability and AI’s role in its discovery.
- PHP.net: official site of the PHP language and its security advisories.
- Wikipedia: history and origin of the PHP language since 1994.
📱 Like this content? Follow @programacion on Telegram for daily tech content in Spanish: quick summaries, fresh content every day.
Featured image: Foto de Shahadat Rahman en Unsplash
Did it work for you? Got a different error? Say so below: questions get answered and help the next reader.
Leave a comment
0 Comments