AI-Found PHP Flaws Lead to First Reported Break-In as Attacks Continue

Four days after emergency fixes for the PHP2Shell flaws, researchers reported a confirmed intrusion at a European government agency and a suspected North Korea-linked scanning campaign.

By Richthrax · Oct. 25, 2026

Security researchers have reported the first confirmed break-in using PHP2Shell, a pair of flaws in the PHP programming language that sent governments and companies scrambling last week, The Hacker News reported Oct. 25.

Palo Alto Networks' Unit 42 research team said attackers broke into an unnamed government entity in Europe and reached password hashes and multifactor-authentication secrets within two hours, according to The Hacker News. Unit 42 said the attackers' commands were formatted to produce "machine-parseable output for an AI model to read," the outlet reported.

PHP's developers released fixes Oct. 21. Before Oct. 25, security firms had reported millions of attack attempts but no confirmed compromises.

What the flaws are

The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, let an attacker run code on a web server without logging in. Each is rated 9.2 out of 10 for severity, Newsweek reported. Wiz, a Google-owned security firm, estimates PHP runs roughly 70% of websites, according to Newsweek and CNN.

Wiz said nearly every PHP version is affected by at least one of the flaws, going back to PHP 5.4. Its researchers showed attacks against WordPress, Drupal and Joomla, but said the flaws are in PHP itself, so sites do not need those programs to be at risk.

PHP's fixes are in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The PHP project also issued minimal source-code fixes for the retired 7.4, 8.0 and 8.1 branches, but said that is not a return to regular support, according to Socket.

Found with AI

Wiz said its researchers used its own Wiz Atlas tool plus Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol. It said it found the first flaw Aug. 19 and reported it to PHP's security team Aug. 24. Wiz wrote that one researcher did in a week what once would have taken "a world-class team" months.

Ryan Austin, a researcher at the security firm Calif, found the flaws separately during an August audit using GPT-5.6 Sol, the Deseret News reported, citing The Wall Street Journal.

The White House said in an Oct. 21 statement that "advanced SI technology helped identify a cybersecurity vulnerability," MLex reported.

Leak, early release, early attacks

Details leaked online Oct. 20, and PHP moved its release up a day to Oct. 21 at 14:00 UTC, according to watchTowr and Nextgov/FCW.

Amazon said its decoy servers recorded an exploitation attempt Oct. 17, four days before public disclosure, and that it is unclear how the attacker got the information.

Cloudflare counted tens of thousands of attack attempts 45 minutes after disclosure and millions by early Oct. 22, The Hacker News reported Oct. 23. One attacker tried to install a version of Mirai, malware that turns hijacked machines into tools for knocking other sites offline, according to the same report.

Through Oct. 23, the firms Previdian, Wordfence and SOCRadar said they had seen no successful break-ins, The Hacker News reported.

On Oct. 25, The Hacker News also reported that the threat intelligence firm CYFIRMA had tracked a campaign probing 216 unpatched hosts in about a dozen countries. CYFIRMA attributed it with "moderate confidence" to a Korean-speaking operator linked to North Korea's Lazarus Group.

The PHP Foundation has also warned of a third flaw, CVE-2026-115560, which requires an unusual setup to exploit and will be fixed in a regular release, according to The Hacker News.

Governments pulled the plug

The NSA, FBI and CISA told organizations Oct. 21 to update or take systems offline, Defense One reported. The NSA said flaws like these "often provide a direct path to the server's file system or database," according to AFP. CISA said that day it had not observed exploitation, Nextgov/FCW reported.

Government websites in France, Denmark, Finland and the Netherlands were briefly taken offline while fixes were applied, CNN reported. In Britain, 32 government digital services were unavailable and four were partly unavailable, and the National Cyber Security Centre sent about 50,000 warnings, The Hacker News reported, citing Parliament's official record from Oct. 22.

A Nextgov/FCW search of the scanning service Shodan found about 900 results tied to U.S. federal, state and local government websites showing signs of PHP. The outlet said many of those records may be out of date. Newsweek reported Oct. 21 that it found no evidence that U.S. federal sites had been compromised or taken offline.

The patching problem

Fixes help only sites that install them. A scan published Oct. 20 by the firm Mallory found that about 59% of internet-facing PHP hosts that reveal their version run a branch with no official fix coming, the security firm CybelAngel reported.

Bitsight says updating PHP on the server is the only full fix and that firewall rules or app changes do not close the gap, according to The Hacker News.

What it means for you

PHP runs on web servers, not on phones or home computers, so most readers have nothing to install. The risk is to the sites people use, including local governments, schools, medical portals and small businesses.

Website owners should confirm with their hosting company that PHP has been updated and should update WordPress and its plugins.

Disclosure: The Despoiler uses Claude, made by Anthropic, to help produce its trackers. Anthropic competes with OpenAI and Google, whose AI models are named in this story.