A critical vulnerability in PHP, exploited in an attack chain that also used Fragnesia to gain kernel-level access to 25 servers seemingly linked to the US government, was known to a small team of maintainers for two years before it was made public, according to a post-mortem from the PHP Foundation. The vulnerability was discovered by OpenAI's GPT 5.6-Sol AI agent in October 2026.
PHP powers around 70% of websites globally. The vulnerability, which allows remote code execution with sufficient attacker knowledge, stems from an ancient architectural decision in PHP's error handling using the longjmp() C function.
The PHP Foundation's post-mortem, published after the vulnerability was made public, indicated that a small team of maintainers had known about the issue for two years. The team, which consists of one full-time employee and 14 part-time contractors, admitted to management mistakes and went back and forth several times on the best fix while maintaining compatibility with third-party extensions.
The vulnerability was first discovered by OpenAI's GPT 5.6-Sol AI agent during the week of October 19, 2026. Shortly after public disclosure, an exploit chain called PHP2Shell was observed in the wild, combined with the Fragnesia Linux kernel vulnerability (also known as Dirty Frag) to achieve kernel-level access. Security firm BitSight reported that by October 29, 25 servers seemingly linked to the US government had been compromised in a campaign using this chain.
Patching progress has been slow. Censys, which has a real-time view updated hourly, initially estimated around 45.7 million vulnerable PHP installations out of 119 million total. The number of unpatched services had dropped to about 29 million as of the time of writing, seemingly indicating a patch rate of around 1 million per day, depending on how it is counted. According to Censys, 62% of the PHP servers it was consulting were not reporting their version numbers, leaving actual totals uncertain. Many installations remain on end-of-life versions: 73% of PHP installations online were running versions with no active support at the time of disclosure, with nearly 8% on version 5.x, which came out in 2005.
Palo Alto Networks issued an advisory for products using its PanOS system. Mitigation options include web application firewalls such as Immunify360 and those offered by Cloudflare and Fastly. CrowdStrike's server security suite can also detect malicious activity by the PHP binary. The PHP Foundation has published source code patches for versions 7.4 through 8.1, and backports are available from community sources including Ondrej Surý for Debian and Ubuntu, as well as from CloudLinux and AlmaLinux. Commercial vendors including Ubuntu Pro and Zend have released fixes for versions as old as 5.5.
Analysis
Why This Matters
- The PHP vulnerability affects tens of millions of servers worldwide, with many still unpatched, leaving a vast attack surface for remote code execution.
- The exploit chain demonstrates how AI-discovered vulnerabilities can be quickly weaponized and combined with other flaws, raising concerns about the speed of patching compared to automated discovery.
- The incident highlights chronic underfunding and understaffing in critical open-source infrastructure, with a skeleton crew maintaining software used by 70% of websites.
Background
PHP is a server-side scripting language that powers a majority of websites. Its development is overseen by the PHP Foundation, which has a small staff. Security experts have long warned about technical debt in widely-used open-source projects. In October 2026, OpenAI's GPT 5.6-Sol AI agent discovered a critical memory handling vulnerability in PHP. The vulnerability was publicized on October 19, and within two weeks was being actively exploited.
Key Perspectives
PHP Foundation: Admitted management mistakes, noting that the small team of one full-time employee and 14 part-time contractors had known about the vulnerability for two years but struggled to fix it without breaking third-party extensions.
Security experts: Had warned for decades about mounting technical debt in critical open-source software, arguing that AI-driven vulnerability scanning had made the traditional 90-day disclosure window obsolete.
What to Watch
- The emergence of a one-click "red button" exploit tool for PHP2Shell, which would lower the barrier for mass exploitation.
- Further chained attacks combining the PHP vulnerability with other kernel-level flaws, following the Fragnesia example.
- The patch rate over the coming weeks and whether the estimated 29 million unpatched servers shrink significantly.
Checked
12 claims in this story checked against 1 source: 11 supported.
Show each claim
- SupportedPHP maintainers knew of the critical flaw for two years before it was made public, according to the post-mortem.Latest from Tom's Hardware: “The PHP Foundation's post-mortem indicates that the team had known about the issue for two years”
- SupportedThe vulnerability was discovered by OpenAI's GPT 5.6-Sol AI agent.Latest from Tom's Hardware: “the week of October 19, 2026, when OpenAI's GPT 5.6-Sol discovered critical vulnerabilities in the open-source programming language PHP.”
- SupportedThe vulnerability was exploited in the wild.Latest from Tom's Hardware: “With some clever injection of just the right content in a web request, this mechanism can be exploited to run any code with PHP's permissions, as shown by the ongoing PHP2Shell exploit.”
- Supported73% of PHP installations online were running versions with no active support.Latest from Tom's Hardware: “73% of PHP installations online were running end-of-life versions with no active support”
- SupportedA PHP2Shell attack chain combined the PHP vulnerability with Fragnesia to gain kernel-level access to 25 servers seemingly linked to the US government.Latest from Tom's Hardware: “a campaign that chained the PHP vulnerability together with Fragnesia (aka Dirty Frag ) to eventually get kernel-level access to 25 servers seemingly linked to the U.S. government.”
- Partly supportedPHP2Shell was observed in the wild shortly after public disclosure.Latest from Tom's Hardware: “Right now, the PHP2Shell exploit is doing the rounds”
- SupportedThe AI agent discovered the vulnerability during the week of October 19, 2026.Latest from Tom's Hardware: “the week of October 19, 2026, when OpenAI's GPT 5.6-Sol discovered critical vulnerabilities”
- SupportedPHP hosts around 70% of websites on the internet.Latest from Tom's Hardware: “PHP hosts around 70% of websites on the internet”
- SupportedThe maintenance team had one full-time employee and 14 part-time contractors.Latest from Tom's Hardware: “it's a small outfit with one full-time employee and 14 part-time contractors”
- SupportedCensys initially estimated around 45.7 million vulnerable PHP installations out of 119 million total.Latest from Tom's Hardware: “The initial count estimated the number of vulnerable PHP installs at around 45.7 million, out of 119 million total.”
- SupportedAccording to Censys, 62% of PHP servers it was consulting were not reporting their version numbers.Latest from Tom's Hardware: “According to Censys, 62% of PHP servers it's consulting aren't reporting that datum at all”
- SupportedNearly 8% of PHP installations were running version 5.x, which came out in 2005.Latest from Tom's Hardware: “nearly 8% of PHP installations are of version 5.x, which came out in 2005”
