Getting to Know PHP2Shell: A 20-Year-Old Dangerous Flaw That Can Be Hacked Thanks to AI

Anggoro Suryo Jati - detikInet 

Friday, Oct 23, 2026 05:45 WIB

Jakarta - A wave of panic is sweeping cyberspace following the discovery of two critical security flaws labeled PHP2Shell. This flaw forced various popular platforms such as Wikipedia, 4chan, DeviantArt, to games like Pokémon Home and Pokémon Champions to take emergency action. Even the US cybersecurity agency (NSA) and the UK's (NCSC) urged site managers to temporarily shut down their systems if they are unable to perform an update.

So, what exactly is PHP2Shell, how dangerous is its impact on internet users, and how did this ancient bug suddenly threaten millions of websites?

What is PHP2Shell and Why is it So Dangerous? Simply put, PHP is the main programming language that underpins about 69.3% of websites worldwide, including all sites built using the WordPress platform.

PHP2Shell is the nickname for two critical security flaws (CVE-2026-109618 and CVE-2026-109619) found in the PHP language. This flaw allows unauthenticated Remote Code Execution (RCE)--a technical term meaning hackers can infiltrate and execute malicious code remotely.

The main dangers of PHP2Shell include:

• Server Takeover: Hackers can take full control of the website server without requiring a password or administrator account.

• Sensitive Data Theft: Hackers can steal database contents, user passwords, API keys, and cryptographic certificates.

• Malware Spread: Compromised servers can be turned into a means to spread malware or used as a tool to attack other servers.

Security firms Wiz and OpenAI even consider PHP2Shell as one of the most severe cybersecurity incidents in software history.

Lying Dormant for 20 Years: Once Complex, Now Easily Exploited by AI The most surprising thing about PHP2Shell is its age. This flaw has actually been lying dormant silently within the PHP code for approximately 20 years.

Why is it only threatening now? Previously, exploiting this flaw required an attack chain that was extremely complex and beyond the limits of manual human analysis.

However, the game map changed after the research group Calif utilized the AI model GPT-5.6 Sol, as well as the firm Wiz, which also used AI to uncover the flaw.

Unfortunately, AI technology is a double-edged sword. With the help of today's advanced AI models, exploitation chains that were previously almost impossible for humans to do have now become very easy and practical for hackers to execute.

Cloudflare even confirmed that it has detected an initial wave of attacks beginning to utilize this flaw in the wild.

What Should Users and Website Owners Do? For ordinary internet users, this threat does not attack smartphone or PC devices directly. However, hacked sites can endanger visitors through the spread of malware.

For website owners (especially WordPress users and web hosting services such as GoDaddy, Hostinger, or Bluehost):

1. Immediately Update PHP: Check the PHP version in use and update to the latest security patch version that has been released.

2. Abandon Old PHP Versions: If the site is still running PHP 8.1 or older versions, it is highly recommended to upgrade because older versions no longer receive official patches.

3. Non-PHP Platform Users: Users of services like Squarespace or Wix are considered safe because these platforms do not use the PHP language.

Temporarily shutting down the site while the update process is carried out is much safer than leaving the server as an easy target for hacking, as quoted by detikINET from The Verge, Friday (23/10/2026).

Source: https://inet.detik.com/security/d-8719720/mengenal-php2shell-celah-berbahaya-20-tahun-yang-bisa-di-hack-berkat-ai