The PHP Bug That Broke The Internet

Summary

The video explains PHP2Shell, a pair of critical vulnerabilities in the PHP runtime that can enable remote code execution on vulnerable servers. The issue affects PHP itself—not only applications such as WordPress or Drupal—and, in some configurations, may be exploitable while PHP is processing an HTTP request, before application code runs.

How it works

The bugs involve PHP’s handling of memory exhaustion. By submitting crafted requests involving nested form fields and empty file uploads, an attacker can cause PHP to allocate far more memory internally than the request size suggests.

If PHP runs out of memory at a precise point, an internal hash table can be left in an inconsistent state. Cleanup may then process uninitialized data, leading to memory corruption and potentially code execution with the privileges of the PHP process.

Scope and severity

The researchers demonstrated exploit chains against 11 PHP applications, including WordPress, Drupal, Joomla, Magento, Nextcloud, phpMyAdmin, and Roundcube. The two vulnerabilities are identified as CVE-2026-109618 and CVE-2026-109619, each rated 9.2/10.

Discovery and AI-assisted research

The vulnerabilities were found during research supported by OpenAI’s Patch the Planet initiative. AI agents helped researchers trace PHP code paths related to memory management, building on earlier reports about similar issues.

The video also notes that AI-assisted vulnerability research has increased the number of invalid, duplicate, or unreproducible reports sent to PHP maintainers, adding to their triage workload.

Disclosure problems

After responsible disclosure began, information about the flaws leaked before the planned announcement. Container images containing patches reportedly became available hours before the coordinated release, making it easier to compare patched and vulnerable versions. A proof-of-concept demonstration was also exposed, and Cloudflare and Watchtower reported attack attempts or active exploitation.

The narrator cautions that some exploit scripts circulating online may not work and could be unsafe to run.

Patching guidance

Update the PHP runtime serving the site, not just its CMS or framework. Restart Apache, PHP-FPM, or other long-running PHP workers so they load the patched version.

The listed releases are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. The subtitles render the second version ambiguously as “8.36.”

The video says there are no good non-patch mitigations. Setting PHP’s memory limit to unlimited is mentioned as a possible workaround, but it can expose systems to memory-exhaustion denial-of-service attacks.

Impact

The video reports that some organizations took websites offline while waiting to patch. It cites warnings from Japanese officials and U.S. agencies, as well as precautionary shutdowns of government services in several European countries. The narrator emphasizes that patching quickly mattered because exploit details were becoming available.

Guides or tutorials

The video provides practical patching steps, but it is primarily a vulnerability analysis rather than a step-by-step exploit tutorial.

Main speaker and sources

The main speaker is Mental Outlaw. The video also refers to research by Califf and the Corks Lab team, the PHP Foundation and PHP security team, Cloudflare, Watchtower, and warnings from the NSA, FBI, CISA, and Japanese officials.