PHP2Shell flaw patched before attackers could exploit it
The PHP vulnerability could have allowed code execution and data theft on sites including NASA and Wikipedia, GIGAZINE reports.
The PHP vulnerability known as PHP2Shell was patched before it could be widely exploited, online outlet GIGAZINE reported on November 6, 2026.
Security researchers confirmed the flaw could have allowed arbitrary code execution on a host server, the installation of malware and the reading of sensitive data. The affected sites could have included those of NASA, Wikipedia and the White House.
Exploiting the flaw required finding memory locations and the correct bits to overwrite in the right order, a process in which AI was used.
Found in an independent audit
The bug at the root of PHP2Shell was reported to the PHP Foundation in 2024 as a memory shortage error, but was not fixed because its severity was not recognised, according to the background on the case. In early 2026, the OpenAI-backed cybersecurity company Calif carried out an independent audit of PHP, during which the vulnerability was found.
PHP is a programming language developed in 1994. Anthropic previously disclosed a case in which a large language model generated a patch together with a proof of its validity.
Quick answers
What is PHP2Shell?
It is a PHP vulnerability that security researchers confirmed could allow arbitrary code execution on a host server, malware installation and the reading of sensitive data. It was patched before it could be widely exploited.
Which sites could PHP2Shell have affected?
According to GIGAZINE, the affected websites could have included those of NASA, Wikipedia and the White House.