Mitigating Risks of PHP2Shell—and AI-Driven Vulnerability Discovery

The cybersecurity industry was rocked last week by the disclosure of two critical vulnerabilities in PHP, a programming language estimated to power roughly 70% of websites across the internet. Organizations have scrambled to patch those vulnerabilities, collectively referred to as "PHP2Shell," before hackers can exploit them. Some website operators, including multiple European government agencies, have taken their sites offline as a precaution. Government authorities, including the National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and the Federal Bureau of Investigation (FBI), are urging organizations either to patch immediately or disconnect their systems from the internet. CISA confirmed this week that hackers are actively exploiting PHP2Shell.

On their own, the PHP2Shell vulnerabilities pose a significant challenge to organizations running affected versions of PHP. But more than that, PHP2Shell underscores the extent to which frontier AI models have rapidly transformed cybersecurity risks. The vulnerabilities, which had not been fully discovered for 14 years despite widespread use of PHP, were identified by a security firm using an OpenAI model as part of OpenAI's Patch the Planet initiative. Although one aspect of the vulnerabilities had been identified in 2024, it reportedly was never addressed in part because exploitation was deemed too difficult to be likely.

Security professionals have dubbed this month "Black October" in reference to PHP2Shell and a confluence of other critical vulnerabilities and security incidents, several of them involving AI. For example, one malicious actor reportedly used AI agents to break into more than 100 companies' websites, and CrowdStrike documented four threat groups using autonomous AI agents to carry out cyber intrusions. While frontier AI's acceleration of cybersecurity risks has been a major topic of discussion for months, PHP2Shell and these other recent incidents are the first time many organizations are experiencing those risks first-hand.

This blog post describes the PHP2Shell vulnerabilities and potential legal risks for companies that fail to remediate them promptly. The post then identifies strategies for organizations to mitigate those legal risks and to use PHP2Shell as an opportunity to address broader cybersecurity risks introduced by the use of frontier AI models by threat actors. We discussed how AI is accelerating software vulnerability risks, and strategies for responding, in a recent webinar.

Overview of PHP2Shell

The PHP project, a volunteer group that maintains PHP, disclosed PHP2Shell and released patches on October 21, 2026. PHP runs on web servers and generates the pages that visitors see, handling tasks such as processing logins, accepting form submissions, and retrieving information from databases. The two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) are flaws in how PHP manages memory when a request fails partway through, for example, because it runs out of memory. PHP can leave behind stale data that a later request can then reuse. By exploiting flaws in PHP, an attacker can run its own code on a web server without a password or other access credentials, or retrieve data from the server's memory, such as passwords, access tokens, and encryption keys. With control of a server, an attacker could steal data, install malware, or use the server to move deeper into an organization's network. Every version of PHP back to 2012 is affected.

Amazon Threat Intelligence has found that malicious actors attempted to exploit PHP2Shell days before the vulnerabilities were publicly disclosed, and Cloudflare observed millions of exploitation attempts following the public announcement. CISA confirmed earlier this week that malicious actors had successfully exploited PHP2Shell on live victim systems, and added the vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on October 26.

CISA has directed federal civilian agencies to remediate PHP2Shell urgently—by October 29. CISA has advised all affected organizations to patch immediately, prioritizing internet-facing systems. CISA advises organizations that cannot remediate the vulnerabilities quickly (for example, because they are running unsupported versions of PHP or are reliant on third parties to patch) to take affected systems offline until they are patched or updated. CISA also advises organizations to monitor specific types of suspicious activity that may indicate exploitation of PHP2Shell.

Other government authorities have issued similar guidance, including the NSA, the FBI, and authorities in the European Union (EU) and United Kingdom.

Legal Considerations

Failing to promptly address a widely publicized, critical vulnerability can create significant legal exposure, both before and after any breach occurs.

The Federal Trade Commission (FTC) has long taken the position that failing to maintain reasonable security can be an unfair practice under Section 5 of the FTC Act, and it has specifically identified failure to patch known vulnerabilities as a basis for enforcement. The FTC has settled multiple cases over companies' alleged failures to patch software vulnerabilities promptly, most notably involving Equifax. The FTC, along with the Consumer Financial Protection Bureau and 50 state attorneys general, settled with Equifax for $700 million over allegations that the company's failure to patch a critical vulnerability promptly led to a breach exposing the personal data of 147 million consumers.

In January 2022, in response to the Log4j vulnerability, the FTC published a blog post warning that the duty to take reasonable steps to mitigate known software vulnerabilities arises under the FTC Act and the Gramm-Leach-Bliley Act (we previously discussed the FTC blog post). The FTC stated that it intended to pursue companies that failed to patch the Log4j vulnerability or to take other reasonable steps to protect consumers' data from exposure. The FTC also described Log4j as part of a broader set of structural issues with open-source software, which is widely used but often maintained by volunteers who may lack the resources for security maintenance and incident response. The FTC's blog post warning readily applies to PHP (which is widely used open-source software maintained by volunteers), and the FTC could pursue companies that fail to patch PHP2Shell on the same grounds articulated in the post for companies that failed to patch the Log4j vulnerability. State attorneys general could bring similar claims under state unfair trade practices laws. Some cybersecurity laws, including the FTC's Safeguards Rule (applicable to many non-bank financial institutions), the New York Department of Financial Services' (NYDFS) Cybersecurity Regulation, and the EU's NIS2 Directive and Cyber Resilience Act (CRA), expressly require organizations to timely identify and patch software vulnerabilities.

If exploitation of PHP2Shell leads to a data breach, the legal risks are familiar: class actions, government investigations, and notification obligations under federal and state breach notification laws, among other requirements. Public companies experiencing a material cybersecurity incident may be required to disclose the incident publicly using the Securities and Exchange Commission's Form 8-K.

Strategies for Addressing PHP2Shell—And Tackling Broader AI Security Risks

Companies should consider the following steps when working to remediate PHP2Shell:

• Review and implement patching guidance. Security teams should review CISA, NSA, FBI, and other government guidance, the PHP project's advisories, and guidance published by reputable cybersecurity firms. In line with that guidance, organizations should identify every system running PHP, including unsupported versions and PHP built into third-party products and services. Organizations running supported versions of PHP (8.2 through 8.5) should install the patched releases. For unsupported versions 7.4 through 8.1, the PHP project released only source-code fixes, so organizations will need to build and install those fixes, obtain patched packages from a vendor, or upgrade to a supported version. Older versions require an upgrade. Where a system cannot be patched promptly, companies should consider the agencies' recommendation to take the system offline, taking into account business, operational and security risks.
  • The PHP project has published temporary mitigations for organizations that cannot patch immediately, such as turning off a PHP feature that tracks the progress of file uploads. Security firms have also recommended blocking certain types of file-upload requests at the web server. These measures are only partial, may break website features such as file uploads, and should be reversed after patching. The PHP project has emphasized that updating is the only complete fix.
• Document patching efforts. With PHP2Shell already being exploited by malicious actors, organizations are in a race to patch their servers before they are compromised. Even if organizations move quickly, malicious actors may compromise affected servers before they are patched. Organizations should document their patching efforts to show they acted reasonably even if a breach occurred. That documentation should include how the organization identified affected systems, when each system was patched or taken offline, any compensating controls used in the interim, and the justification for any delays. Organizations should also document their investigation of potential compromise going back at least to the first day exploitations are known to have occurred (currently October 17, but this date could be pushed back as more information about PHP2Shell arises).
• Manage vendors and suppliers. Many organizations' PHP exposure sits with vendors: web hosts, SaaS providers, marketing platforms, and other service providers that process company data. Companies should confirm that critical vendors have patched PHP2Shell on all systems that process the company's data.

PHP2Shell is many organizations' first major experience with frontier AI intensifying cybersecurity risks, and it underscores the need for organizations to rethink how they respond to and mitigate risks of software vulnerabilities. Organizations can use their experience with PHP2Shell to facilitate discussions about preparing their cybersecurity programs for AI-driven risks, including by:

• Briefing the board of directors. Directors must oversee mission-critical risks, including cybersecurity. Management should brief the board on the organization's exposure to PHP2Shell, the status of remediation, and whether any compromise has been detected. More broadly, organizations should use PHP2Shell as an opportunity to educate board members on how AI is transforming cyber risks, including by accelerating discovery and exploitation of vulnerabilities. When vulnerabilities that sat undetected for over a decade can be found and exploited in days, increased investments in vulnerability management and incident detection and response capabilities may be necessary.
• Updating risk assessments. In May 2026, NYDFS issued an industry letter warning that frontier AI models heighten cybersecurity risks, including by enabling attackers to generate exploits faster, and advising regulated entities to update their risk assessments to reflect AI-driven risks (we discussed that guidance in a previous blog). In its September 2026 guidance on cybersecurity risk assessments, NYDFS advised that risk assessments should consider whether emerging technologies or changes in threat actor capabilities materially affect a company's risk profile, citing artificial intelligence and advances in quantum computing as examples. Whether or not organizations are regulated by NYDFS, PHP2Shell is a timely opportunity to update risk assessments to account for AI's ability to identify vulnerabilities at scale, and to determine what changes in risk management (such as faster patching timelines, expanded asset inventories, or additional monitoring) are needed as a result.
• Managing vendor and supply chain risk. Organizations should verify that contracts with critical suppliers obligate them to patch vulnerabilities and report security incidents promptly. Companies can be held responsible for breaches caused by their vendors' security failures, and regulators expect companies to perform due diligence on, and exercise continuing oversight of, their vendors' cybersecurity practices.
• Expediting vulnerability management. NYDFS's frontier AI guidance recommends that organizations reassess how they rate the criticality of known vulnerabilities and shorten remediation timelines. CISA's three-day deadline for federal agencies to remediate PHP2Shell is an indicator of how quickly companies may be expected to patch vulnerabilities going forward. Organizations should consider whether their own timelines for patching critical, internet-facing vulnerabilities are fast enough, and whether they need to reprioritize vulnerability remediation and more effectively manage downtime during patching.
• Strengthening detection, response, and resilience. Because attackers may exploit a vulnerability before it can be patched, NYDFS's guidance recommends that organizations ensure they can promptly detect and respond to suspicious activity, evaluate whether their logging and alerting are sufficient, and test backups and incident response plans. PHP2Shell is a good opportunity to confirm that those capabilities would hold up against attacks that move at AI speed.

We discussed many of these strategies in our recent webinar on AI risks and vulnerability management.

PHP2Shell is certainly just the beginning. AI models will continue to discover and exploit widespread vulnerabilities, forcing companies to rethink how they respond to mitigate risks. Organizations must move quickly to remediate PHP2Shell—and should use this opportunity to further broader discussions about managing AI-driven cyber risks.

+++

Mike Borgia is a partner in DWT's Washington, D.C., office and is the leader of the firm's information security practice. For any questions or more information, please contact Mike or another member of our technology + privacy & security team. To stay informed, sign up for our alerts.