PHP2Shell: an OpenAI model helped find the critical PHP flaws that triggered today’s emergency patches

• Who / what: the PHP project released emergency security updates for two critical remote-code-execution flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell.
• AI connection: OpenAI says security firm Calif identified one of the flaws using GPT-5.6 Sol under its Patch the Planet program; Wiz independently discovered and reported both. OpenAI's account is self-reported and not independently verified.
• Severity: both flaws rated critical at CVSS v4 9.2; an unauthenticated attacker can run code on the server. Every PHP release back to 5.4 is affected by at least one bug, per Wiz.
• When: disclosed and patched on Wednesday, October 21, 2026; details leaked October 20, forcing an early release. GitHub advisories published 13:34 UTC.
• Response: Cloudflare's WAF protections went live for all WAF customers at 03:02 UTC; the NSA and CERT-EU issued advisories; OpenAI proposed a five-stage framework for AI-discovered vulnerabilities and committed $1 billion in subsidized Daybreak access for under-resourced defenders.
• Action: update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP warns there are no complete mitigations — updating is the only safe choice.

The PHP project released emergency security updates today for two critical vulnerabilities — CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell — that let an unauthenticated attacker run code on web servers. OpenAI says the security firm Calif identified one of the flaws using its GPT-5.6 Sol model, in what may be the clearest case yet of AI finding a bug with internet-scale impact.

Both flaws are rated critical, with a CVSS v4 score of 9.2, and both sit in PHP itself — which means they sit underneath WordPress, Drupal, Magento and countless home-grown sites. The PHP maintainers gave advance notice on Tuesday that they would release early if details went public. Details went public, and the patches came today.

Two flaws under most of the web

CVE-2026-109618 (“RCE via OOM corruption”): running out of memory can interrupt PHP while request data is half set up, and clean-up then treats the broken data as valid. CVE-2026-109619 (“RCE via stale global state”): state from one request can outlive its memory and be reused by a later request. Both allow remote code execution without logging in.

PHP says every installation serving web requests is at risk — PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed — and rates the risk highest for mod_php, where a demonstrated exploit fires from one unauthenticated request “before any application code runs.” No complete exploit has yet been shown against PHP-FPM. Wiz, which found both bugs independently, warns the flaws can also expose server memory holding “passwords, authentication tokens, API keys and certificates,” and says every PHP release back to 5.4 is hit by at least one of the bugs.

A leak forced the pace

The planned timeline did not survive the week. News of the flaws leaked on October 20 across Hacker News forums, a post on X from security firm watchTowr, and a proof-of-concept video mistakenly released by Calif. PHP shipped early, as it had warned it would.

Cloudflare says the flaws leaked before the planned disclosure date and that it observed attack traffic aimed at its customers, with attackers already mutating payloads to evade its rules. Its firewall protections went live for every customer on its WAF — free plans included — at 03:02 UTC on Wednesday, roughly nine hours before disclosure. The GitHub security advisories were published at 13:34 UTC, and the fixes shipped that afternoon.

The same day brought advisories from the US National Security Agency and from CERT-EU, whose Security Advisory 2026-018 noted that proofs of concept had begun to circulate. The Record reported that several governments and companies, Nintendo among them, took websites offline as a precaution. watchTowr told The Record that attackers were already trying proof-of-concept tools — many of them, in the firm’s phrase, “vibecoded” with AI — against real servers: “Whilst nobody has been successful to date, we don’t expect that will last long,” said Jake Knott, the firm’s head of threat intelligence.

What OpenAI says

OpenAI published its own account in a blog post titled “Patch the Planet: global response coordination as agents uncover critical vulnerabilities,” dated October 21 and tagged Security and Product. Its attribution is precise and narrow: “Calif identified a critical flaw using GPT-5.6 Sol as part of our Patch the Planet initiative, with Wiz also independently discovering and reporting both vulnerabilities.”

The post calls the flaws “one of the most impactful security issues in recent memory” and says OpenAI led “a coalition of maintainers, researchers, and security providers” over the preceding two months. Its central claim is about timing: “To our knowledge, frontier AI found these vulnerabilities before attackers did, opening a Defender’s Window for maintainers and security providers to prepare fixes and protections ahead of disclosure.”

Two caveats travel with that claim. First, OpenAI’s page is self-reported and light on incident specifics: it names no CVE identifiers or PHP version numbers, does not say which of the two flaws Calif found, and gives no date for when Calif made its finding or when the PHP project was notified. Second, OpenAI does not mention the leak or the observed attack traffic at all.

A five-stage plan and $1 billion in subsidized access

The second half of OpenAI’s post is a proposal rather than a report: a five-stage framework for handling AI-discovered vulnerabilities in widely used software. The stages are: validate and fix the upstream vulnerability (including “adversarial testing with frontier models to look for ways around the patch”); give affected organizations time to act; coordinate with government partners; prepare updates across affected products; and publish guidance and support deployment once a patch exists. OpenAI names the White House’s Super Intelligence Force, the Office of the National Cyber Director and CISA among its government partners on the PHP response.

It also committed $1 billion in subsidized Daybreak access through “Daybreak for Frontline Defenders,” aimed at organizations with limited security resources — a commitment that predates the disclosure, announced in a September post — plus Codex for OSS subscriptions for open-source maintainers, direct sponsorship of projects such as the Rust Foundation, and a php2shell-checker version-checking tool shared as a Codex skill. A Patch the Planet website at patchtheplanet.org collects disclosures and upgrade guidance.

Patch the Planet itself launched in June 2026 with Trail of Bits as part of OpenAI’s Daybreak cybersecurity initiative. Its dashboard, as of October 21, shows 68 codebases under review, 1,995 issues found, 679 patches written and 466 accepted upstream — figures the program reports itself, not independently audited. Maintainers keep control of disclosure and remediation.

Patch now

The fix is to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, all out now. Linux distributions received the patches in advance, so most servers can update through their package manager; on shared hosting, check that the host has updated. PHP 8.1 and older get no updates from the PHP project itself, though it has published minimal source patches for 7.4, 8.0 and 8.1 and some vendors offer backports.

PHP lists stopgaps for anyone who cannot update at once, such as turning off session.upload_progress and lowering post_max_size, but warns that “there are no complete mitigations, updating is the only safe choice.”

Lukasz Olejnik, an independent security consultant and visiting senior research fellow at King’s College London, told Wired how little time defenders have: “Everybody should patch immediately, exploitation may happen very fast and at a scale. AI makes exploiting such vulnerabilities of immediate importance. Like, indeed, a minute or so.”

Why it matters

This is the clearest case yet of AI finding a bug big enough to send much of the web scrambling — and of how little time a leak leaves between discovery and attack. OpenAI says the PHP bugs “are among several significant vulnerabilities we’ve already found and are working to fix,” and expects such findings “to increase sharply in the coming months” — while admitting the same capabilities “can also help attackers rapidly develop offensive tools and exploits.” If OpenAI is right that more are coming, site owners will need to patch in hours, not weeks.

(Primary source: OpenAI’s blog post of October 21, 2026, “Patch the Planet: global response coordination as agents uncover critical vulnerabilities”; reporting from PPC Land, MadRobot, Blockchain News and OfficeChai; technical details via the PHP2Shell summary.)