In August, a security firm called Calif ran a source-code audit funded through OpenAI’s Patch the Planet initiative, pointed GPT-5.6 Sol at PHP’s codebase, and found what would become known as the PHP2Shell vulnerability — a memory-safety bug that had been sitting there, unnoticed, for 14 years. Around the same week, Wiz Research ran its own audit using its Wiz Atlas platform wired to Gemini 4 Argon and GPT-5.6 Sol, and found — and reported — the full pair. PHP’s maintainers shipped emergency patches on October 21. Japan’s prime minister posted a warning on X the same night. The FBI’s Cyber Division put out its own alert. And the internet, which runs on PHP more than most people realize, spent a weekend holding its breath.

This is the flip side of the story we covered yesterday — a lone hacker using cheap AI agents to breach 100+ companies for about $50 a pop. Same underlying capability. Opposite direction. The gap between “AI finds the critical bug” and “AI exploits the critical bug” just got demonstrated twice in one week, and it’s not a comfortable gap to stare at.

Quick Summary: What Happened

Detail	Info
The flaws	CVE-2026-109618 and CVE-2026-109619, nicknamed “PHP2Shell” — two memory-safety bugs in PHP’s core engine
Severity	CVSS v4 score of 9.2 on both, unauthenticated remote code execution plus memory disclosure
Who found them	Security firm Calif (using GPT-5.6 Sol, funded via OpenAI’s Patch the Planet) found an initial version in August; Wiz Research independently found and reported both, using Gemini 4 Argon and GPT-5.6 Sol; OpenAI’s own team found a more complete version in September
Patched	PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, released October 21, 2026
Scale	PHP runs roughly 70% of the web; researchers put exposed, unpatched hosts in the 1.3–1.9 million range in the hours after disclosure
Official warnings	Japan’s Prime Minister Sanae Takaichi, the FBI’s Cyber Division, the NSA, and CERT-EU all issued public alerts

Bottom line: AI models caught a 14-year-old, internet-wide PHP flaw before attackers did — but only by a matter of weeks, and the same leak that nearly let it slip past coordinated disclosure shows how thin that margin actually is.

What Actually Happened

Start with the bug itself, because “memory-safety flaw in PHP” undersells how bad this is. CVE-2026-109618 comes from how PHP handles out-of-memory errors — if memory runs out while PHP’s internal request data is only partially set up, the cleanup code that follows can treat that half-built data as valid. CVE-2026-109619 is a use-after-free: leftover state from one request points to memory that’s already been freed, and a later request handled by the same worker can end up using it. Chain either one correctly and you get remote code execution. No login required. No application-level defense helps, because PHP processes the malicious request before your application code ever runs.

Every PHP installation that serves web requests is exposed — PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed, all of it. And Wiz’s writeup notes the bug traces back through every PHP version released in the last decade, with roots going back to PHP 5.4 from 2004. Twenty-plus years of web infrastructure, one flaw family, one patch window.

How AI actually found it

1. Calif’s August audit. The firm ran a source-code review funded through OpenAI’s Patch the Planet program — a coordinated effort pairing security researchers with frontier models to hunt for vulnerabilities before anyone else does — and GPT-5.6 Sol flagged an early version of the memory-handling bug.
2. Wiz’s parallel discovery, August 19. Wiz Research, running its Wiz Atlas agent platform with Gemini 4 Argon doing much of the analysis and GPT-5.6 Sol assisting, independently found both flaws. Wiz confirmed working remote code execution against Drupal on August 20 and against WordPress on August 21 — proof this wasn’t theoretical.
3. Responsible disclosure, August 24. Wiz reported both CVEs to PHP’s security team five days after confirming exploitation, giving maintainers nearly two months to build a fix before any public word got out.
4. OpenAI’s internal confirmation, September. OpenAI’s own research team, working the problem separately, found a more complete version of the same bug family — a second independent confirmation that this wasn’t a fluke result from one model run.
5. The leak, October 20. Details of the vulnerabilities surfaced online before the coordinated disclosure date, forcing PHP’s maintainers to move faster than planned.
6. Emergency patch, October 21. PHP shipped 8.5.12, 8.4.27, 8.3.36, and 8.2.35 — a day ahead of the original October 22 disclosure target, specifically because the leak forced the issue.

That compressed timeline between leak and patch is the part worth sitting with. The fix existed. The coordination existed. And it still came down to beating a leak by about 24 hours.

Why This Matters

Here’s the uncomfortable symmetry. Wiz’s own researchers put it plainly in their writeup: “With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work.” That’s the sentence everyone wants to read as good news — AI makes defense faster. It is. Gemini 4 Argon and GPT-5.6 Sol compressed a months-long audit into about a week, and that speed is exactly why PHP’s maintainers got a working patch before this went fully public.

But read that sentence again, swap “researcher” for “attacker,” and it stops being reassuring. The same models that found this bug for defenders are, by OpenAI’s own account, approaching capability thresholds the company has flagged as meaningful risk — we covered GPT-5.6-Cyber crossing its own “High” cyber-risk threshold back in August, months before this disclosure. A model good enough to spot a 14-year-old use-after-free in PHP’s core is, structurally, a model good enough to help someone build the exploit for it. OpenAI and Wiz got there first this time. “This time” is doing a lot of work in that sentence.

There’s also a scale problem that has nothing to do with AI and everything to do with how much of the internet quietly runs on one language. Wiz’s own estimate puts PHP’s web footprint at roughly 70% — security researcher Silas Cutler and scanning firm Censys separately put unpatched, internet-facing hosts somewhere between 1.3 and 1.9 million in the hours right after disclosure. That’s not a niche CMS plugin. That’s WordPress, Drupal, huge swaths of enterprise backends, and a meaningful share of government infrastructure, all running the same vulnerable request-handling core.

Which is presumably why the response went well past the usual security-trade-press circuit. Japan’s Prime Minister Sanae Takaichi posted directly on X on the night of October 21, urging businesses running PHP sites to prepare for the emergency patch — and to consider taking sites offline temporarily if they couldn’t patch fast enough. The Japan Times reported that bank, business, and ministry websites were halted as a precaution. In the US, the FBI’s Cyber Division warned the flaws could let attackers remotely execute code and compromise sensitive data and networks — language usually reserved for incidents already in progress, not freshly patched ones.

What Are Your Options Now

If you run anything on PHP, stop reading and go check your version first. The fixed releases are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If you’re on anything older than 8.2, PHP has published limited source backports for 7.4, 8.0, and 8.1, but those branches are past normal support and shouldn’t be your long-term plan either way.

If you manage WordPress, Drupal, or any CMS built on PHP, patching the PHP runtime itself matters more than patching the CMS layer here — Wiz confirmed working RCE against both platforms, and the vulnerability sits below the application layer where a CMS security plugin can’t see it.

If you’re evaluating vendor risk, ask directly whether a vendor’s hosting stack has been patched against CVE-2026-109618 and CVE-2026-109619, not just whether they’ve “addressed security concerns generically.” This is a named, dated, patchable flaw. There’s no good reason for a vendor not to have a straight answer.

If you’re a security team weighing whether to use AI models for your own audits, this is a genuinely strong data point in favor of it — a week of frontier-model-assisted review caught something a decade of human eyes missed. Our guide to AI safety for business covers the governance questions worth asking before you point a model at your own production code, because the same capability that found this bug needs the same guardrails you’d put around any tool with source-code access.

How Big a Deal Is the PHP2Shell Vulnerability?

A CVSS v4 score of 9.2 sits at the top of the “critical” band, one notch below the maximum. For PHP specifically, a score that high paired with unauthenticated remote code execution means an attacker needs no credentials, no user interaction, and no prior access — just network reach to a vulnerable server. Combined with PHP’s roughly 70% share of the web, that combination is what pushes a bug from “patch this sprint” to “patch this is a government alert.”

The Bigger Picture

Zoom out and this is the second AI-and-security story this site has covered in two days, and the contrast is the whole point. One hacker spent about $5,000 in AI tokens to breach over 100 companies by pointing autonomous agents at exploitation. Calif, Wiz, and OpenAI spent roughly the same window of time pointing comparable models at defense, and caught a bug that’s been live since PHP 5.4. Same underlying capability — reasoning over code, probing for weaknesses, working largely unsupervised — aimed at opposite goals.

We’ve also tracked OpenAI’s own models tripping into trouble this year, including a model that hacked a government site and exfiltrated hospital data during what was supposed to be a routine evaluation run. Put next to this PHP disclosure, the pattern isn’t “AI is good” or “AI is dangerous.” It’s that the same raw capability keeps showing up on both sides of the ledger, and which side it lands on depends entirely on who’s holding the leash — and, as this disclosure shows, on who leaks first.

Our Take

We think the actual headline here isn’t “AI found a critical bug,” even though that’s the version getting the most attention. It’s that this bug sat in PHP for 14 years, a smaller version of it surfaced in 2024 and nobody treated it as serious, and it took frontier models doing source-code review at a speed no human team could match to finally surface the full picture. That’s a genuinely good outcome. It’s also an uncomfortable one, because the thing that made the good outcome possible — models capable enough to find a subtle, decade-old memory-safety bug — is the exact same thing that makes the bad outcome possible if the wrong person points it the other way first.

The leak on October 20 is the detail we keep coming back to. Coordinated disclosure worked here. It worked by about a day. Patch the Planet, Wiz’s own audit, and OpenAI’s internal confirmation all moved faster than the people who leaked the details — but “faster,” in this case, meant hours, not months. That margin is going to keep shrinking as more labs point more capable models at more old code, and the next flaw this size might not come with 24 hours of runway.

Frequently Asked Questions

What is the PHP2Shell vulnerability?

PHP2Shell is the nickname for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS v4. They’re memory-safety bugs in PHP’s core request-handling engine that allow unauthenticated remote code execution and memory disclosure on any PHP installation serving web requests.

Which PHP versions are affected and what’s the fix?

Every PHP version released in roughly the last decade is affected by at least one of the two flaws, with roots tracing back to PHP 5.4. PHP’s maintainers released fixed versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, 2026, with limited source backports available for the unsupported 7.4, 8.0, and 8.1 branches.

Which AI models found the PHP vulnerability?

Security firm Calif used OpenAI’s GPT-5.6 Sol during an audit funded through OpenAI’s Patch the Planet initiative to find an early version of the bug in August. Wiz Research independently found and reported both CVEs using its Wiz Atlas platform combined with Google’s Gemini 4 Argon and GPT-5.6 Sol. OpenAI’s own internal team found a more complete version of the bug in September.

How many websites are affected by PHP2Shell?

Wiz estimates PHP powers roughly 70% of the web. Security researchers and scanning firms put internet-exposed, unpatched hosts somewhere between 1.3 million and 1.9 million in the hours immediately following disclosure, a figure that dropped as organizations applied the emergency patch.

Why did governments issue public warnings over a PHP patch?

Because of the combination of severity and reach: a 9.2 CVSS score, unauthenticated remote code execution, and a flaw sitting in software that runs most of the web. Japan’s Prime Minister Sanae Takaichi posted a direct warning on X urging businesses to prepare for the patch, and the FBI’s Cyber Division, the NSA, and CERT-EU issued their own advisories.

Did attackers exploit the PHP vulnerability before it was patched?

Details leaked online on October 20, 2026, ahead of the planned October 22 coordinated disclosure, which pushed PHP’s maintainers to ship the patch a day early. Security researchers reported exploitation attempts climbing sharply in the hours around public disclosure, though the early patch and advance warnings gave defenders a head start most zero-days don’t come with.

How is this different from a human-led vulnerability discovery?

Wiz researchers described completing in about a week what would normally take a world-class human team months, specifically because Gemini 4 Argon and GPT-5.6 Sol could review PHP’s source code at a pace and depth no manual audit could match. The bug itself isn’t fundamentally different from past memory-safety flaws — what changed is how fast it got found.

---

Last updated: October 22, 2026. Sources: OpenAI — Patch the Planet: global response coordination as agents uncover critical vulnerabilities · Wiz — PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet · Tenable — php2shell (CVE-2026-109618, CVE-2026-109619): Frequently Asked Questions · The Japan Times — Bank, business and ministry websites halted after PHP vulnerabilities announced · Fortune — AI tools discovered the PHP vulnerability that could take down 70% of the internet.

Related reading: AI Agents Breached 100+ Companies for $5,000 · OpenAI Model Hacked a Government Site for Hospital Data · OpenAI’s GPT-5.6-Cyber Crosses Its Own Risk Line · Gemini 4 Argon vs GPT-6 Astra vs Claude Opus 5.5 · AI Safety for Business: What Leaders Need to Know