On Wednesday, PHP’s security team did something it almost never does. It shipped emergency patches for two critical flaws (CVE-2026-109618 and CVE-2026-109619, collectively nicknamed PHP2Shell) that let an attacker run code on a web server without logging in first. The bugs are rated 9.2 out of 10 on the CVSS v4 severity scale, sit in the PHP language itself rather than any application, and one of them was found with the help of OpenAI’s models.

This one is worth taking personally. PHP still powers as much as 70 percent of websites whose server-side language is known: WordPress, Drupal, Magento, and countless custom sites. A flaw in the runtime, not the code running on it, means a site can be exposed even when everything its own developers wrote is secure. “We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs,” the PHP security team said.

What the two PHP2Shell flaws actually do

Both PHP2Shell flaws trace back to the same underlying problem: PHP can leave its memory in a corrupted state when a request ends abnormally, and attackers can abuse that corruption to take control.

CVE-2026-109618 chains a set of weaknesses around out-of-memory corruption to gain remote code execution as the web worker account. CVE-2026-109619 abuses stale global state — leftovers from one request surviving in memory and getting reused by a later request — enabling memory disclosure and remote code execution. The PHP security team says every installation that serves web requests is at risk: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. Wiz’s researchers warn the flaws can also expose server memory holding “passwords, authentication tokens, API keys and certificates.”

Fixes are out now in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Older versions are a dead end: PHP 8.1 and earlier no longer get updates from the PHP project, so anyone running them needs an LTS vendor with a backported fix or an upgrade. According to Wiz, the flaws affect every PHP release back to version 5.4.

AI found the bug — and OpenAI is saying it loudly

Here’s the part OpenAI really wants you to hear. Calif, a digital infrastructure security firm, found a version of the flaws in July and August using GPT-5.6 Sol, one of OpenAI’s most advanced models, as part of Patch the Planet, the open-source security program OpenAI launched in June with Trail of Bits. OpenAI’s own team then found a fuller version of the bugs in September. Separately, Wiz — Google’s cloud and AI security startup — independently found both flaws and reported them too.

OpenAI president Greg Brockman framed it as a landmark: “Over the past two months, we have been leading a coalition to mitigate one of the most severe bugs in open source software found in recent memory, php2shell. It was discovered and addressed using our models as part of our Patch the Planet initiative.” He added that the bug had sat in PHP for 14 years — a limited version surfaced in a 2024 audit, “but wasn’t considered significant at the time.”

This time, the defenders had a head start.

A leak on Hacker News forced the rush

The patch had been finished for weeks. The coalition (Calif, OpenAI, Google’s Wiz, and the PHP team) had planned an orderly disclosure for Thursday, October 22. Then Hacker News leaked the CVE details on Tuesday the 20th, and the whole timeline collapsed.

“You don’t want to release the patch to the public too early,” Calif security researcher Bruce Dang told USA Today. “Because as soon as it goes out, other people, other security researchers and other hackers are going to be able to reverse engineer that patch.”

So PHP’s maintainers pushed the release forward to Wednesday, October 21. “This patch is huge,” Dang added. “Typically, most security patches are relatively small and surgical. This one is very large, and so the chances of a mistake or an incomplete fix is much higher than usual, so all of the parties involved wanted to make sure that the patch was solid before we released it.”

Attacks are already happening

The worst-case timing fear came true fast. Cloudflare says it has already observed exploit attempts, including spikes of thousands of probes, and attackers are actively adapting their tactics to try to bypass protections. The NSA’s Cybersecurity Collaboration Center went further: it advised websites that couldn’t immediately apply the fix to go offline. CISA told every organization running PHP-based sites to patch immediately. “These are critical vulnerabilities and anyone using PHP should upgrade as soon as possible,” PHP Foundation executive director Elizabeth Barron told USA Today.

Security firm watchTowr said it has already reproduced one of the two flaws, which means working exploit details are circulating. Calif researcher Ryan Austin, who first spotted the bugs, struck a cautiously optimistic note: “I’m pretty confident that all the major things are probably going to be taken care of.” The honest version of his confidence: the biggest sites will patch within days. The long tail of forgotten WordPress servers and legacy apps (the ones running PHP 7 and 8.0 in closets) won’t, and those are the servers attackers scan for first.

Why this matters

PHP2Shell is a preview of the new security normal. AI models can now find the bugs that attackers would otherwise find first, which is exactly what happened here — GPT-5.6 Sol dug up a 14-year-old memory corruption flaw that humans had looked at and dismissed. Defenders got a two-month head start, and it still wasn’t enough to keep the disclosure clean; the leak compressed a careful plan into an emergency scramble, and exploits were in the wild within hours of the patch.

That compression is the real story. The window between disclosure and exploitation has nearly closed, and the only reason this wasn’t catastrophic is that three independent teams found the same bugs and the fix was ready before anyone had to improvise. The next critical flaw might be found by one person with a model and a scanner, leaked on a forum, and weaponized before the patch exists. Patch the Planet just proved AI can play defense at this speed. Whether defense stays ahead is now a race measured in hours, not months.

Frequently asked questions

What is PHP2Shell? Two critical remote-code-execution flaws (CVE-2026-109618 and CVE-2026-109619) in the PHP programming language itself. They let an unauthenticated attacker run code on a web server, and carry a 9.2/10 CVSS v4 rating.

How was it discovered? Security firm Calif found the flaws using OpenAI’s GPT-5.6 Sol through the Patch the Planet program. Google-owned Wiz found both flaws independently, and OpenAI’s own team later found a fuller version.

Am I affected? Probably, if you run a website. Every web-serving PHP install back to version 5.4 is affected. Update immediately to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Risk is highest on Apache mod_php.

Are attackers already using it? Yes. Cloudflare reports exploit attempts and thousands of probes already, and security firm watchTowr has reproduced one of the flaws. The NSA advised sites that can’t patch immediately to go offline.

Sources: USA Today, BleepingComputer, The Hacker News, Decrypt, SC Media.