The official PHP logo, placed on a plain background by MadRobot. Image: Colin Viebrock / Wikimedia Commons, CC BY-SA 4.0, cropped
Two critical flaws in PHP, the programming language that runs an estimated seven in ten websites, were patched in a rush on Wednesday after details leaked ahead of time, and OpenAI says one of its AI models helped find them. The PHP project released emergency security updates for the bugs, nicknamed PHP2Shell, which can let an attacker run code on a web server without logging in.
OpenAI said in a blog post that the security firm Calif found a critical flaw using GPT‑5.6 Sol, as part of Patch the Planet, the open-source security programme OpenAI launched in June with Trail of Bits. Wiz, the Google-owned cloud security company, independently found and reported both bugs. OpenAI calls them “one of the most impactful security issues in recent memory”.
What PHP2Shell does #
The bugs are in PHP itself, so they sit underneath WordPress, Drupal, Magento and countless home-grown sites. Both are rated critical, with a CVSS v4 score of 9.2:
- CVE-2026-109618 (“RCE via OOM corruption”): running out of memory can interrupt PHP while request data is half set up, and clean-up then treats the broken data as valid.
- CVE-2026-109619 (“RCE via stale global state”): state from one request can outlive its memory and be reused by a later request.
PHP says every installation serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It rates the risk highest for mod_php, where a demonstrated exploit fires from one unauthenticated request “before any application code runs”. No complete exploit has yet been shown against PHP-FPM. Wiz’s research warns the flaws can also expose server memory holding “passwords, authentication tokens, API keys and certificates”. Wiz says every PHP release back to 5.4 is hit by at least one of the bugs.
A leak forced the pace #
PHP gave advance notice on Tuesday and said it would release early if details went public. They did. Cloudflare says the flaws leaked before the planned date and that it saw attack traffic aimed at its customers, with attackers changing their payloads to slip past its rules. Its firewall protections went live for every customer with its WAF, free plans included, at 03:02 UTC on Wednesday, about nine hours before disclosure.
Several governments and companies, Nintendo among them, took websites offline as a precaution, The Record reported. The security firm watchTowr told it that attackers were already trying proof-of-concept tools, many “vibecoded” with AI, against real servers:
Whilst nobody has been successful to date, we don't expect that will last long.
Jake Knott, head of threat intelligence, watchTowr, to The Record
“Everybody should patch immediately” #
The fix is to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, all out now on php.net. Linux distributions got the patches in advance, so most servers can update through their package manager; on shared hosting, check that your host has updated. PHP 8.1 and older get no updates from the PHP project, though it has published minimal source patches for 7.4, 8.0 and 8.1 and some vendors offer backports.
PHP lists stopgaps for anyone who cannot update at once, such as turning off session.upload_progress and lowering post_max_size, but warns that “there are no complete mitigations, updating is the only safe choice.” OpenAI has also shared a PHP version checker.
Lukasz Olejnik, an independent security consultant and visiting senior research fellow at King’s College London, told Wired how little time defenders have:
Everybody should patch immediately, exploitation may happen very fast and at a scale. AI makes exploiting such vulnerabilities of immediate importance. Like, indeed, a minute or so.
Lukasz Olejnik, security consultant, to Wired
OpenAI says more are coming #
OpenAI says the PHP bugs “are among several significant vulnerabilities we’ve already found and are working to fix”, and expects such findings “to increase sharply in the coming months”. It admits the same capabilities “can also help attackers rapidly develop offensive tools and exploits”, a worry Anthropic raised when it found that a downloadable Chinese model can now build working hacks, and one the ARTEX hacking tool is already showing in the wild.
It set out a five-stage plan for handling bugs like this and says it worked with the White House’s Super Intelligence Force, the Office of the National Cyber Director and CISA on the PHP response. It is also putting $1 billion into subsidised access to Daybreak, its cyber-defence programme, for under-resourced defenders. The same day, Anthropic said Claude helped strip unneeded code out of OpenSSH.
Why it matters #
This is the clearest case yet of AI finding a bug big enough to send much of the web scrambling, and of how little time a leak leaves between discovery and attack. If OpenAI is right that more are coming, site owners will need to patch in hours, not weeks.
Sources: PHP security advisory; GitHub advisory, CVE-2026-109618; GitHub advisory, CVE-2026-109619; OpenAI; Cloudflare; Wiz research; Wired (Olejnik quote); The Record (Knott quote).