PHP Got Hacked by AI

Security firm Calif, working with OpenAI's GPT-5.6 Sol model through OpenAI's Patch the Planet program, discovered two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, both rated 9.2) that allow unauthenticated remote code execution via out-of-memory corruption and stale state carried between requests. PHP released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026 after the disclosure was moved up when an anonymous Hacker News post leaked the bugs, and Cloudflare observed the first attacks more than six hours before any patch existed. The NSA, FBI, CISA, UK NCSC and CERT-EU issued alerts, and Dutch government sites including DigiD went offline.

Originally published on Medium https://medium.com/ai-tools-digest/php-got-hacked-by-ai-f307388bec7a . At 9:55 p.m. on Wednesday, October 21, 2026, in Tokyo, Japan, the prime minister Sanae Takaichi urged website owners to check whether they ran PHP and apply a security fix as soon as it became available. If they couldn’t patch, she advised temporarily disabling parts of their sites. About an hour later, PHP released fixes for two critical vulnerabilities. The US National Security Agency issued an even drastic warning: if you couldn’t patch, take your systems OFFLINE. To see why, you need to understand the whole incident, and it starts long before AI. In 2004, security researcher Stefan Esser found the first remote flaw in how PHP handles its memory limit. In 2020, someone filed PHP bug 78876, noting that long form variables could make PHP run out of memory. It was treated as harmless. In 2024, an audit by OSTIF and Quarkslab rediscovered the same out-of-memory problem. No one could prove it was exploitable, so it stayed unfixed Calif . PHP stops a request when it runs out of memory. If that happens halfway through building an internal data structure, PHP skips its cleanup. The memory is freed, but pointers to it survive. The next request handled by the same worker then trusts that freed memory, which an attacker has filled with their own data. Calif showed that one crafted upload, under PHP’s default 8 MiB upload limit, can exhaust its default 128 MiB memory limit. No login is needed, and no bug in the website’s own code. PHP filed the flaws as two CVEs: CVE-2026–109618 out-of-memory corruption and CVE-2026–109619 stale state that survives into the next request . Both are rated 9.2 out of 10 php.net . On 30 July 2026, OpenAI invited the security firm Calif into Patch the Planet, its program to help open-source maintainers. Calif’s Ryan Austin picked PHP. On 1 August, working with OpenAI’s GPT-5.6 Sol, he had a working remote code execution against WordPress. Calif reported the first bug to PHP on 11 August and sent a working exploit on 14 August. On 19 August, Wiz Research independently found the same family of bugs using Gemini 4 Argon, GPT-5.6 Sol and its own Wiz Atlas tool, and reported its variants on 24 August Wiz . For about 11 weeks, PHP’s maintainers built the fix while OpenAI coordinated a coalition. Linux distributions received patches early. Cloudflare, AWS, Google, Microsoft, Fastly, Akamai and others prepared firewall rules. OpenAI briefed the White House’s Super Intelligence Force, the Office of the National Cyber Director and CISA OpenAI . The plan was to disclose on 22 October. On 20 October, an anonymous Hacker News post claimed the bugs were real. It was deleted, but screenshots spread to X and Mastodon, along with images and a short video of Calif’s private exploit tool, named PHP2Shell Alexandre Daubois . PHP brought the release forward to 21 October at 14:00 UTC. watchTowr also confirmed the flaws were genuine. Cloudflare saw the first attacks at 07:43 UTC, more than six hours before any patch existed Sansec . PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 shipped on schedule. The NSA, the FBI, CISA, the UK’s National Cyber Security Centre and CERT-EU all issued alerts. In the Netherlands, DigiD, MijnOverheid, the House of Representatives’ site and the Dutch National Cyber Security Centre’s own site went offline Patchstack, citing NOS . Cloudflare’s shares rose about 5% that day Investing.com . Calif’s account is the clearest. Austin started from a theory, that ‘siblings’ of Esser’s 2004 bug still lurked in the code. He asked his model to look for ways to trigger a controllable out-of-memory error, then for code that could be interrupted mid-task. The model spotted that PHP counts a new table entry as live before it finishes building it. Austin then had it turn that one finding into a reusable search pattern, which led straight to more variants Calif . Calif says it used no special harness and no models unavailable to the public. Its lesson is that knowing your target still matters. The expert supplied the direction. The model supplied the speed. Wiz tells the same story from the exploitation side. Building working attacks meant chaining several bugs and adapting to each target’s memory layout. With frontier models it adapted exploits across applications in hours, and a single researcher did in a week what Wiz says would once have taken a world-class team months Wiz . If finding was the whole problem, PHP2Shell would have been fixed in 2020 or 2024. It wasn’t, and the PHP Foundation has said why. After the release, the Foundation explained that a possible exploit had been theorized as early as 2024. No concrete attack path was found, and other issues with clearer impact took priority. The experts who could fix it had many other responsibilities, so work on a fix stalled and restarted repeatedly over months ABC News . OpenAI says these bugs are among several significant ones it has already found, and it expects such findings to “increase sharply” in the coming months. That last step belongs to the people who operate websites, and PHP2Shell showed how unevenly it happens. After disclosure, Cloudflare says exploit attempts jumped from thousands to millions Yahoo Finance . On 20 October, the security company Mallory counted about 884,000 internet-facing hosts reporting PHP 8.1 or older The Hacker News . PHP no longer releases fixes for those versions. That is why the NSA’s advice included taking unpatchable systems offline, and why Japan’s Prime Minister suggested switching site features off NSA . The Dutch government sites that went dark show that even well-resourced organizations reached for it. A Prime Minister asking a country to patch a programming language overnight sounds like a one-off but it probably isn’t. OpenAI expects findings like this to keep coming, and attackers already run AI campaigns for a few thousand dollars.