PHP Patches 'PHP2Shell', Two Critical Remote-Code-Execution Flaws That Researchers Say Frontier AI Helped Find and Exploit

By the researchers' own account, frontier AI turned flaws that had sat in PHP for more than a decade into working attacks, and a leak then shortened the time defenders had to prepare. On Wednesday, October 21, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing CVE-2026-109618 and CVE-2026-109619, two flaws collectively called PHP2Shell. heise online reports that both are rated CVSS 9.2 (critical). The planned disclosure date was moved up a day, from October 22, because of a leak, heise reports, and Cloudflare says it observed attack traffic against its customers.

What the flaws are

Wiz, Cloudflare and BleepingComputer describe memory-safety bugs in how PHP cleans up when a request ends abnormally, for example after an out-of-memory or other fatal error. A later request handled by the same worker can then use corrupted or freed memory. Wiz says it demonstrated unauthenticated remote code execution on WordPress, Drupal and Joomla, and separately showed that attackers could read process memory containing passwords, tokens and API keys. Wiz says every PHP version back to 5.4 is affected by at least one of the bugs; Cloudflare says the flaws affect web servers running PHP 5.4 or later.

BleepingComputer says PHP's security team provided minimal source backports for PHP 7.4, 8.0 and 8.1, and quotes PHP core developer Gina Peter Banyard as warning that no mitigation fully blocks the attacks and that applying the patches is the only permanent defence. PHP has published interim configuration changes that reduce some attack paths, both BleepingComputer and heise report.

How much of the web is exposed depends on whose estimate is used. Wiz says PHP powers 70% of websites, Cloudflare says "almost 70%", and BleepingComputer puts PHP's share at 75% to 80%. Wiz calls the findings among "the most severe vulnerabilities discovered in PHP, and arguably in software history"; OpenAI calls them "one of the most impactful security issues in recent memory."

Who found it, by each account

The accounts overlap but do not agree on order or emphasis:

• OpenAI says Calif "identified a critical flaw using GPT‑5.6 Sol" as part of its Patch the Planet initiative, "with Wiz also independently discovering and reporting both vulnerabilities."
• Wiz's timeline says it discovered the first vulnerability on August 19 using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, and reported the bugs to PHP on August 24. It says Gemini 4 Argon "made an invaluable contribution" to finding the vulnerability, building exploits, detecting attacks and validating the patch.
• heise, in an English article it says was translated from German, writes that Calif's team was first, in a code audit with the PHP Ecosystem Security Team sponsored by OpenAI's Patch the Planet, and that Wiz, which heise describes as a Google subsidiary, and OpenAI reproduced the flaws using LLMs.
• BleepingComputer says the flaws were discovered by Calif, Wiz and OpenAI researchers. Cloudflare names Calif, Wiz, OpenAI and Quarkslab as disclosing them.

The leak and the defenders' window

Cloudflare says its web application firewall protections went live by default for free and paid customers at 03:02 UTC on October 21, about nine hours before public disclosure. It says the vulnerability leaked before the official release date, that it observed attack traffic targeting customers, and that attackers were mutating payloads to try to bypass its rules. BleepingComputer reports that Cloudflare CTO Dane Knecht confirmed early attacks before the patches were released. heise's article said there was no known evidence of exploitation by criminals at the time it was written. Cloudflare says its rules are an additional layer and that customers should still apply the PHP update.

OpenAI says it coordinated with maintainers, security providers and US agencies including the White House's Super Intelligence Force, the Office of the National Cyber Director and CISA. BleepingComputer reports that the UK's National Cyber Security Centre told organisations to update PHP immediately or take systems offline until patched; Times of AI has not reviewed the NCSC advisory directly. OpenAI also said it has committed $1 billion in subsidised access to Daybreak, its cyber-defence offering, for organisations with limited security resources, and published a proposed framework for coordinating responses to AI-found vulnerabilities. We covered Patch the Planet when it launched in June.

Limits

• Severity, reach and AI-contribution claims are the researchers' and companies' own; the website-share estimates come from different sources and are not reconciled.
• Discovery credit differs by account, and none of the sources sets out a single agreed sequence.
• Reports of attack activity come from Cloudflare and its CTO via BleepingComputer; the scale of exploitation is not public.

Sources

• OpenAI: Patch the Planet: global response coordination as agents uncover critical vulnerabilities (October 21, 2026)
• Wiz Research: PHP2Shell (October 21, 2026)
• Cloudflare: Cloudflare deploys protections against php2shell vulnerability (October 21, 2026)
• heise online (translated from German): php2shell: Critical flaws allow code injection in PHP (October 21, 2026)
• BleepingComputer: PHP ships emergency patches for critical PHP2Shell flaws (October 21, 2026)
• Times of AI: Daybreak Full GPT-5.5-Cyber: Politically Safest Place to Ship Frontier Uplift (June 22, 2026)