AI-assisted audits find two unauthenticated RCE flaws in PHP
On 21 October 2026 the PHP project shipped emergency releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fixing two flaws collectively named PHP2Shell: CVE-2026-109618 (remote code execution via out-of-memory corruption) and CVE-2026-109619 (remote code execution via stale global state), each rated CVSS v4.0 9.2. Both allow unauthenticated remote code execution on any PHP installation serving web requests, with Apache mod_php the highest risk. The first flaw was found in August by security firm Calif during a source-code audit funded under OpenAI's Patch the Planet programme and conducted with GPT-5.6 Sol; Google's Wiz team independently found both using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, and the PHP advisory credits Calif, Wiz and OpenAI together. A partial leak on 20 October forced the schedule forward, and AWS later reported exploitation attempts in its telemetry dating to 17 October, four days before disclosure.
Why It Mattered
This is the clearest case to date of frontier models finding flaws of the highest consequence in the foundations of the internet rather than in test harnesses or benchmark corpora. PHP runs an estimated 70 percent of websites, and the two bugs sat in code paths reachable before any application logic executes, which means a decade of deployed servers were exposed to unauthenticated code execution. Previous AI-assisted vulnerability discovery had produced long tails of low- and medium-severity findings; PHP2Shell was described by OpenAI as among the most impactful security issues in recent memory, and three separate teams reached it by pointing models at a codebase that thousands of human reviewers had read for twenty years. The week also demonstrated the compressed defensive timeline that follows. Exploitation attempts preceded the patch, Cloudflare recorded large volumes of attack traffic, CISA and the FBI issued urgent patching guidance, CERT-EU published advisory 2026-018, and government websites in Britain, Finland and Japan were taken offline as a precaution while fixes were applied. The disclosure therefore functions as a natural experiment in whether AI-assisted defence outruns AI-assisted offence: the same capability that surfaced the bugs is available to attackers reading the same patch diffs. For the history of AI, the entry matters less as a security event than as evidence about the division of labour in software maintenance. Critical open-source infrastructure is maintained by very small teams, and the economics of model-driven auditing favour whoever funds the compute. The episode established a template — a frontier lab paying for an audit of a dependency it does not own, coordinating disclosure with a foundation and a cloud security vendor — that is likely to be cited whenever the question of who is responsible for hardening shared infrastructure is revisited.
Who Built It
Calif, Wiz and OpenAI, with the PHP Foundation
Applications
- Cybersecurity
- Vulnerability Research
- Software Infrastructure