AI Helped Find Two Critical PHP Flaws Behind Emergency Patches

On October 21, 2026, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities that, under the right conditions, let an unauthenticated attacker run code on servers running PHP. US agencies have nicknamed the pair PHP2Shell.

AI played a part in finding them. OpenAI says security firm Calif identified a critical flaw using GPT-5.6 Sol as part of its Patch the Planet program, and that Wiz independently discovered and reported both vulnerabilities.

The two flaws

• CVE-2026-109618: remote code execution through memory corruption when a request hits PHP’s memory limit at exactly the wrong moment. The PHP Foundation says that on Apache with mod_php, an unauthenticated request can trigger it before any application code runs.
• CVE-2026-109619: remote code execution through stale global state, where a later request can use memory that belonged to an earlier one.

CERT-EU lists both with a CVSS score of 9.2. It says every PHP installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php the highest-risk setup.

How AI fit in

According to the PHP Foundation, Calif began auditing PHP on July 30 through Patch the Planet. On August 11, a Calif researcher reported an unconditional remote code execution bug, and OpenAI independently reported the same root cause the same day. Wiz followed with further attack vectors.

OpenAI says it spent the past two months leading a coalition of maintainers, researchers and security providers, while PHP’s maintainers led the fixes and release. It calls the issue “one of the most impactful security issues in recent memory” and says it expects similar findings “to increase sharply in the coming months.” OpenAI also says it has committed $1 billion in subsidized access to its Daybreak security tools for under-resourced defenders.

A rocky disclosure

The PHP Foundation says the CVE IDs leaked online on October 20, so the project moved the release up by a day. Proof-of-concept exploits then began circulating.

What to do

The NSA says attackers could use PHP2Shell to take control of web servers without prior access, and that the risk requires immediate patching across US government agencies. CISA urges organizations to patch immediately, prioritizing internet-facing systems, and to take PHP-based systems offline if they can’t update right away or are on PHP 8.1 or older.