PHP2Shell: two CVSS 9.2 remote-code-execution bugs in every PHP since 5 are fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and OpenAI says GPT-5.6 Sol helped find one
Patches shipped October 21 after the embargo leaked, php.net says no complete mitigation exists, and the AI-discovery claim comes from OpenAI itself. Verdict: patch first, read the 'AI found it first' framing second.
To our knowledge, frontier AI found these vulnerabilities before attackers did, opening a Defender's Window for maintainers and security providers to prepare fixes and protections ahead of disclosure.
Comprehensive take
Patch now: this is the rare AI-security story where the headline risk is real regardless of who found the bug. The part to hold loosely is OpenAI's 'found before attackers' framing, which is unverifiable and sits beside a leaked embargo and early attacks reported by Cloudflare. Credit the coordination, which clearly worked; wait for the CVE write-ups before crediting any one model.
Use cases
Site and platform operators
Inventory every PHP runtime (CMS hosts, containers, appliances), move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and restart all workers; php.net says updating is the only complete fix.
Teams on unsupported PHP
PHP published minimal source backports for 7.4, 8.0 and 8.1 in tagged branches; plan a real upgrade, because those are not full releases.
Security and AI-policy leads
Use the embargo-leak timeline as a case study for how AI-assisted discovery compresses defenders' preparation window.
Specs
| CVEs | CVE-2026-109618 (OOM-handling corruption) and CVE-2026-109619 (stale request state) source |
|---|---|
| Severity | CVSS v4.0 9.2 for both, per the PHP security team source |
| Fixed versions | PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35; source backports for 7.4, 8.0, 8.1 source |
| Credit (per OpenAI) | Calif found a critical flaw with GPT-5.6 Sol; Wiz independently reported both source |
| Embargo leak | CVE IDs posted October 20; alleged PoCs followed; ASD and CERT-EU pre-patch alerts source |
| Government guidance | NCSC: all versions may be affected; identify PHP installs broadly source |
Insights
- Axion reading: OpenAI's post credits GPT-5.6 Sol with one flaw and Wiz with independent discovery of both, so the headline 'AI found PHP2Shell' overstates what the primary source says.
- Axion note: the 70% of websites figure comes from OpenAI's social post, not from PHP or a measured survey; 'found before attackers' is an unverifiable claim and early attacks were reported after the leak.
- Axion projection (not reported fact): if AI-assisted discovery keeps shortening time-to-bug, embargo windows of weeks will be harder to hold.
What shipped, and what to do first
On October 21 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both scored CVSS v4.0 9.2 by the PHP security team. Its advisory says either can allow unauthenticated remote code execution, and that there are "no complete mitigations, updating is the only safe choice". For branches that no longer receive releases, the project published minimal source backports for PHP 7.4, 8.0 and 8.1 for people who build their own. If you run PHP, that is the whole action item: find every install, including the ones bundled inside appliances and hosting stacks, and update. The UK's NCSC makes the same point and notes that all versions may be affected, so discovery should not be limited to old releases.
The bugs, in the maintainers' words
CVE-2026-109618 is an out-of-memory handling flaw: PHP can be interrupted while internal request data is only partly initialised, and request cleanup then treats the invalid data as valid. CVE-2026-109619 is stale state: request-owned internal state can survive after its backing memory is freed, and a later request handled by the same worker may use it before normal initialisation resets it. Both were reported against a codebase that, per OpenAI's social post, runs an estimated 70% of websites. That 70% is OpenAI's estimate, not a figure from the PHP project.
The AI-discovery claim, scoped
OpenAI says researchers at Calif identified a critical flaw using GPT-5.6 Sol under its Patch the Planet initiative, and that Wiz independently found and reported both vulnerabilities. Read that carefully: the post credits the model with helping surface one flaw, and credits a second team with independent discovery of both. OpenAI also says that "to our knowledge" frontier AI found the bugs before attackers did. That is an unverifiable negative, and the embargo story below cuts against the tidy version of it. What is solid is the coordination: OpenAI says it led a coalition of maintainers, researchers and security providers for about two months, because the fix needed a major change to the PHP engine, and that Wiz, Cloudflare and others contributed research and protections ahead of disclosure.
The embargo leaked
Infosecurity Magazine reports that a Hacker News user posted the CVE identifiers on October 20, before patches existed, claiming a CVSS of 10.0 (PHP rated them 9.2). iTnews reports that a researcher then posted alleged full details with two proofs of concept, that Australia's ASD and CERT-EU issued rare pre-patch alerts, and The Independent reports Cloudflare saw early attacks and added temporary firewall rules. We have not independently verified exploitation in the wild. Treat it as a reason to move today, not as a measured attack count.
Partial mitigations, if you cannot patch yet
PHP's advisory lists stopgaps and is explicit that none is complete. For 109618: set memory_limit=-1 in a way applications cannot override, keep post_max_size low (8M, or 32M if uploads are needed), and use a container or cgroup limit rather than RLIMIT_AS. For 109619: disable session.upload_progress and restart every worker, and on PHP 8.5 set fatal_error_backtraces=0. Each of those blocks only the confirmed paths. OpenAI also published a PHP version checker and says a Codex skill is coming.
Why this matters beyond PHP
OpenAI pairs the announcement with a $1 billion commitment of subsidised Daybreak access for under-resourced defenders, and says it expects findings like this to "increase sharply". Whether that is marketing or an accurate forecast, the operational lesson is the same: the gap between a model finding a bug and a patch reaching every server is now the scarce resource, and a leak can erase it.