OpenAI Models Uncover Critical PHP Flaws Affecting Most of the Web

PHP shipped an emergency security update on October 21 at 14:00 UTC, patching two critical vulnerabilities allowing unauthenticated remote code execution (RCE)—CVE-2026-109618 and CVE-2026-109619 (codenamed php2shell)—in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. All PHP deployments handling web requests are affected. OpenAI announced its models played a key role in the discovery and launched the "Patch the Planet" global cybersecurity initiative; the FBI, NSA, and other agencies also issued emergency alerts. Since PHP powers roughly 70% of websites worldwide, this is regarded as one of the largest-impact open source security incidents in recent years.Confirmed

• PHP's official security advisory confirms the two vulnerabilities allow unauthenticated RCE, affecting all web-serving deployments including PHP-FPM, modphp, php-cgi, FrankenPHP, and LiteSpeed; modphp carries the highest risk, with a demonstrated exploit triggerable by an unauthenticated request before application code runs (m2, m13).
• Both are rated CVSSv4 9.2; security researcher cyb3rops revealed one is a core RCE flaw scoring a perfect CVSS 10.0 (m11, m20).
• The vulnerabilities were found and disclosed collaboratively by Calif.io, OpenAI, Wiz, and Quarkslab; OpenAI says researchers in its "Patch the Planet" program made the discovery using OpenAI models, and over the past two months led a coalition of maintainers and security vendors to prepare the fix (m1, m16, m18, m19).
• The flaws lie in PHP itself, not plugins—plugin developers cannot fix them, and sites like WordPress must upgrade PHP directly (m6).
• The FBI published both CVE numbers and advised organizations unable to upgrade immediately to take systems offline; the NSA also issued an immediately effective emergency recommendation to update or take systems offline until fully mitigated (m12, m14).
• Cloudflare has urgently shipped WAF rules as a temporary mitigation (m15).
• The joint write-up mentioned in m16 uses a "journey through time" narrative tracing the root cause back through code evolution since 2004.Unconfirmed
• vxunderground calling the flaw "ultra mega" severity on par with Log4Shell is an analogy from some security researchers, not an official rating (m17).
• m11 states that older versions (pre-PHP 8) are expected to receive no patches, consistent with the advisory listing only four PHP 8.x fixed versions, but officials have not explicitly stated the plan for older versions.
• m4's mention of "AI-assisted attacks possibly arriving within 15 minutes" is a precautionary speculation from the Japanese security community; no real-world exploitation has been confirmed.Why it matters
• PHP powers about 70% of websites worldwide; the flaws are low-barrier and automatable, and because they sit in the language core rather than the plugin layer, the fix falls on server operators—WordPress site owners were urged to stand by overnight to patch.
• This is a landmark case of AI models systematically participating in vulnerability hunting for critical open source infrastructure; OpenAI leveraged it to launch the "Patch the Planet" program, signaling the normalization of AI-driven security research.
• The rare simultaneous warnings from agencies in multiple countries (FBI, NSA) and Cloudflare's emergency WAF rules reflect the incident's potentially huge impact.

2026-10-21 ~ 2026-10-22 · 48 related posts

Full story(5 episodes)→

• Episode 1: OpenAI Models Uncover Critical PHP Flaws Affecting Most of the Web(2026-10-21, 48 posts)
• Episode 2: Researchers Predict LLM Audits Will Uncover More PHP Vulnerabilities(2026-10-21, 3 posts)
• Episode 3: PHP RCE proof-of-concept confirmed working, but not one-click(2026-10-21, 2 posts)
• Episode 4: POC Released for Critical Pre-Auth RCE in PHP session.upload_progress(2026-10-21, 2 posts)
• Episode 5: OpenAI Says PHP Vulnerability Finds Are Just the Beginning as Devs Joke Online(2026-10-21, 2 posts)

• CVSS 10.0 RCE vulnerability disclosed in PHP core, patches only for PHP 8 — cyb3rops · 2026-10-21
• CVSS 10.0 RCE in PHP core: critical patches land Oct 21, PHP 8 only — cyb3rops · 2026-10-21
• PHP core RCE rated CVSS 10.0 lands Oct 20; eBPF tool spots exploitation early — cyb3rops · 2026-10-21
• PHP pre-announces critical security release fixing two CVSS 9.2 vulnerabilities on Oct 21 — jedisct1 · 2026-10-21
• Two CVSS 9.2 Critical PHP Vulnerabilities Land Tomorrow; Laravel Scrambles to Patch — taylorotwell · 2026-10-21
• PHP remote control vulnerability hits back to PHP 5, agents poised to weaponize it fast — MarcJSchmidt · 2026-10-21
• Two critical PHP vulnerabilities prompt emergency patches due at midnight JST — itmedia_news · 2026-10-21
• PHP rushes emergency patches as info on two RCE flaws (rated up to CVSS 10) leaks early — DynamicWebPaige · 2026-10-21
• Two PHP CVEs incoming, warning that '70.2% of the internet' will be scrambling — JiliJeanlouis · 2026-10-21
• [source] PHP ships emergency patches for two critical unauthenticated RCE vulnerabilities — cyber_forecast · 2026-10-21
• Critical PHP RCE Leaked Before Patch, Fueling Fears of Open-Source AI Regulation — basedjensen · 2026-10-21
• PHP hit by mega exploit dubbed php2shell; some say Log4J-level severity, PoC video features a dancing anime lady — basedjensen · 2026-10-21
• PHP pre-announces two CVSS 9.2 critical vulns as Cloudflare races to deploy WAF rules — mitsuhiko · 2026-10-21
• Two Critical PHP Core CVEs Scored 9.2 Get Emergency Patches Today, Feared Unauth RCE — Kyrannio · 2026-10-21
• Two CVSS 9.2 PHP 0-days expose unpatched sites, plus eMudhra cert flaw enables IoT impersonation — seanwbren · 2026-10-21
• PHP critical CVE scored 9.2 forces emergency patch: WordPress operators urged to prep before exploits hit — EthanJPerez · 2026-10-21
• PHP ships emergency patch for CVSS 9.2 flaw as AI-assisted exploits expected within 15 minutes — EthanJPerez · 2026-10-21
• PHP team warns of two critical vulnerabilities, patches due Oct 21 — EthanJPerez · 2026-10-21
• Wiz discloses PHP2Shell: pre-auth RCE chains hit WordPress, Drupal, Joomla — shirtamari · 2026-10-21
• php2shell: A 20-Year Deep Dive Into Two PHP Remote Vulnerabilities — moyix · 2026-10-21
• [source] OpenAI says its models found critical PHP flaws affecting ~70% of all websites — OpenAI · 2026-10-21
• OpenAI models helped researchers find critical PHP RCE flaws affecting ~70% of websites — moyix · 2026-10-21
• Developer rushes to warn former startup as severe PHP RCE bugs drop — vista8 · 2026-10-21
• NSA Warns of Two Critical PHP Vulnerabilities: Update or Take Systems Offline — seanmcdonaldxyz · 2026-10-21
• Wiz uses Gemini to uncover PHP2Shell, CVSS 10 flaws affecting 70% of the web — ralucaadapopa · 2026-10-21
• FBI alerts on two critical PHP RCE flaws, CVSS 9.2, patch immediately — burny_tech · 2026-10-21
• php2shell: Critical PHP RCE bugs hit PHP 5.4+; Cloudflare deployed WAF rules 9 hours early — 0xkarasy · 2026-10-21
• OpenAI staffer: we helped find a PHP vuln, and in 6 months you'll see us as a security company — paw_lean · 2026-10-21
• PHP critical vulnerability exploits underway; Gemini 4 aided discovery and patch validation — rseroter · 2026-10-21
• Wiz used Gemini 4 and GPT-5.6 to uncover critical PHP RCE chain — basedjensen · 2026-10-22
• Wiz used Gemini and GPT to exploit decade-old PHP bugs in a week, prompting emergency patches — Haunting_Ganache_850 · 2026-10-22
• Teaser: a PHP vulnerability dropping next week will freak out LinkedIn — tlakomy · 2026-10-22

16 near-duplicate retellings: _jaydeepkarale · cyb3rops · banteg · DanielLockyer · cyb3rops · jedisct1 · Polymarket · RSync25 · MickeySteamboat · Kyrannio · Kyrannio · MickeySteamboat · gabrielchua · _mbdr_ · OpenAI · FlorianGallwitz