OpenAI models uncover critical PHP flaw affecting 70% of websites

PHP issued a security advisory on October 21 disclosing two critical vulnerabilities enabling unauthenticated remote code execution (RCE) (CVE-2026-109618 and CVE-2026-109619, CVSS v4 score 9.2), with emergency fixes shipped in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. OpenAI announced that models from its "Patch the Planet" initiative helped researchers discover the flaws; the FBI and NSA both issued urgent advisories, recommending that organizations unable to upgrade immediately take their systems offline.

Confirmed

• PHP's official advisory confirms the two critical flaws allow unauthenticated RCE, affecting all deployments that handle web requests (PHP-FPM, modphp, php-cgi, FrankenPHP, LiteSpeed), with modphp at highest risk—Daniel Lockyer noted a demo exploit can be triggered by an unauthenticated request before application code runs
• Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; patches were released late on October 21 Japan time (UTC 14:00), after officials gave advance notice and urged users to prepare for upgrades
• OpenAI announced that researchers in its "Patch the Planet" initiative used its models to find the vulnerabilities, and over the past two months led coordination between maintainers and security vendors; Wiz participated in the joint discovery (technical php2shell analysis shared by moyix)
• Cloudflare urgently deployed WAF rules as temporary mitigation; Laravel creator Taylor Otwell said Laravel is urgently adapting patches across the board
• The FBI listed both CVE identifiers and advised organizations that cannot upgrade immediately to take systems offline first; the NSA issued an emergency advisory urging immediate patching or shutdown
• Multiple parties warned attackers may weaponize the flaws quickly post-disclosure: one security account predicted AI-assisted automated attacks within 15 minutes of patch release; the flaws reside in the PHP engine itself so plugin developers cannot fix them, and WordPress site owners were urged to stand by overnight to patch

Unconfirmed

• cyb3rops previously claimed a CVSS 10.0 maximum-severity RCE with patches only for PHP 8 series and no fixes for older versions, contradicting the official four-version fix scope and not directly corroborated by the official advisory
• vxunderground claimed the flaw (php2shell) is on par in severity with Log4Shell—this is an individual researcher's assessment
• Which OpenAI model was used (Kyrannio's repost claimed GPT-5.6) has not been confirmed in OpenAI's official posts

Why it matters

• PHP powers roughly 70% (some say 80%) of websites worldwide, with major ecosystems like WordPress built on it, giving the flaws an enormous attack surface
• This is a landmark case of AI models systematically participating in discovering and fixing critical open-source vulnerabilities; OpenAI is using it to launch its "Patch the Planet" global cybersecurity initiative, aiming to continuously find and patch open-source flaws with AI

2026-10-21 ~ 2026-10-22 · 64 related posts

Full story(5 episodes)→

• Episode 1: OpenAI models uncover critical PHP flaw affecting 70% of websites(2026-10-21, 64 posts)
• Episode 2: Researchers Predict LLM Audits Will Uncover More PHP Vulnerabilities(2026-10-21, 3 posts)
• Episode 3: PHP RCE proof-of-concept confirmed working, but not one-click(2026-10-21, 2 posts)
• Episode 4: POC Released for Critical Pre-Auth RCE in PHP session.upload_progress(2026-10-21, 2 posts)
• Episode 5: PHP 8.5.12 Patch Incomplete: php2shell Double-Free Still Exploitable(2026-10-22, 2 posts)

• CVSS 10.0 RCE vulnerability disclosed in PHP core, patches only for PHP 8 — cyb3rops · 2026-10-21
• CVSS 10.0 RCE in PHP core: critical patches land Oct 21, PHP 8 only — cyb3rops · 2026-10-21
• PHP core RCE rated CVSS 10.0 lands Oct 20; eBPF tool spots exploitation early — cyb3rops · 2026-10-21
• PHP pre-announces critical security release fixing two CVSS 9.2 vulnerabilities on Oct 21 — jedisct1 · 2026-10-21
• Two CVSS 9.2 Critical PHP Vulnerabilities Land Tomorrow; Laravel Scrambles to Patch — taylorotwell · 2026-10-21
• PHP remote control vulnerability hits back to PHP 5, agents poised to weaponize it fast — MarcJSchmidt · 2026-10-21
• Two critical PHP vulnerabilities prompt emergency patches due at midnight JST — itmedia_news · 2026-10-21
• PHP rushes emergency patches as info on two RCE flaws (rated up to CVSS 10) leaks early — DynamicWebPaige · 2026-10-21
• Two PHP CVEs incoming, warning that '70.2% of the internet' will be scrambling — JiliJeanlouis · 2026-10-21
• [source] PHP ships emergency patches for two critical unauthenticated RCE vulnerabilities — cyber_forecast · 2026-10-21
• Critical PHP RCE Leaked Before Patch, Fueling Fears of Open-Source AI Regulation — basedjensen · 2026-10-21
• PHP hit by mega exploit dubbed php2shell; some say Log4J-level severity, PoC video features a dancing anime lady — basedjensen · 2026-10-21
• PHP pre-announces two CVSS 9.2 critical vulns as Cloudflare races to deploy WAF rules — mitsuhiko · 2026-10-21
• Two Critical PHP Core CVEs Scored 9.2 Get Emergency Patches Today, Feared Unauth RCE — Kyrannio · 2026-10-21
• Two CVSS 9.2 PHP 0-days expose unpatched sites, plus eMudhra cert flaw enables IoT impersonation — seanwbren · 2026-10-21
• PHP critical CVE scored 9.2 forces emergency patch: WordPress operators urged to prep before exploits hit — EthanJPerez · 2026-10-21
• PHP ships emergency patch for CVSS 9.2 flaw as AI-assisted exploits expected within 15 minutes — EthanJPerez · 2026-10-21
• PHP team warns of two critical vulnerabilities, patches due Oct 21 — EthanJPerez · 2026-10-21
• Wiz discloses PHP2Shell: pre-auth RCE chains hit WordPress, Drupal, Joomla — shirtamari · 2026-10-21
• php2shell: A 20-Year Deep Dive Into Two PHP Remote Vulnerabilities — moyix · 2026-10-21
• OpenAI says its models found critical PHP flaws affecting ~70% of all websites — OpenAI · 2026-10-21
• OpenAI models helped researchers find critical PHP RCE flaws affecting ~70% of websites — moyix · 2026-10-21
• Developer rushes to warn former startup as severe PHP RCE bugs drop — vista8 · 2026-10-21
• OpenAI says PHP flaws found with GPT-5.6 are just the tip of the iceberg — Dan_Jeffries1 · 2026-10-21
• NSA Warns of Two Critical PHP Vulnerabilities: Update or Take Systems Offline — seanmcdonaldxyz · 2026-10-21
• Wiz uses Gemini to uncover PHP2Shell, CVSS 10 flaws affecting 70% of the web — ralucaadapopa · 2026-10-21
• Indian CA used private keys as weak as "4"; AI-found critical PHP flaw exposed early — 歸藏的AI工具箱 · 2026-10-21
• Devs celebrate the 'PHP meltdown' as AI-found flaws expose legacy code archaeology — weskambale · 2026-10-21
• FBI alerts on two critical PHP RCE flaws, CVSS 9.2, patch immediately — burny_tech · 2026-10-21
• php2shell: Critical PHP RCE bugs hit PHP 5.4+; Cloudflare deployed WAF rules 9 hours early — 0xkarasy · 2026-10-21
• OpenAI staffer: we helped find a PHP vuln, and in 6 months you'll see us as a security company — paw_lean · 2026-10-21
• PHP critical vulnerability exploits underway; Gemini 4 aided discovery and patch validation — rseroter · 2026-10-21
• Weak CA keys cracked in 1 second and AI-found PHP flaw force global emergency patching — 赛博禅心 · 2026-10-21
• Wiz used Gemini 4 and GPT-5.6 to uncover critical PHP RCE chain — basedjensen · 2026-10-22
• AI-assisted php2shell exploit chain hits PHP runtime, forcing coordinated defense — VectorWireAI · 2026-10-22
• Wiz used Gemini and GPT to exploit decade-old PHP bugs in a week, prompting emergency patches — Haunting_Ganache_850 · 2026-10-22

14 near-duplicate retellings: _jaydeepkarale · cyb3rops · banteg · DanielLockyer · cyb3rops · jedisct1 · Polymarket · RSync25 · MickeySteamboat · Kyrannio · Kyrannio · MickeySteamboat · gabrielchua · _mbdr_