PHP Ships Emergency Patches for Two Unauthenticated RCE Flaws Found with OpenAI Models
On October 21, PHP shipped an emergency security update: versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fixed two critical vulnerabilities enabling unauthenticated remote code execution (RCE)—CVE-2026-109618 and CVE-2026-109619 (CVSSv4 9.2). All PHP deployments handling web requests (PHP-FPM, modphp, php-cgi, FrankenPHP, LiteSpeed) are affected, with modphp at highest risk—a demonstrated exploit can be triggered by an unauthenticated request before application code runs. OpenAI announced that researchers in its "Patch the Planet" program found these vulnerabilities with the help of OpenAI models; the event drew wide attention as it affects roughly 70% of websites worldwide.
Confirmed
- PHP's official advisory confirmed the two unauthenticated RCE vulnerabilities and four patched versions; the security team had pre-announced the update for October 21 14:00 UTC, and the patch went live late on the 21st Japan time, with details relayed from the official advisory by @DanielLockyer, @cyberforecast, and others.
- OpenAI's official posts (m1/m2) announced that its models helped discover the bugs, with fixes coordinated over the past two months alongside maintainers and security vendors—time-consuming due to major changes to the PHP engine; @YuchenjUW said the bugs were found by GPT-5.6 Sol.
- US officials got heavily involved: the FBI's cyber division notified of the two CVEs and advised organizations unable to upgrade immediately to take systems offline; the NSA issued an immediately effective emergency directive urging prompt updates or taking systems offline until mitigated.
- Laravel founder Taylor Otwell confirmed Laravel rolled out emergency patch adaptations across the board; the flaws originate in PHP itself rather than plugins, so plugin developers can't fix them on users' behalf, and WordPress site owners were urged to stand by for patching.
- Supply-chain security firm lead Dan Lorenc revealed that while the bugs were still under embargo, a frontier model with a proprietary harness independently reproduced the CVE from a single prompt: "find bad vulnerabilities."
- Wes Roth reported the Dutch central government proactively took some government websites offline as a precaution.
Unconfirmed
- Posts vary on PHP's coverage (about 70%, 80%, or 8%); the exact share can't be verified—OpenAI's official "about 70%" is taken as authoritative.
- @cyb3rops previously mentioned an independently confirmed CVSS 10.0 max-severity RCE bug with no patches for old versions; its relation to the two officially announced 9.2-scored vulnerabilities is unclear.
- "Automated AI attacks within 15 minutes of patch release" is a precautionary judgment from Japan's security community; no actual in-the-wild exploitation has been confirmed.
Why it matters
- A landmark case of AI models systematically discovering critical vulnerabilities in widely deployed open-source software: @Sriramk argued this signals AI making the internet safer by surfacing long-dormant security issues, but software supply chains need the ability to build and deploy fixes quickly, likely requiring more public-private collaboration.
- @YuchenjUW framed it against multiple security incidents within days (such as the LiteLLM supply-chain attack), noting AI is also making attacks faster and cheaper—offensive and defensive capabilities are escalating in parallel.
2026-10-21 ~ 2026-10-23 · 110 related posts
- Episode 1: PHP Ships Emergency Patches for Two Unauthenticated RCE Flaws Found with OpenAI Models(2026-10-21, 110 posts)
- Episode 2: Researchers Predict LLM Audits Will Uncover More PHP Vulnerabilities(2026-10-21, 3 posts)
- Episode 3: PHP RCE proof-of-concept confirmed working, but not one-click(2026-10-21, 2 posts)
- Episode 4: 'Black October': 27 Major Vulnerabilities and Supply-Chain Attacks Hit in Days(2026-10-21, 19 posts)
- Episode 5: POC Released for Critical Pre-Auth RCE in PHP session.upload_progress(2026-10-21, 2 posts)
- Episode 6: LLM-Generated Fake PHP Exploit Sparks Security Panic(2026-10-21, 2 posts)
- Episode 7: Open-source repo demonstrates HTTP-only ASLR bypass RCE in PHP 8.4.26(2026-10-21, 2 posts)
- Episode 8: PHP 8.5.12 Patch Incomplete: php2shell Double-Free Still Exploitable(2026-10-22, 2 posts)
- Episode 9: php2shell Vulnerability Story Told in Hand-Drawn Comics(2026-10-22, 2 posts)
- Episode 10: PHP zero-day RCEs force emergency patches as ARTEX agentic AI attacks hundreds of orgs(2026-10-22, 20 posts)
- Episode 11: PHP2Shell Exploited Four Days Before Public Disclosure(2026-10-22, 2 posts)
- Episode 12: php2shell Exploits Top One Million After Disclosure(2026-10-22, 3 posts)
- Episode 13: Drupal/PHP Vulnerability Surge Keeps Security Teams Busy Hardening Sites(2026-10-22, 2 posts)
- Episode 14: Investor Deedy Warns AI Is Lowering the Barrier to Exploiting Vulnerabilities(2026-10-22, 3 posts)
Primary sources
- CVSS 10.0 RCE vulnerability disclosed in PHP core, patches only for PHP 8 — cyb3rops · 2026-10-21
- CVSS 10.0 RCE in PHP core: critical patches land Oct 21, PHP 8 only — cyb3rops · 2026-10-21
- PHP core RCE rated CVSS 10.0 lands Oct 20; eBPF tool spots exploitation early — cyb3rops · 2026-10-21
- PHP pre-announces critical security release fixing two CVSS 9.2 vulnerabilities on Oct 21 — jedisct1 · 2026-10-21
- Two CVSS 9.2 Critical PHP Vulnerabilities Land Tomorrow; Laravel Scrambles to Patch — taylorotwell · 2026-10-21
- PHP remote control vulnerability hits back to PHP 5, agents poised to weaponize it fast — MarcJSchmidt · 2026-10-21
- Two critical PHP vulnerabilities prompt emergency patches due at midnight JST — itmedia_news · 2026-10-21
- PHP rushes emergency patches as info on two RCE flaws (rated up to CVSS 10) leaks early — DynamicWebPaige · 2026-10-21
- Two PHP CVEs incoming, warning that '70.2% of the internet' will be scrambling — JiliJeanlouis · 2026-10-21
- [source] PHP ships emergency patches for two critical unauthenticated RCE vulnerabilities — cyber_forecast · 2026-10-21
- Critical PHP RCE Leaked Before Patch, Fueling Fears of Open-Source AI Regulation — basedjensen · 2026-10-21
- PHP hit by mega exploit dubbed php2shell; some say Log4J-level severity, PoC video features a dancing anime lady — basedjensen · 2026-10-21
- PHP pre-announces two CVSS 9.2 critical vulns as Cloudflare races to deploy WAF rules — mitsuhiko · 2026-10-21
- Two Critical PHP Core CVEs Scored 9.2 Get Emergency Patches Today, Feared Unauth RCE — Kyrannio · 2026-10-21
- Two CVSS 9.2 PHP 0-days expose unpatched sites, plus eMudhra cert flaw enables IoT impersonation — seanwbren · 2026-10-21
- PHP critical CVE scored 9.2 forces emergency patch: WordPress operators urged to prep before exploits hit — EthanJPerez · 2026-10-21
- PHP ships emergency patch for CVSS 9.2 flaw as AI-assisted exploits expected within 15 minutes — EthanJPerez · 2026-10-21
- PHP team warns of two critical vulnerabilities, patches due Oct 21 — EthanJPerez · 2026-10-21
- Wiz discloses PHP2Shell: pre-auth RCE chains hit WordPress, Drupal, Joomla — shirtamari · 2026-10-21
- php2shell: A 20-Year Deep Dive Into Two PHP Remote Vulnerabilities — moyix · 2026-10-21
- [source] OpenAI says its models found critical PHP flaws affecting ~70% of all websites — OpenAI · 2026-10-21
- OpenAI models helped researchers find critical PHP RCE flaws affecting ~70% of websites — moyix · 2026-10-21
- Security researcher: benchmark-saturated open models still fail real PHP exploit work — banteg · 2026-10-21
- Developer rushes to warn former startup as severe PHP RCE bugs drop — vista8 · 2026-10-21
- OpenAI says PHP flaws found with GPT-5.6 are just the tip of the iceberg — Dan_Jeffries1 · 2026-10-21
- NSA Warns of Two Critical PHP Vulnerabilities: Update or Take Systems Offline — seanmcdonaldxyz · 2026-10-21
- Wiz uses Gemini to uncover PHP2Shell, CVSS 10 flaws affecting 70% of the web — ralucaadapopa · 2026-10-21
- Indian CA used private keys as weak as "4"; AI-found critical PHP flaw exposed early — 歸藏的AI工具箱 · 2026-10-21
- Devs celebrate the 'PHP meltdown' as AI-found flaws expose legacy code archaeology — weskambale · 2026-10-21
- FBI alerts on two critical PHP RCE flaws, CVSS 9.2, patch immediately — burny_tech · 2026-10-21
- php2shell: Critical PHP RCE bugs hit PHP 5.4+; Cloudflare deployed WAF rules 9 hours early — 0xkarasy · 2026-10-21
- OpenAI staffer: we helped find a PHP vuln, and in 6 months you'll see us as a security company — paw_lean · 2026-10-21
- PHP critical vulnerability exploits underway; Gemini 4 aided discovery and patch validation — rseroter · 2026-10-21
- LiteLLM supply chain attack, PHP flaws found by GPT-5.6: AI is making hacking faster and cheaper — Yuchenj_UW · 2026-10-21
- Weak CA keys cracked in 1 second and AI-found PHP flaw force global emergency patching — 赛博禅心 · 2026-10-21
- Wiz used Gemini 4 and GPT-5.6 to uncover critical PHP RCE chain — basedjensen · 2026-10-22
- AI-assisted php2shell exploit chain hits PHP runtime, forcing coordinated defense — VectorWireAI · 2026-10-22
13 near-duplicate retellings: _jaydeepkarale · cyb3rops · banteg · DanielLockyer · cyb3rops · jedisct1 · Polymarket · RSync25 · MickeySteamboat · Kyrannio · Kyrannio · MickeySteamboat · gabrielchua