AI-Discovered PHP2Shell Flaw Forces Global Emergency Patching

Security firm Wiz and OpenAI's "Patch the Planet" project independently discovered PHP2Shell, a set of critical vulnerabilities in PHP's core engine affecting every PHP release of the past decade (back to 5.4)—roughly 70% of web services. Dormant for 14 years, the flaws allow unauthenticated remote code execution and Heartbleed-style memory disclosure. Per the New York Times and Wall Street Journal, the NSA issued an emergency advisory telling sites that cannot patch immediately to go offline; institutions worldwide—including the Japanese Prime Minister's office, a German hospital, France's taxpayer system, and IT companies in Kenya—scrambled to patch overnight, with many sites briefly taken down as a precaution. Wiz says the research ran on its Wiz Atlas platform using Gemini 4 Argon and GPT-5.6 Sol, with Gemini 4 Argon standing out in vulnerability discovery, exploit development, and attack-surface analysis; OpenAI's side involved GPT, and the two disclosures were independent.

Confirmed

• PHP2Shell stems from flaws in how PHP handles memory: attackers can execute malicious code on affected servers, take over websites, and steal sensitive data, impacting widely deployed systems like WordPress and Wikipedia.
• The NSA urged all organizations running PHP to patch the two critical vulnerabilities ASAP, and to take systems offline if they cannot update immediately.
• Wiz disclosed the vulnerability in cross-Google and cross-industry research; OpenAI's project was an independent discovery.
• Separately, Anthropic used Claude to automatically shrink the attack surface of 25 open-source projects.

Controversy and Dissent

• @joshuasaxe pushed back on the claim that "PHP2Shell is the worst day in cybersecurity history," calling it fear-mongering absent a mechanistic explanation comparing it to historic major vulnerabilities; he remains optimistic overall: defenders fixed it before widespread exploitation, along with tens of thousands of similar issues over the past year, and initial access was never the real bottleneck for attackers anyway.
• @ShakeelHashim relayed Transformer Weekly's take: the cybersecurity disaster Anthropic and OpenAI warned of months ago—dismissed by some as hype—materialized this week in a different form.
• @kuza55 shared hands-on experience using an AI agent to untangle the eMudhra certificate mess: with a single instruction to "patch everything," the agent found all dependencies needing updates and rebuilt images for components with no upstream fix—showcasing AI's value in emergency response.

Why It Matters

The event is seen as a landmark case of cybersecurity entering an "AI vs. AI" era: the same models that can find and fix vulnerabilities are in the hands of both attackers and defenders, compressing the attack-defense cycle; the global emergency patching also served as the first real-world test of AI agents' capability in large-scale incident response.

2026-10-22 ~ 2026-10-24 · 12 related posts

Full story(15 episodes)→

• Episode 1: PHP Rushes Emergency Patches for Two Unauthenticated RCE Flaws Found with OpenAI Models(2026-10-21, 113 posts)
• Episode 2: Researchers Predict LLM Audits Will Uncover More PHP Vulnerabilities(2026-10-21, 3 posts)
• Episode 3: PHP RCE proof-of-concept confirmed working, but not one-click(2026-10-21, 2 posts)
• Episode 4: "Black October": A Wave of Critical Vulnerabilities Hits Dozens of Open-Source Projects(2026-10-21, 27 posts)
• Episode 5: LLM-Generated Fake PHP Exploit Sparks Security Panic(2026-10-21, 2 posts)
• Episode 6: Open-source repo demonstrates HTTP-only ASLR bypass RCE in PHP 8.4.26(2026-10-21, 2 posts)
• Episode 7: PHP Engine Hit by Two Critical RCE Flaws With Leaked Exploits; Scans Began 20 Minutes After Patch Release(2026-10-22, 6 posts)
• Episode 8: PHP 8.5.12 Patch Incomplete: php2shell Double-Free Still Exploitable(2026-10-22, 2 posts)
• Episode 9: php2shell Vulnerability Story Told in Hand-Drawn Comics(2026-10-22, 2 posts)
• Episode 10: PHP Zero-Day Rush Patch Meets ARTEX Agent Attacks in "Worst Cybersecurity Day"(2026-10-22, 28 posts)
• Episode 11: PHP2Shell Exploited Four Days Before Public Disclosure(2026-10-22, 2 posts)
• Episode 12: php2shell Exploits Top One Million After Disclosure(2026-10-22, 3 posts)
• Episode 13: Drupal/PHP Vulnerability Surge Keeps Security Teams Busy Hardening Sites(2026-10-22, 2 posts)
• Episode 14: AI-Discovered PHP2Shell Flaw Forces Global Emergency Patching(2026-10-22, 12 posts)
• Episode 15: Investor Deedy Warns AI Is Lowering the Barrier to Exploiting Vulnerabilities(2026-10-22, 3 posts)

• [source] Wiz says Gemini 4 Argon helped find decade-old critical vulnerability, coordinated fix across industry — HaydnBelfield · 2026-10-22
• Researcher pushes back on 'worst day in cybersecurity history' claims about php2shell — joshua_saxe · 2026-10-23
• AI agents untangle cert-vendor mess: find every outdated dep and rebuild images automatically — kuza55 · 2026-10-23
• php2shell zero-day sparks AI cybersecurity debate as Anthropic uses Claude to harden 25 OSS codebases — connoraxiotes · 2026-10-23
• AI uncovers PHP2Shell flaw threatening the tech behind 70% of all websites — AIFlow_ML · 2026-10-23
• OpenAI's Patch the Planet and Wiz independently uncover PHP2Shell flaw affecting 70% of the web — zacharynado · 2026-10-23
• NSA urges PHP sites offline as 14-year-old bug is found with a five-word AI prompt — nicolechirps · 2026-10-23
• [source] AI-Discovered PHP Flaw Triggers Global Emergency Patching, Briefly Taking Websites Offline — nordicinst · 2026-10-23
• AI vs AI: the PHP-to-Shell exploit and agent swarms reshaping cybersecurity — The AI Daily Brief · 2026-10-23
• AI-Found PHP Flaws Confirm the Cyber Disaster — But It Looks Different Than Imagined — ShakeelHashim · 2026-10-23
• [source] Wiz: Gemini 4 Argon helped uncover critical PHP RCE flaws affecting 70% of the web — DynamicWebPaige · 2026-10-23
• AI-found PHP flaws forced emergency site shutdowns across Europe — and reignited the AI doomer debate — DrTechlash · 2026-10-24