PHP2Shell hits 70% of the web: OpenAI and Wiz independently found the PHP flaws using AI models

Latent Space · rss · 2026-10-22

• Researchers disclosed two PHP-engine memory-corruption bugs dubbed PHP2Shell (CVE-2026-109618 / CVE-2026-109619), rooted in PHP's handling of out-of-memory and fatal errors, with demonstrated pre-auth RCE against WordPress, Drupal, and Joomla plus Heartbleed-style memory disclosure — affecting roughly 70% of the web.
• Found independently by two parties: Calif researchers under OpenAI's "Patch the Planet" program using GPT-5.6 Sol, and Google-acquired Wiz using Gemini 4 Argon, GPT-5.6 Sol, and its own Wiz Atlas tool.
• OpenAI says disclosure followed roughly 2 months of coordinated remediation, requiring a major PHP-engine change with advance notice to governments; Cloudflare shipped free-tier WAF stopgaps before the patch; the NSA advised taking unpatchable systems offline.
• Viral claims of 1.5M unpatched servers (attributed to Censys), outages at Wikipedia, Archive.org, European government sites, and Japan's PM urging patching or disconnecting remain largely uncorroborated by primary sources.
• OpenAI also published a repo with a Codex skill to help operators check exposure. Commentary: expect a year-plus of AI-discovered critical vulnerabilities — the largest security audit of critical software in history.

Original post →

More from Safety

• Upstream CEO: hacked robots can turn dangerous without losing control — TechNadu · 2026-10-22
• Cloudflare's AI security-audit skill tops GitHub with 38.5k stars — alex_verem · 2026-10-22
• Major US banks detect unauthorized third-party AI agents inside customer accounts, Axios reports — EthanJPerez · 2026-10-22
• Seth Lazar: AI Agents Are Already Straining Democratic Resilience — sethlazar · 2026-10-22
• Ben Bajarin: cybersecurity becomes the budget that lets enterprise AI scale — BenBajarin · 2026-10-22
• Europe cannot rent its way to AI sovereignty, Air Street Capital argues — nathanbenaich · 2026-10-22

Safety channel →