OpenAI Model Uncovers Critical PHP Vulnerabilities

Episode 1 · PHP's php2shell: Two Unauthenticated RCE Flaws Found with Help from OpenAI Models (2026-10-21, 49 posts)

PHP shipped an emergency security update on October 21 at 14:00 UTC, patching two critical vulnerabilities allowing unauthenticated remote code execution (RCE)—CVE-2026-109618 and CVE-2026-109619 (codenamed php2shell)—in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. All PHP deployments handling web requests are affected. OpenAI announced its models played a key role in the discovery and launched the "Patch the Planet" global cybersecurity initiative; the FBI, NSA, and other agencies also issued emergency alerts. Since PHP powers roughly 70% of websites worldwide, this is regarded as one of the largest-impact open source security incidents in recent years.Confirmed

• PHP's official security advisory confirms the two vulnerabilities allow unauthenticated RCE, affecting all web-serving deployments including PHP-FPM, modphp, php-cgi, FrankenPHP, and LiteSpeed; modphp carries the highest risk, with a demonstrated exploit triggerable by an unauthenticated request before application code runs (m2, m13).
• Both are rated CVSSv4 9.2; security researcher cyb3rops revealed one is a core RCE flaw scoring a perfect CVSS 10.0 (m11, m20).
• The vulnerabilities were found and disclosed collaboratively by Calif.io, OpenAI, Wiz, and Quarkslab; OpenAI says researchers in its "Patch the Planet" program made the discovery using OpenAI models, and over the past two months led a coalition of maintainers and security vendors to prepare the fix (m1, m16, m18, m19).
• The flaws lie in PHP itself, not plugins—plugin developers cannot fix them, and sites like WordPress must upgrade PHP directly (m6).
• The FBI published both CVE numbers and advised organizations unable to upgrade immediately to take systems offline; the NSA also issued an immediately effective emergency recommendation to update or take systems offline until fully mitigated (m12, m14).
• Cloudflare has urgently shipped WAF rules as a temporary mitigation (m15).
• The joint write-up mentioned in m16 uses a "journey through time" narrative tracing the root cause back through code evolution since 2004.Unconfirmed
• vxunderground calling the flaw "ultra mega" severity on par with Log4Shell is an analogy from some security researchers, not an official rating (m17).
• m11 states that older versions (pre-PHP 8) are expected to receive no patches, consistent with the advisory listing only four PHP 8.x fixed versions, but officials have not explicitly stated the plan for older versions.
• m4's mention of "AI-assisted attacks possibly arriving within 15 minutes" is a precautionary speculation from the Japanese security community; no real-world exploitation has been confirmed.Why it matters
• PHP powers about 70% of websites worldwide; the flaws are low-barrier and automatable, and because they sit in the language core rather than the plugin layer, the fix falls on server operators—WordPress site owners were urged to stand by overnight to patch.
• This is a landmark case of AI models systematically participating in vulnerability hunting for critical open source infrastructure; OpenAI leveraged it to launch the "Patch the Planet" program, signaling the normalization of AI-driven security research.
• The rare simultaneous warnings from agencies in multiple countries (FBI, NSA) and Cloudflare's emergency WAF rules reflect the incident's potentially huge impact.

• CVSS 10.0 RCE vulnerability disclosed in PHP core, patches only for PHP 8 — cyb3rops · 2026-10-21
• CVSS 10.0 RCE in PHP core: critical patches land Oct 21, PHP 8 only — cyb3rops · 2026-10-21
• PHP core RCE rated CVSS 10.0 lands Oct 20; eBPF tool spots exploitation early — cyb3rops · 2026-10-21
• PHP pre-announces critical security release fixing two CVSS 9.2 vulnerabilities on Oct 21 — jedisct1 · 2026-10-21
• Two CVSS 9.2 Critical PHP Vulnerabilities Land Tomorrow; Laravel Scrambles to Patch — taylorotwell · 2026-10-21
• PHP remote control vulnerability hits back to PHP 5, agents poised to weaponize it fast — MarcJSchmidt · 2026-10-21
• Two critical PHP vulnerabilities prompt emergency patches due at midnight JST — itmedia_news · 2026-10-21
• PHP rushes emergency patches as info on two RCE flaws (rated up to CVSS 10) leaks early — DynamicWebPaige · 2026-10-21
• Two PHP CVEs incoming, warning that '70.2% of the internet' will be scrambling — JiliJeanlouis · 2026-10-21
• PHP to issue urgent fix for two CVSS 9.2 flaws amid RCE exploit concerns — _jaydeepkarale · 2026-10-21
• PHP ships emergency patches for two critical unauthenticated RCE vulnerabilities — cyber_forecast · 2026-10-21
• Critical PHP RCE Leaked Before Patch, Fueling Fears of Open-Source AI Regulation — basedjensen · 2026-10-21
• PHP hit by mega exploit dubbed php2shell; some say Log4J-level severity, PoC video features a dancing anime lady — basedjensen · 2026-10-21
• PHP pre-announces two CVSS 9.2 critical vulns as Cloudflare races to deploy WAF rules — mitsuhiko · 2026-10-21
• Critical PHP core RCE vulnerability rated CVSS 9.2, details delayed to Oct 21 — cyb3rops · 2026-10-21
• Two Critical PHP Core CVEs Scored 9.2 Get Emergency Patches Today, Feared Unauth RCE — Kyrannio · 2026-10-21
• Two CVSS 9.2 PHP 0-days expose unpatched sites, plus eMudhra cert flaw enables IoT impersonation — seanwbren · 2026-10-21
• PHP critical CVE scored 9.2 forces emergency patch: WordPress operators urged to prep before exploits hit — EthanJPerez · 2026-10-21
• Two CVSS 9.2 PHP flaws to be disclosed, affecting ~70% of the web — banteg · 2026-10-21
• PHP ships emergency patch for CVSS 9.2 flaw as AI-assisted exploits expected within 15 minutes — EthanJPerez · 2026-10-21

29 more related posts →

Episode 2 · Researchers Predict LLM Audits Will Uncover More PHP Vulnerabilities (2026-10-21, 3 posts)

Security researcher moyix predicts researchers will point LLMs at PHP codebases and uncover dozens of additional serious vulnerabilities beyond upcoming fixes, betting on an exploitable stack overflow in recursive abbreviation-handling code.

• Security Researcher Bets LLM Audits Will Find Dozens More PHP Vulnerabilities — moyix · 2026-10-21
• moyix Doubles Down: Bets on Exploitable Stack Overflow in PHP's Recursive Acronym Code — moyix · 2026-10-21
• Devs brace for LLM-driven PHP vuln hunting, point to WASM sandboxing as defense — MickeySteamboat · 2026-10-21

Episode 3 · PHP RCE proof-of-concept confirmed working, but not one-click (2026-10-21, 2 posts)

Security researchers confirmed the leaked PHP RCE proof-of-concept is genuine and usable, though exploitation requires certain preconditions. Combined with the vulnerability's high severity rating, the situation remains concerning.

• PHP RCE proof-of-concept confirmed working, exploitation not trivial but concerning — realmrfakename · 2026-10-21
• Researcher confirms PHP RCE proof-of-concept works, though not trivial to exploit — realmrfakename · 2026-10-21

Episode 4 · POC Released for Critical Pre-Auth RCE in PHP session.upload_progress (2026-10-21, 2 posts)

A researcher disclosed two critical pre-auth RCE flaws (CVSS 9.2) in PHP's session.uploadprogress handler via the php2shell project, and the POC has leaked early. Researchers warn mitigations alone may not suffice and urge exposed servers to patch promptly.

• php2shell POC Leaked Early: Mitigation Alone May Not Be Enough, Patch PHP Now — basedjensen · 2026-10-21
• php2shell: Critical PHP session.upload_progress pre-auth RCE bugs (CVSS 9.2) get public POCs — jedisct1 · 2026-10-21

Episode 5 · OpenAI Says PHP Vulnerability Finds Are Just the Beginning as Devs Joke Online (2026-10-21, 2 posts)

After OpenAI announced that GPT-5.6 (Sol) uncovered critical PHP vulnerabilities, the company said more discoveries are yet to come, while developers joked online about the 'PHP archaeologists' finally facing their reckoning.

• OpenAI says PHP flaws found with GPT-5.6 are just the tip of the iceberg — Dan_Jeffries1 · 2026-10-21
• Devs celebrate the 'PHP meltdown' as AI-found flaws expose legacy code archaeology — weskambale · 2026-10-21