PHP's Emergency RCE Fixes: From AI Discovery to Incomplete Patch

Episode 1 · PHP Rushes Fixes for Two Unauthenticated RCE Flaws, Discovered with Help of OpenAI Models (2026-10-21, 64 posts)

PHP issued a security advisory on October 21 disclosing two critical vulnerabilities enabling unauthenticated remote code execution (RCE) (CVE-2026-109618 and CVE-2026-109619, CVSS v4 score 9.2), with emergency fixes shipped in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. OpenAI announced that models from its "Patch the Planet" initiative helped researchers discover the flaws; the FBI and NSA both issued urgent advisories, recommending that organizations unable to upgrade immediately take their systems offline.

Confirmed

• PHP's official advisory confirms the two critical flaws allow unauthenticated RCE, affecting all deployments that handle web requests (PHP-FPM, modphp, php-cgi, FrankenPHP, LiteSpeed), with modphp at highest risk—Daniel Lockyer noted a demo exploit can be triggered by an unauthenticated request before application code runs
• Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; patches were released late on October 21 Japan time (UTC 14:00), after officials gave advance notice and urged users to prepare for upgrades
• OpenAI announced that researchers in its "Patch the Planet" initiative used its models to find the vulnerabilities, and over the past two months led coordination between maintainers and security vendors; Wiz participated in the joint discovery (technical php2shell analysis shared by moyix)
• Cloudflare urgently deployed WAF rules as temporary mitigation; Laravel creator Taylor Otwell said Laravel is urgently adapting patches across the board
• The FBI listed both CVE identifiers and advised organizations that cannot upgrade immediately to take systems offline first; the NSA issued an emergency advisory urging immediate patching or shutdown
• Multiple parties warned attackers may weaponize the flaws quickly post-disclosure: one security account predicted AI-assisted automated attacks within 15 minutes of patch release; the flaws reside in the PHP engine itself so plugin developers cannot fix them, and WordPress site owners were urged to stand by overnight to patch

Unconfirmed

• cyb3rops previously claimed a CVSS 10.0 maximum-severity RCE with patches only for PHP 8 series and no fixes for older versions, contradicting the official four-version fix scope and not directly corroborated by the official advisory
• vxunderground claimed the flaw (php2shell) is on par in severity with Log4Shell—this is an individual researcher's assessment
• Which OpenAI model was used (Kyrannio's repost claimed GPT-5.6) has not been confirmed in OpenAI's official posts

Why it matters

• PHP powers roughly 70% (some say 80%) of websites worldwide, with major ecosystems like WordPress built on it, giving the flaws an enormous attack surface
• This is a landmark case of AI models systematically participating in discovering and fixing critical open-source vulnerabilities; OpenAI is using it to launch its "Patch the Planet" global cybersecurity initiative, aiming to continuously find and patch open-source flaws with AI

• CVSS 10.0 RCE vulnerability disclosed in PHP core, patches only for PHP 8 — cyb3rops · 2026-10-21
• CVSS 10.0 RCE in PHP core: critical patches land Oct 21, PHP 8 only — cyb3rops · 2026-10-21
• PHP core RCE rated CVSS 10.0 lands Oct 20; eBPF tool spots exploitation early — cyb3rops · 2026-10-21
• PHP pre-announces critical security release fixing two CVSS 9.2 vulnerabilities on Oct 21 — jedisct1 · 2026-10-21
• Two CVSS 9.2 Critical PHP Vulnerabilities Land Tomorrow; Laravel Scrambles to Patch — taylorotwell · 2026-10-21
• PHP remote control vulnerability hits back to PHP 5, agents poised to weaponize it fast — MarcJSchmidt · 2026-10-21
• Two critical PHP vulnerabilities prompt emergency patches due at midnight JST — itmedia_news · 2026-10-21
• PHP rushes emergency patches as info on two RCE flaws (rated up to CVSS 10) leaks early — DynamicWebPaige · 2026-10-21
• Two PHP CVEs incoming, warning that '70.2% of the internet' will be scrambling — JiliJeanlouis · 2026-10-21
• PHP to issue urgent fix for two CVSS 9.2 flaws amid RCE exploit concerns — _jaydeepkarale · 2026-10-21
• PHP ships emergency patches for two critical unauthenticated RCE vulnerabilities — cyber_forecast · 2026-10-21
• Critical PHP RCE Leaked Before Patch, Fueling Fears of Open-Source AI Regulation — basedjensen · 2026-10-21
• PHP hit by mega exploit dubbed php2shell; some say Log4J-level severity, PoC video features a dancing anime lady — basedjensen · 2026-10-21
• PHP pre-announces two CVSS 9.2 critical vulns as Cloudflare races to deploy WAF rules — mitsuhiko · 2026-10-21
• Critical PHP core RCE vulnerability rated CVSS 9.2, details delayed to Oct 21 — cyb3rops · 2026-10-21
• Two Critical PHP Core CVEs Scored 9.2 Get Emergency Patches Today, Feared Unauth RCE — Kyrannio · 2026-10-21
• Two CVSS 9.2 PHP 0-days expose unpatched sites, plus eMudhra cert flaw enables IoT impersonation — seanwbren · 2026-10-21
• PHP critical CVE scored 9.2 forces emergency patch: WordPress operators urged to prep before exploits hit — EthanJPerez · 2026-10-21
• Two CVSS 9.2 PHP flaws to be disclosed, affecting ~70% of the web — banteg · 2026-10-21
• PHP ships emergency patch for CVSS 9.2 flaw as AI-assisted exploits expected within 15 minutes — EthanJPerez · 2026-10-21

44 more related posts →

Episode 2 · Researchers Predict LLM Audits Will Uncover More PHP Vulnerabilities (2026-10-21, 3 posts)

Security researcher moyix predicts researchers will point LLMs at PHP codebases and uncover dozens of additional serious vulnerabilities beyond upcoming fixes, betting on an exploitable stack overflow in recursive abbreviation-handling code.

• Security Researcher Bets LLM Audits Will Find Dozens More PHP Vulnerabilities — moyix · 2026-10-21
• moyix Doubles Down: Bets on Exploitable Stack Overflow in PHP's Recursive Acronym Code — moyix · 2026-10-21
• Devs brace for LLM-driven PHP vuln hunting, point to WASM sandboxing as defense — MickeySteamboat · 2026-10-21

Episode 3 · PHP RCE proof-of-concept confirmed working, but not one-click (2026-10-21, 2 posts)

Security researchers confirmed the leaked PHP RCE proof-of-concept is genuine and usable, though exploitation requires certain preconditions. Combined with the vulnerability's high severity rating, the situation remains concerning.

• PHP RCE proof-of-concept confirmed working, exploitation not trivial but concerning — realmrfakename · 2026-10-21
• Researcher confirms PHP RCE proof-of-concept works, though not trivial to exploit — realmrfakename · 2026-10-21

Episode 4 · POC Released for Critical Pre-Auth RCE in PHP session.upload_progress (2026-10-21, 2 posts)

A researcher disclosed two critical pre-auth RCE flaws (CVSS 9.2) in PHP's session.uploadprogress handler via the php2shell project, and the POC has leaked early. Researchers warn mitigations alone may not suffice and urge exposed servers to patch promptly.

• php2shell POC Leaked Early: Mitigation Alone May Not Be Enough, Patch PHP Now — basedjensen · 2026-10-21
• php2shell: Critical PHP session.upload_progress pre-auth RCE bugs (CVSS 9.2) get public POCs — jedisct1 · 2026-10-21

Episode 5 · PHP 8.5.12 Patch Incomplete: php2shell Double-Free Still Exploitable (2026-10-22, 2 posts)

Security researchers report that PHP 8.5.12's October security fix for the php2shell double-free vulnerability is incomplete, with at least three exploitation paths confirmed still working on the patched release.

• PHP 8.5.12 security patch incomplete: three exploit paths survive, lab-confirmed — jedisct1 · 2026-10-22
• PHP 8.5.12 may still be vulnerable to php2shell, researchers report — basedjensen · 2026-10-22