PHP2Shell: How AI Found Two Critical PHP Flaws

§ 01What to update#

Both flaws score 9.2 on CVSS v4.0 in PHP’s advisories. PHP lists PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed as at risk. “We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.” And on workarounds: “There are no complete mitigations, updating is the only safe choice.”

Older branches matter too. Wiz says every PHP version released in the last decade is affected by at least one of the bugs, going back to PHP 5.4. Those branches get no fix from PHP itself, so the path is a distributor’s backport or an upgrade. OpenAI names Wiz and Cloudflare among the partners that prepared protections ahead of disclosure, and it published a PHP version checker.

§ 02What actually broke#

Both bugs come from how PHP handles a fatal error in the middle of a request, most often running out of memory.

• CVE-2026-109618, RCE via OOM corruption. PHP aborts on an out-of-memory error by jumping out of the current context. If that happens while request memory is reachable but not yet initialized, shutdown later reads invalid state. The advisory lists multipart upload tricks that reach the memory limit while staying inside PHP’s size limits, and Apache mod_php runs that shutdown even when startup failed, before any application code.
• CVE-2026-109619, RCE via stale global state. A worker keeps global pointers into memory owned by one request. If the request is cut short, the memory is freed but the pointer stays, and the next request on the same worker reads it before setup resets it: a use after free.

Wiz demonstrated pre-authentication code execution on WordPress, Drupal and Joomla, plus remote disclosure of worker memory that can hold passwords, tokens and API keys. The targets were examples; the bug lives in PHP, not in the apps.

§ 03Two months between an AI find and a fix#

That gap is what OpenAI calls the Defender’s Window: “To our knowledge, frontier AI found these vulnerabilities before attackers did.” Wiz is specific about the models. It used Gemini 4 Argon and GPT-5.6 Sol throughout, and says Gemini 4 Argon contributed to finding the bug, building exploits, detecting attacks and validating the patch.

The window narrowed at the end. PHP’s October 20 notice scheduled the release for 14:00 UTC the next day and reserved the right to release earlier “should details of either vulnerability become public”. Security firm Huntress reported that details had leaked ahead of the planned disclosure. The Dutch national cyber center NCSC-NL tells operators to update and to watch for public exploit activity.

§ 04What OpenAI is proposing#

OpenAI used the disclosure to lay out a response process for AI-found bugs in widely used software.

• Money and access. $1 billion in subsidized Daybreak access through Daybreak for Frontline Defenders, aimed at organizations with limited security resources.
• Tools. The PHP version checker now, and a Codex skill to help operators find vulnerable versions, coming.
• Process. Five stages: fix upstream with adversarial testing by frontier models, give affected organizations time, involve government partners, prepare downstream updates, then publish guidance. For PHP it engaged the White House’s Super Intelligence Force, the Office of the National Cyber Director and CISA.
• A forecast. “We expect similar findings to increase sharply in the coming months.”

It also asks an open question many operators will dislike: whether governments should ever use a vulnerability to patch systems they manage “after losing administrative access”.

§ 05What it means for teams running PHP#

Check the PHP version on every server you own, including shared hosting and old side projects, and update or ask your host which release you are on. For agencies and small teams, the harder part is the inventory: a forgotten WordPress install on PHP 7 has no fix from PHP.

The bigger signal is the pace. Two frontier labs’ models are credited on one internet-scale bug, and OpenAI says more are already in the queue.

§ 06What to watch#

• Reports of exploitation in the wild, and whether CISA adds either CVE to its Known Exploited Vulnerabilities catalog.
• OpenAI’s Codex skill for PHP version checks.
• Backports from Linux distributions and hosts for PHP 8.1 and older.