# PHP2Shell: How AI Found Two Critical PHP Flaws

> Two critical PHP flaws (CVSS 9.2) fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, found with frontier AI. What broke and what to update.

- Author: Nitish Garg, Founder & CEO, CellCog
- Published: 2026-10-21
- Canonical (HTML): https://cellcog.ai/blog/php2shell-openai-patch-the-planet/
- Section: Guides / Trust, permissions & security
- Publisher: CellCog (https://cellcog.ai), the AI employee platform. Blog index for agents: https://cellcog.ai/blog/llms.txt

## Key points

- PHP fixed two critical flaws, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS v4.0, that can allow unauthenticated remote code execution.
- The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, published October 21, 2026; PHP says updating is the only complete fix.
- OpenAI says Calif found one flaw with GPT-5.6 Sol, and Wiz independently found and reported both using Gemini 4 Argon and GPT-5.6 Sol.
- Wiz found the first bug on August 19 and reported it on August 24; the fix took two months of coordination before release.
- OpenAI committed $1 billion in subsidized Daybreak access for defenders and expects similar findings to increase sharply in the coming months.

## At a glance

- **What happened?** PHP released four security updates on October 21, 2026 for two critical flaws in the PHP engine that frontier AI helped find.
- **Who is at risk?** PHP says all installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php at highest risk.
- **What should I do?** Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or get a backport from your distributor for older branches.

**PHP shipped four security releases on October 21, 2026, fixing two critical flaws that can let an attacker run code on a web server without logging in.** OpenAI says researchers at Calif found one of them with GPT-5.6 Sol under its Patch the Planet program, and that Wiz independently found and reported both. PHP's own advisory is blunt: "All PHP users are strongly encouraged to update immediately."

This page reads OpenAI's [disclosure post](https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/), PHP's [security advisory and release notes](https://www.php.net/archive/2026.php), the two GitHub advisories ([CVE-2026-109618](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w), [CVE-2026-109619](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)) and [Wiz's research write-up](https://www.wiz.io/blog/php2shell-php-rce).

## What to update

*Table: Fixed PHP releases for both CVEs, October 21, 2026*

| Branch | Vulnerable | Fixed release |
|---|---|---|
| PHP 8.5 | before 8.5.12 | 8.5.12 |
| PHP 8.4 | before 8.4.27 | 8.4.27 |
| PHP 8.3 | before 8.3.36 | 8.3.36 |
| PHP 8.2 | before 8.2.35 | 8.2.35 |

Both flaws score 9.2 on CVSS v4.0 in PHP's advisories. PHP lists PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed as at risk. "We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs." And on workarounds: "There are no complete mitigations, updating is the only safe choice."

Older branches matter too. Wiz says every PHP version released in the last decade is affected by at least one of the bugs, going back to PHP 5.4. Those branches get no fix from PHP itself, so the path is a distributor's backport or an upgrade. OpenAI names Wiz and Cloudflare among the partners that prepared protections ahead of disclosure, and it published a PHP version checker.

## What actually broke

Both bugs come from how PHP handles a fatal error in the middle of a request, most often running out of memory.

- **CVE-2026-109618, RCE via OOM corruption.** PHP aborts on an out-of-memory error by jumping out of the current context. If that happens while request memory is reachable but not yet initialized, shutdown later reads invalid state. The advisory lists multipart upload tricks that reach the memory limit while staying inside PHP's size limits, and Apache mod_php runs that shutdown even when startup failed, before any application code.
- **CVE-2026-109619, RCE via stale global state.** A worker keeps global pointers into memory owned by one request. If the request is cut short, the memory is freed but the pointer stays, and the next request on the same worker reads it before setup resets it: a use after free.

Wiz demonstrated pre-authentication code execution on WordPress, Drupal and Joomla, plus remote disclosure of worker memory that can hold passwords, tokens and API keys. The targets were examples; the bug lives in PHP, not in the apps.

![Animation: request A fills a PHP worker's memory, an out-of-memory error frees it while a pointer in worker globals stays, request B follows the stale pointer and code runs, then the patch resets the pointer first](https://cellcog.ai/blog/media/php2shell-openai-patch-the-planet/php-stale-state.svg)
*One request dies out of memory; the next request on that worker reads its stale pointer*

## Two months between an AI find and a fix

That gap is what OpenAI calls the Defender's Window: "To our knowledge, frontier AI found these vulnerabilities before attackers did." Wiz is specific about the models. It used Gemini 4 Argon and GPT-5.6 Sol throughout, and says Gemini 4 Argon contributed to finding the bug, building exploits, detecting attacks and validating the patch.

![Animation: a timeline from Aug 19, found with AI, to Oct 21, four fixed releases; a teal band labelled defender's window spans the gap and Oct 21 turns amber, labelled public](https://cellcog.ai/blog/media/php2shell-openai-patch-the-planet/php-defender-window.svg)
*AI found the bug on August 19; the public fix shipped on October 21*

The window narrowed at the end. PHP's October 20 notice scheduled the release for 14:00 UTC the next day and reserved the right to release earlier "should details of either vulnerability become public". Security firm [Huntress reported](https://www.huntress.com/blog/php2shell-leaked-critical-php-vulnerabilities) that details had leaked ahead of the planned disclosure. The Dutch national cyber center [NCSC-NL](https://github.com/NCSC-NL/php2shell) tells operators to update and to watch for public exploit activity.

## What OpenAI is proposing

OpenAI used the disclosure to lay out a response process for AI-found bugs in widely used software.

- **Money and access.** $1 billion in subsidized Daybreak access through Daybreak for Frontline Defenders, aimed at organizations with limited security resources.
- **Tools.** The PHP version checker now, and a Codex skill to help operators find vulnerable versions, coming.
- **Process.** Five stages: fix upstream with adversarial testing by frontier models, give affected organizations time, involve government partners, prepare downstream updates, then publish guidance. For PHP it engaged the White House's Super Intelligence Force, the Office of the National Cyber Director and CISA.
- **A forecast.** "We expect similar findings to increase sharply in the coming months."

It also asks an open question many operators will dislike: whether governments should ever use a vulnerability to patch systems they manage "after losing administrative access".

## What it means for teams running PHP

Check the PHP version on every server you own, including shared hosting and old side projects, and update or ask your host which release you are on. For agencies and small teams, the harder part is the inventory: a forgotten WordPress install on PHP 7 has no fix from PHP.

The bigger signal is the pace. Two frontier labs' models are credited on one internet-scale bug, and OpenAI says more are already in the queue.

## What to watch

- Reports of exploitation in the wild, and whether CISA adds either CVE to its Known Exploited Vulnerabilities catalog.
- OpenAI's Codex skill for PHP version checks.
- Backports from Linux distributions and hosts for PHP 8.1 and older.

## FAQ

**What is PHP2Shell?**

PHP2Shell is the name Wiz gave two critical PHP engine flaws, CVE-2026-109618 and CVE-2026-109619, that can let an attacker run code on a server without logging in.

**Which PHP versions fix PHP2Shell?**

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, all released October 21, 2026. Every earlier release on those branches is affected.

**Which AI models found the PHP vulnerabilities?**

OpenAI says Calif found one flaw with GPT-5.6 Sol. Wiz says it used Gemini 4 Argon and GPT-5.6 Sol to find the bugs, build exploits and validate the patch.

**Is there a workaround if I cannot update PHP?**

PHP says there are no complete mitigations and updating is the only safe choice. Security vendors shipped interim protections, such as firewall rules, for teams that need time.

**Can an AI employee keep my servers patched?**

A CellCog AI software engineer can check which PHP version each server runs, prepare and test the upgrade, and leave every deploy for your approval.

## Related

- [Anthropic Cyber Mission: OSS Scanner and Grid Defense](https://cellcog.ai/blog/anthropic-cyber-mission/index.md)
- [Claude Solves the NIST Curve Seed Mystery: It Was Timestamps](https://cellcog.ai/blog/claude-ecdsa-curve-seeds/index.md)
- [406 Scientists Want Cyber-Capable AI Air-Gapped](https://cellcog.ai/blog/ai-security-open-letter/index.md)

## The AI employee for this read

[AI Software Engineer](https://cellcog.ai/ai-employees/ai-software-engineer): I built this page. For what it covers, hire an engineer: it works in your repo behind an approval gate, so nothing reaches your world unclassified.

---

Markdown alternate of https://cellcog.ai/blog/php2shell-openai-patch-the-planet/. Try CellCog free, no credit card needed: https://cellcog.ai/signup