SafetyRisk, alignment & guardrails
PHP ships emergency fixes for AI-found PHP2Shell flaws as OpenAI outlines its Patch the Planet disclosure process
AI-assisted researchers found two critical PHP flaws, dubbed PHP2Shell, that leaked a day early and drew attack attempts before fixes shipped. OpenAI's Patch the Planet program describes how such AI-found bugs should be validated, patched and disclosed in coordinated stages.
From the OpenAI News article of October 21, 2026 and cited sources: PHP2Shell is two use-after-free bugs in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. [2] [3] [9] [13]
SOURCES[2] Sansec: PHP2Shell sansec.io[3] BleepingComputer bleepingcomputer.com[9] The Hacker News thehackernews.com
AT Pulse research deskPublished · Updated · 4 min read · AI-assisted analysisAI-assisted, not human-edited. Methodology Corrections Who owns this site
- What happened
- PHP2Shell is two use-after-free bugs in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. [2] [3] [9] [13]
- Original source
- OpenAI News article, company source
- Brief by
- AT Pulse research desk AI-assisted; publisher and contact on the desk page
- When
- October 21, 2026 article published
- Covered
- Oct 22 edition
- Evidence
- 14 sources across 13 sites
StrongHow it’s measured
Hacker News · 259 likes · 177 comments
Reach blends public engagement (views, likes, comments, shares, stars) from the platforms where the story or its original source lives: YouTube, Hacker News, GitHub, Substack and similar. A video and the article written from its transcript share one score, taken from the video. Platforms with no data are left out rather than counted as zero, and the age of a story never lowers its score.
PHP2Shell is two use-after-free bugs in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. A fatal error such as hitting memory_limit stops native code before it frees memory, and multipart form requests trigger it. One bug can leak secrets through the session cookie. The other enables remote code execution through OPcache type confusion. Details leaked on 20 October, and PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October. [2] [3] [9] [13]
Patch the Planet, run by OpenAI with Trail of Bits, has AI models do the vulnerability research and human experts validate the findings before they reach open-source maintainers. HackerOne handles intake. According to Safeguard's summary, OpenAI's coordination process has stages: fix upstream, give affected organizations time to prepare, brief governments, align updates across products, then publish guidance. There are no fixed embargo periods. [1] [4] [5] [11] [12]
Finding serious bugs is getting cheaper than fixing them. pwn.ai reports it found a CVSS 9.3 Linux KVM guest-to-host escape in three days for under $700 in API costs. The program's own dashboard, which has not been independently audited, lists 1,995 issues found and 466 patches merged upstream, with 1,316 issues still waiting for a fix. [7] [8] [11]
AI models helped find critical bugs in PHP and the Linux KVM hypervisor quickly and cheaply, and the program has a large backlog of unfixed issues.
Read the full assessment
Implication: discovery is outpacing fixes, so maintainer capacity and how fast downstream users patch become the bottleneck, not detection.
Sources are gathered; writing the dossier now.
Executive brief
AI-assisted researchers found two critical remote-code-execution flaws in PHP's own runtime, collectively called "PHP2Shell". Details leaked a day before the planned disclosure, and attack attempts were reported hours before PHP published fixes on 21 October 2026 (Sansec; BleepingComputer). OpenAI's same-day post describes how its "Patch the Planet" program coordinates disclosure when AI agents find serious bugs. That post was reviewed here only through a feed excerpt and secondary summaries. The PHP case shows the tension in this approach: AI speeds up discovery, but the disclosure process can still break at the human and information-control layer.
What changed and event timeline
Patch the Planet launches
OpenAI and Trail of Bits announced a Daybreak program in which AI does the security research and human experts review findings for open-source maintainers. HackerOne and Calif are launch partners (;).
First PHP bug found
Sansec dates the initial discovery to 1 August. Other coverage says Calif first identified the issue in July, with help from an OpenAI model (;).
PwnEscape disclosed
Pwn.ai disclosed CVE-2026-99999, a Linux KVM guest-to-host escape rated CVSS 9.3. Researchers say they found it in three days using GPT-5.6 Sol for under $700 in API calls (;).
PHP2Shell details leak
Details appeared on Hacker News ahead of the planned 22 October disclosure ().
Patches ship; OpenAI publishes its coordination post
Cloudflare deployed WAF rules at 03:02 UTC. PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 at 14:00 UTC (;).
Capabilities and access
- Models: Trail of Bits names GPT-5.5-Cyber and GPT-5.6-Cyber (Trail of Bits). Calif reportedly used "GPT-5.6 Sol" to find PHP2Shell (Safeguard). The Hacker News credits OpenAI's Codex Security team (The Hacker News).
- What maintainers get: one week of Trail of Bits engineering, six months of ChatGPT Pro, conditional access to Codex Security, and intake through HackerOne's platform (Blockchain.News).
Technical analysis for researchers and developers
- Root cause: both PHP flaws are use-after-free bugs. All known triggers use multipart/form-data requests (Sansec).
- CVE-2026-109618: the upload-progress handler can return freed worker memory inside the PHPSESSID cookie.
- CVE-2026-109619: a backtrace use-after-free combined with OPcache type confusion gives remote code execution on its own (Sansec).
Read the full section
- Root cause: both PHP flaws are use-after-free bugs. A fatal error, usually from hitting
memory_limit, interrupts native code before it cleans up memory. All known triggers use multipart/form-data requests (Sansec). - CVE-2026-109618: the upload-progress handler can return freed worker memory inside the PHPSESSID cookie. That can leak secrets even on sites that never call
session_start()(Sansec). - CVE-2026-109619: a backtrace use-after-free combined with OPcache type confusion gives remote code execution on its own (Sansec).
- Affected setups: mod_php carries the highest risk; PHP-FPM, php-cgi, FrankenPHP and LiteSpeed are also affected (BleepingComputer).
- Defence: Cloudflare pairs request rules with response-side "full transaction" detection to spot successful exploits (Cloudflare).
Claims and evidence
- Program numbers: the dashboard shows 68 codebases, 1,995 issues, 679 patches written and 466 merged upstream.
- OpenAI's five-stage framework: validate and fix upstream, give affected organizations preparation time, coordinate with governments, prepare cross-product updates, then publish guidance.
- Severity: CVSS 9.2 for both CVEs, confirmed across several outlets (SOCRadar).
Read the full section
- Program numbers: the dashboard shows 68 codebases, 1,995 issues, 679 patches written and 466 merged upstream. These figures are program-reported and not audited (Trail of Bits; Blockchain.News).
- OpenAI's five-stage framework: validate and fix upstream, give affected organizations preparation time, coordinate with governments, prepare cross-product updates, then publish guidance. There are no fixed embargoes. This is known only through Safeguard's summary (Safeguard).
- Severity: CVSS 9.2 for both CVEs, confirmed across several outlets (SOCRadar).
- AI speed-up: one researcher reportedly did in a week what would normally take a team months. This is anecdotal (The Hacker News).
Context and prior work
- cURL's Daniel Stenberg had publicly criticized the "avalanche" of AI-generated bug reports, yet cURL joined the program.
- Earlier field reports describe Linux pointer-leak proofs of concept, privilege-escalation exploits, Safari bugs, and dnsmasq CVEs flagged before their public fix (Tech Insider).
- Cloudflare also credits Quarkslab on PHP2Shell (Cloudflare).
Read the full section
- cURL's Daniel Stenberg had publicly criticized the "avalanche" of AI-generated bug reports, yet cURL joined the program. Its pitch is human-validated findings rather than raw AI output (Techzine).
- Earlier field reports describe Linux pointer-leak proofs of concept, privilege-escalation exploits, Safari bugs, and dnsmasq CVEs flagged before their public fix (Tech Insider).
- Cloudflare also credits Quarkslab on PHP2Shell (Cloudflare).
Limitations, safety and contested findings
- How exploitable is it? Sansec says exploitation requires specific server conditions, so mass exploitation is unlikely (Sansec).
- Exploitation timing: Sansec dates Cloudflare's first reported attacks to 07:43 UTC, while The Hacker News cites watchTowr reports at 14:19 UTC (Sansec; The Hacker News).
- Version checks can mislead: distribution backports may not change version strings.
Read the full section
- How exploitable is it? Sansec says exploitation requires specific server conditions, so mass exploitation is unlikely (Sansec). Cloudflare reports active attack attempts and payloads being changed to evade its rules (Cloudflare).
- Exploitation timing: Sansec dates Cloudflare's first reported attacks to 07:43 UTC, while The Hacker News cites watchTowr reports at 14:19 UTC (Sansec; The Hacker News).
- Version checks can mislead: distribution backports may not change version strings. OpenAI's checker warns that "UNKNOWN" does not mean patched, and one volunteer RPM repository had no day-one update (Safeguard).
- Backlog: 1,316 issues are still waiting for a patch (Trail of Bits).
- Earlier criticism: some AI tools produce false positives or simply rediscover known CVEs (Techzine).
Business and practitioner implications
- A PHP core developer says upgrading is the only mitigation. PHP 8.1 and older get no official fixes (The Hacker News; BleepingComputer).
- Expect little warning downstream. Most organizations only see the final public-guidance stage, so they need to be able to respond within hours (Safeguard).
- At under $700 and three days for a KVM escape, critical bugs can now be found at low cost, so maintainers' capacity to fix them becomes the limiting factor (Cybernews).
Read the full section
- Patch PHP now. A PHP core developer says upgrading is the only mitigation. PHP 8.1 and older get no official fixes (The Hacker News; BleepingComputer).
- Expect little warning downstream. Most organizations only see the final public-guidance stage, so they need to be able to respond within hours (Safeguard).
- Plan for cheaper bug discovery. At under $700 and three days for a KVM escape, critical bugs can now be found at low cost, so maintainers' capacity to fix them becomes the limiting factor (Cybernews).
- WAFs help, but only as a stopgap (Cloudflare).