SafetyRisk, alignment & guardrails
PHP2Shell: AI-assisted teams at Calif/OpenAI and Wiz find remote-code-execution flaws in PHP core, and patches ship after a leaked disclosure
Two use-after-free flaws in PHP's core engine, called PHP2Shell, let attackers run code on servers without logging in. Affected versions go back to PHP 5.4. AI-assisted teams at Calif/OpenAI and Wiz found them separately, and fixes shipped October 21 after a leaky disclosure.
From the TechCrunch AI article of October 21, 2026 and cited sources: Both bugs are use-after-free flaws. [9] [8] [14]
SOURCES[9] PHP Foundation thephp.foundation[8] Wiz: PHP2Shell wiz.io[14] Sansec sansec.io
AT Pulse research deskPublished · Updated · 4 min read · AI-assisted analysisAI-assisted, not human-edited. Methodology Corrections Who owns this site
- Original source
- TechCrunch AI article, independent perspective
- Brief by
- AT Pulse research desk AI-assisted; publisher and contact on the desk page
- When
- October 21, 2026 article published
- Covered
- Oct 22 edition
- Evidence
- 15 sources across 14 sites
- 1TechCrunchtechcrunch.com
- 2Simon Willisonsimonwillison.net
- 3PHP2Shell: AI Found a Hole in 70% of Sitesreddit.com
- 4AI Found the PHP2Shell Vulnerability in 70% of Sites in…reddit.com
- 5AI Just Found a Bug That Puts up to 70% of the World’s…wsj.com
- 6Critical web security flaws spark global alarm as Google…cnbc.com
Reach: not measured yet
Both bugs are use-after-free flaws. The trigger is a fatal error, usually running out of memory, that stops native code before it cleans up, so a later request can reuse state left by an earlier one. Every documented trigger is a multipart/form-data request, and Apache mod_php and PHP-FPM are both affected. Fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older get no fix. [9] [8] [14]
The bugs were found independently. A Calif researcher and OpenAI Codex Security both reported the first one in August. Wiz found more ways in using its Atlas agent, Gemini 4 Argon and GPT-5.6 Sol, and showed unauthenticated code execution against Drupal and WordPress. Wiz says AI cut exploit development to about a week; only Wiz reports that figure. [9] [8] [1]
The embargo broke before the fix shipped. CVE IDs leaked with a wrong severity score of 10.0 (the actual score is 9.2), Calif posted and then deleted a proof-of-concept video, and Chainguard released patched images early. Several governments briefly took services offline, and the NSA and CISA urged immediate patching. [2] [9] [12] [10]
Sources disagree on whether the flaws are being exploited. Patchstack and Cloudflare reported attacks, but Patchstack's own early data showed only probing. Amazon reportedly called the flaws broadly exploited. Sansec judges mass exploitation unlikely because attackers need to know the target's setup and the public exploits fail on default installs. [11] [7] [14] [1]
two teams using frontier models found long-lived PHP core bugs within weeks of each other, and attack reports surfaced before patches shipped.
Read the full assessment
Implication: the time between disclosure and exploitation is shrinking, so teams should plan for leaks, same-day upgrades and restarting PHP workers.
Research is done; writing the dossier now.
Executive brief
Two use-after-free bugs in PHP's core engine, nicknamed PHP2Shell, let attackers run their own code on a server without logging in. PHP runs about 70% of websites. AI-assisted researchers at Calif/OpenAI and at Wiz found the bugs independently. The flaws reach back to PHP 5.4, and Wiz says one researcher built working exploits in about a week. The coordinated disclosure leaked early, and attack reports appeared before the patches shipped on October 21, 2026 (Wiz; PHP Foundation). The NSA reportedly advised taking unpatched systems offline (India TV).
What changed and event timeline
First report
A Calif researcher and OpenAI Codex Security each reported the out-of-memory corruption bug to PHP ().
Wiz finds more ways in
Wiz found a PHP flaw using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol. It confirmed unauthenticated code execution against Drupal and WordPress, then reported to PHP on Aug 24 ().
Leak
At about 15:00 UTC the CVE IDs began circulating with a wrong CVSS score of 10.0. PHP published its pre-announcement at 19:30 UTC. Calif then posted a proof-of-concept video by mistake and later deleted it ().
Patches and attacks
Chainguard shipped patched images at 07:41 UTC, ahead of the embargo (). Patchstack and Cloudflare reported attacks. PHP released fixes at 13:52 UTC ().
Governments respond
The Netherlands, Finland, France and Australia took some government services offline temporarily. The NSA and CISA urged immediate patching ().
Capabilities and access
- Models and tools named: GPT-5.6 Sol, used by Calif inside OpenAI's "Patch the Planet" program (TechCrunch).
- Patch the Planet: reportedly announced June 22, 2026 and co-led with Trail of Bits, HackerOne and Calif (AI Weekly).
- Fixed PHP versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive support.
Read the full section
- Models and tools named: GPT-5.6 Sol, used by Calif inside OpenAI's "Patch the Planet" program (TechCrunch). Wiz used its Atlas agent, Gemini 4 Argon and GPT-5.6 Sol (Wiz).
- Patch the Planet: reportedly announced June 22, 2026 and co-led with Trail of Bits, HackerOne and Calif (AI Weekly).
- Fixed PHP versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer receive support.
Technical analysis for researchers and developers
- Root cause: a fatal error, usually out-of-memory when a request goes over
memory_limit, stops native code before it cleans up. - The two CVEs:
- CVE-2026-109618: a use-after-free in the session upload-progress unserializer. It can leak freed worker memory through the
PHPSESSIDcookie (Sansec).
Read the full section
- Root cause: a fatal error, usually out-of-memory when a request goes over
memory_limit, stops native code before it cleans up. Memory or global state from one request can then be reused by a later one (PHP Foundation). - The two CVEs:
- CVE-2026-109618: a use-after-free in the session upload-progress unserializer. It can leak freed worker memory through the
PHPSESSIDcookie (Sansec). - CVE-2026-109619: a use-after-free in fatal-error backtraces, plus an OPcache type confusion (Wiz).
- Trigger: every documented trigger is a
multipart/form-datarequest (the browser file-upload format). Apache mod_php and PHP-FPM are affected equally (Sansec). - Interim mitigations (incomplete):
- set
session.upload_progress.enabled=0 - lower
post_max_size - on PHP 8.5, set
fatal_error_backtraces=0 - restart PHP workers (Patchstack)
Claims and evidence
- Severity: CVSS 9.2, not the 10.0 that leaked (Simon Willison).
- AI's role: Wiz says AI helped with discovery, adapting exploits across versions, and building detection. These are vendor claims; no independent replication was found.
- Exploit timing: "about a week instead of months" comes only from Wiz (Wiz).
Read the full section
- Severity: CVSS 9.2, not the 10.0 that leaked (Simon Willison).
- AI's role: Wiz says AI helped with discovery, adapting exploits across versions, and building detection. These are vendor claims; no independent replication was found.
- Exploit timing: "about a week instead of months" comes only from Wiz (Wiz).
- OpenAI's statement: OpenAI called it "one of the most impactful vulnerabilities in recent memory" and said AI found it before attackers did (The National).
- Exposure: about 5.1 million IP addresses run PHP, per Recorded Future's estimate (Recorded Future).
Context and prior work
- OpenAI's GPT-5.5-Cyber scored 85.6% on CyberGym, a benchmark for reproducing known vulnerabilities. That is a vendor-reported figure (AI Weekly).
- Two separate teams found related bugs with frontier models in the same month. That fits the pattern of machine-speed vulnerability research that Patch the Planet was set up to handle.
Limitations, safety and contested findings
- Exploitation status is disputed:
- TechCrunch reported no known exploits in the wild (TechCrunch).
- Patchstack, citing hosting partners, and Cloudflare reported attacks. Patchstack's own data at 13:57 UTC showed only probing, with no confirmed breaches (Patchstack).
Read the full section
- Exploitation status is disputed:
- TechCrunch reported no known exploits in the wild (TechCrunch).
- Patchstack, citing hosting partners, and Cloudflare reported attacks. Patchstack's own data at 13:57 UTC showed only probing, with no confirmed breaches (Patchstack).
- Amazon reportedly called the flaws "broadly exploited" (FT).
- Sansec judges mass exploitation unlikely: attacks need knowledge of the target's setup, and public exploits fail against default installs (Sansec).
- Which versions are affected: TechCrunch says every version since PHP 5. Wiz and Sansec say 5.4 and later.
- Disclosure process: the embargo failed three times: the CVE leak, the Calif video and Chainguard's early release.
Business and practitioner implications
- Patch and restart: upgrade to the fixed versions and restart workers. Moving off end-of-life PHP 8.1 or older takes real migration work.
- Managed hosting is not enough: WordPress says this is a server-level PHP flaw, not a WordPress bug, so site owners need to confirm their hosts have patched (TechCrunch).
- Detection: watch for unusual multipart requests followed by memory errors, malformed
PHPSESSIDcookies, and unexplained worker restarts.
Read the full section
- Patch and restart: upgrade to the fixed versions and restart workers. Moving off end-of-life PHP 8.1 or older takes real migration work.
- Managed hosting is not enough: WordPress says this is a server-level PHP flaw, not a WordPress bug, so site owners need to confirm their hosts have patched (TechCrunch).
- Detection: watch for unusual multipart requests followed by memory errors, malformed
PHPSESSIDcookies, and unexplained worker restarts. - Disclosure planning: if AI cuts exploit-building time this sharply, the gap between disclosure and patching gets shorter. Plan for leaks and same-day patching.
The source trail.
Sources (15)
TechCrunch
techcrunch.comSimon Willison
simonwillison.netPHP2Shell: AI Found a Hole in 70% of Sites
Related coverage; assess separately
reddit.comAI Found the PHP2Shell Vulnerability in 70% of Sites in Weeks
Related coverage; assess separately
reddit.comAI Just Found a Bug That Puts up to 70% of the World’s Websites at Risk
Related coverage; assess separately
wsj.comCritical web security flaws spark global alarm as Google, OpenAI and Amazon respond
Related coverage; assess separately
cnbc.comAmazon warns new cyber flaws detected using AI are being ‘broadly exploited’
Related coverage; assess separately
ft.com