SafetyRisk, alignment & guardrails
AI-assisted researchers turn old PHP flaws into a remote-code-execution chain, and attacks begin before emergency patches ship
Researchers using commercial frontier AI models turned long-known PHP memory-handling bugs into an unauthenticated remote-code-execution chain that hits WordPress, Drupal and Joomla. Details leaked before the 21 October patches, exploitation attempts surged, and security agencies told operators to patch or go offline.
From the The Guardian · AI article of October 23, 2026 and cited sources: A PHP core developer flagged the underlying out-of-memory issue in 2024, but it was set aside with no agreed fix and no known exploit. [2] [3] [4] [6]
SOURCES[2] Wikipedia: PHP2Shell en.wikipedia.org[3] Wiz: PHP2Shell wiz.io[4] Fortune: AI tools discovered the PHP vulnerability fortune.com
AT Pulse research deskPublished · Updated · 5 min read · AI-assisted analysisAI-assisted, not human-edited. Methodology Corrections Who owns this site
- What happened
- A PHP core developer flagged the underlying out-of-memory issue in 2024, but it was set aside with no agreed fix and no known exploit. [2] [3] [4] [6] [9]
- Original source
- The Guardian · AI article, independent perspective
- Brief by
- AT Pulse research desk AI-assisted; publisher and contact on the desk page
- When
- October 23, 2026 article published
- Covered
- Oct 24 edition
- Evidence
- 11 sources across 11 sites
- 1‘Black October’: cybersecurity experts sound the alarm…theguardian.com
- 2Wikipedia: PHP2Shellen.wikipedia.org
- 3Wiz: PHP2Shellwiz.io
- 4Fortune: AI tools discovered the PHP vulnerabilityfortune.com
- 5SiliconANGLE: Patch the Planetsiliconangle.com
- 6SecurityWeek: First exploitation attemptssecurityweek.com
Reach: not measured yet
A PHP core developer flagged the underlying out-of-memory issue in 2024, but it was set aside with no agreed fix and no known exploit. In August 2026, Calif (using GPT-5.6 Sol) and Wiz (mainly using Gemini 4 Argon) each found that PHP mishandles fatal errors and leaves corrupted state for later requests to reuse. Wiz chained this with a memory leak into unauthenticated RCE that works across mod_php, PHP-FPM and other setups. Both models are generally available. [2] [3] [4] [6] [9]
Coordinated disclosure broke down. Amazon's sensors saw exploitation attempts on 17 October. Details leaked around 19–20 October through public posts and a proof-of-concept video released by mistake. On 21 October PHP shipped fixed releases (8.2.35 through 8.5.12), and the NSA and CERT-EU told operators to patch right away or take systems offline. [2] [6] [7] [8]
Real exposure is hard to measure, and fixing it will take time. The widely quoted 70% is PHP's share of websites whose server-side language is known, not a count of sites that can be exploited. Nearly half of PHP sites run versions that no longer get security updates. Versions 7.4–8.1 get only minimal backports, and PHP's published workarounds only partly reduce the risk. [8] [10] [11]
Executives at Cloudflare, OpenAI and Anthropic warned that patching cannot keep up with AI-assisted vulnerability discovery. Cloudflare's Matthew Prince said attempts rose from thousands to millions after the announcement, though watchTowr had seen no successful exploitation when SecurityWeek reported. OpenAI acknowledged that the same capabilities can help attackers build exploits faster. [1] [4] [6]
AI-assisted audits produced a working exploit chain in core web infrastructure, and attacks started within days of the leak.
Read the full assessment
Implication: emergency patching, an inventory of end-of-life PHP versions, and rotating credentials that memory leaks may have exposed should become routine work.
Drafting the dossier now that sources have been checked.
Executive brief
The core PHP bugs behind "Black October" were not new. A PHP core developer flagged the underlying out-of-memory error in 2024, but nobody agreed on a fix and no exploit was known, so it was set aside (Wikipedia). In August 2026, researchers using frontier AI models turned the flaws into unauthenticated remote code execution (RCE) against WordPress, Drupal and Joomla (Wiz). News of the bugs leaked before the 21 October patch, and attackers moved first (Fortune). Executives at Anthropic, OpenAI, Cloudflare and Salesforce now warn of a "vulnerability tsunami" (Guardian).
What changed and event timeline
OpenAI launches Patch the Planet
OpenAI started the programme with Trail of Bits, HackerOne and Calif. It funds researchers to use Codex Security and OpenAI models on widely used open-source projects ().
1–24 August 2026: Two teams find the bugs separately
Calif found the first issue on 1 August. Wiz found the flaws on its own on 19 August and reported them to PHP on 24 August (;).
Attacks start before the patch
Amazon Threat Intelligence saw exploitation attempts in its MadPot sensor network, four days before any fix existed (;).
The embargo breaks
Details leaked through Hacker News, X and a proof-of-concept video released by mistake. Some reports put the leak on 19 October (;).
Emergency patches and government alerts
PHP shipped versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The NSA and CERT-EU told operators to patch immediately or take affected systems offline (;).
22–23 October 2026: Attempts reach millions and executives sound the alarm
Cloudflare's Matthew Prince said exploitation attempts went from thousands to millions after the announcement. Sam Altman and Anthropic's Jason Clinton warned that patching can't keep up ().
Capabilities and access
- Calif: Ryan Austin used OpenAI's GPT-5.6 Sol to audit PHP's source code (Wikipedia). GPT-5.6 Sol has been generally available since 9 July 2026 (NYU Shanghai RITS).
- Wiz: Its team used Gemini 4 Argon (credited as the main contributor), GPT-5.6 Sol and Wiz's own Atlas tool (Wiz).
- Both teams used commercially available frontier models, not restricted ones.
Read the full section
- Calif: Ryan Austin used OpenAI's GPT-5.6 Sol to audit PHP's source code (Wikipedia). GPT-5.6 Sol has been generally available since 9 July 2026 (NYU Shanghai RITS).
- Wiz: Its team used Gemini 4 Argon (credited as the main contributor), GPT-5.6 Sol and Wiz's own Atlas tool (Wiz).
- Both teams used commercially available frontier models, not restricted ones.
Technical analysis for researchers and developers
- Root cause: PHP mishandles fatal errors during a request, especially out-of-memory errors. The corrupted state is then reused by later requests (Wiz).
- The four flaws Wiz demonstrated:
- a use-after-free in the session upload-progress unserializer (CVE-2026-109618)
Read the full section
- Root cause: PHP mishandles fatal errors during a request, especially out-of-memory errors. The corrupted state is then reused by later requests (Wiz).
- The four flaws Wiz demonstrated:
- a use-after-free in the session upload-progress unserializer (CVE-2026-109618)
- a use-after-free in fatal-error backtraces (CVE-2026-109619)
- leaks of process memory containing passwords, tokens and API keys
- OPcache type confusion that corrupts memory across worker processes
- Exploit chain: "php2shell" combines the memory leak with the corruption bugs to get unauthenticated RCE (Wiz).
- Affected setups: mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed (SecurityWeek).
- Detection signs: unusual multipart requests followed by memory-limit errors, repeated HTTP 500 responses, and malformed PHPSESSID cookies (Wiz).
Claims and evidence
- "Among the most severe… arguably in software history." This is Wiz's own description (Wiz).
- "70% of sites at risk." The figure is W3Techs' share of websites whose server-side language is known (Khaleej Times).
- This comes from Prince's post on X (Guardian). WatchTowr saw attempts but no successful ones at the time of reporting (SecurityWeek).
Read the full section
- "Among the most severe… arguably in software history." This is Wiz's own description (Wiz). The CVSS 9.2 score and the government alerts back up the severity (SecurityWeek), but "history" is the vendor's framing.
- "70% of sites at risk." The figure is W3Techs' share of websites whose server-side language is known (Khaleej Times). It is not a count of sites confirmed to be exploitable.
- Millions of attempts. This comes from Prince's post on X (Guardian). WatchTowr saw attempts but no successful ones at the time of reporting (SecurityWeek).
- AI made exploitation possible. This claim comes from the discoverers themselves (Wiz; Fortune). No independent replication of the AI workflow has been published.
Context and prior work
- Patch the Planet sits inside OpenAI's Daybreak programme, which also released GPT-5.5-Cyber (SiliconANGLE).
- Warnings about an AI-driven "vulnpocalypse" were circulating for months before this (Guardian).
- The PHP Foundation has 13 full- and part-time staff (Wikipedia). That small team is a big part of why the 2024 finding sat unresolved.
Read the full section
- Patch the Planet sits inside OpenAI's Daybreak programme, which also released GPT-5.5-Cyber (SiliconANGLE).
- Warnings about an AI-driven "vulnpocalypse" were circulating for months before this (Guardian).
- The PHP Foundation has 13 full- and part-time staff (Wikipedia). That small team is a big part of why the 2024 finding sat unresolved.
Limitations, safety and contested findings
- Timeline conflicts: sources disagree on when the leak happened (19 vs 20 October) and when the bugs were discovered (1 August for Calif, 19 August for Wiz).
- How the patch got out: proof-of-concept exploits spread after Chainguard shipped patched builds early. PHP itself released 26 minutes ahead of schedule (Wikipedia).
- Unsupported versions: nearly half of PHP sites run versions that no longer get security updates (Island). Versions 7.4–8.1 get only minimal backports (ITdaily).
Read the full section
- Timeline conflicts: sources disagree on when the leak happened (19 vs 20 October) and when the bugs were discovered (1 August for Calif, 19 August for Wiz).
- How the patch got out: proof-of-concept exploits spread after Chainguard shipped patched builds early. PHP itself released 26 minutes ahead of schedule (Wikipedia).
- Unsupported versions: nearly half of PHP sites run versions that no longer get security updates (Island). Versions 7.4–8.1 get only minimal backports (ITdaily).
- Workarounds are partial: PHP's published mitigations only partly reduce the risk (ITdaily).
- Dual use: OpenAI acknowledged that the same capabilities can help attackers build exploits quickly (Fortune).
Business and practitioner implications
- Upgrading to the fixed releases is the only complete fix (Wiz).
- Sites on end-of-life versions have no complete official patch.
- Leaked keys are a separate risk. The memory-disclosure bug can expose secrets, so organisations should consider rotating credentials.
Read the full section
- Patch or go offline. Upgrading to the fixed releases is the only complete fix (Wiz). The NSA's advice was to take systems offline if they can't be updated (Khaleej Times).
- Inventory unsupported PHP. Sites on end-of-life versions have no complete official patch.
- Leaked keys are a separate risk. The memory-disclosure bug can expose secrets, so organisations should consider rotating credentials. This is an inference from Wiz's description, not explicit guidance.
- Expect hours, not days, between disclosure and attack (ITdaily). WAF rules buy time, but emergency patching needs to be routine.
The source trail.
Sources (11)
‘Black October’: cybersecurity experts sound the alarm over new era of AI-enabled hacking
Article text retrieved; extracted text may omit tables or interactive elements.
theguardian.com