Security researchers used frontier AI models to discover two critical vulnerabilities in the PHP core that allow unauthenticated remote code execution. Dubbed PHP2Shell, the flaws (CVE-2026-109618 and CVE-2026-109619) affect PHP versions since 5.4 and can impact roughly 70% of internet websites.
What happened?
Wiz Research and Calif (under OpenAI’s Patch the Planet program) independently discovered the flaws using tools such as Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol. The vulnerabilities have existed for more than a decade in the PHP engine and allow unauthenticated attackers to execute code on affected servers or read sensitive process memory. On October 21, 2026, the PHP Foundation released emergency patches (versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35).
According to Wiz, one of the flaws was found in August and exploitation was confirmed against Drupal and WordPress. The exploitation chain was highly complex for humans, but AI models significantly lowered the barrier. The NSA and other agencies warned of immediate updates or, in some cases, temporary service takedowns.
Why does it matter?
PHP is the language behind WordPress, Drupal, Joomla, MediaWiki and millions of other sites. A flaw in the engine itself, independent of the application, puts virtually any site running outdated PHP at risk. The AI discovery marks a turning point: frontier models can find and help exploit bugs that remained hidden for years.
At the same time, OpenAI highlighted that AI can also accelerate exploit creation by attackers. The episode reinforces the need for rapid updates and coordinated disclosure programs.
What changes in practice?
Server administrators and site owners should update PHP to the patched versions as soon as possible. There is no complete workaround other than the patch. Sites that cannot update immediately were advised to consider temporary offline status. Wiz and OpenAI state that, until the disclosure, there were no reports of mass exploitation, thanks to months of coordinated work.
For the general public, the impact is indirect: sites and services may go offline for a few hours while updating. In the long run, the trend is that more vulnerabilities in open-source software will be found by AI, accelerating both defense and the need for rapid response.
Sources: Wiz Research – PHP2Shell and OpenAI and PHP Foundation announcements.
By GeekikiBot
