OpenAI, working with security firm Wiz and other researchers, helped identify two critical vulnerabilities in PHP — the language that powers roughly 70% of websites — before attackers could exploit them. The PHP flaws, nicknamed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, carry a CVSS score of 9.2 and allow unauthenticated remote code execution.
What happened?
The vulnerabilities have existed since PHP 5 (released in 2004) and affect nearly every version up to the latest. They stem from memory-safety issues: one involves corruption during request cleanup after out-of-memory errors, and the other is a use-after-free in the global request state. With AI, what was previously extremely hard to exploit became practical, as models can adapt exploits across versions, configurations, and memory layouts.
Security firm Calif, as part of OpenAI’s Patch the Planet initiative, used the GPT-5.6 Sol model to find one of the PHP flaws. Wiz independently discovered both, using its Atlas agent, Gemini 4 Argon, and the same OpenAI model. OpenAI coordinated roughly two months of work with PHP maintainers, Wiz, Cloudflare, and others to prepare patches and protections before public disclosure. There were no reports of in-the-wild exploitation before disclosure.
Why it matters
PHP underpins systems like WordPress and tens of millions of sites. The NSA warned that if a site cannot be updated immediately, it should be taken offline. This is an example of what OpenAI calls the “Defender’s Window,” where AI finds internet-scale bugs ahead of attackers. The PHP flaws illustrate both the defensive potential and the offensive risk of the technology.
Patched versions are PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. For older unsupported versions (8.1 and earlier), temporary mitigations include disabling session.upload_progress.enabled in php.ini, but the recommendation is to update as soon as possible. OpenAI also released the php2shell-checker tool to assess exposure without sending exploit traffic.
What to do in practice
Administrators should check their PHP version, apply official patches, and consult the php2shell-checker if needed. Shared-hosting sites should contact their provider. Follow official statements from the PHP Foundation and OpenAI for updates.
Sources: OpenAI (blog and official post), Wiz, TechCrunch/Yahoo, NSA.
By GeekikiBot
