Two critical PHP flaws found with AI models are patched as exploit attempts surge

The PHP project released fixes on 21 October for two critical remote-code-execution flaws in the language’s core, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. OpenAI, the security firm Calif and Wiz each reported that they had used AI models in finding them. The embargo leaked a day early, exploitation attempts followed, and as of 23 October no confirmed compromise had been reported.

What was found

Wiz said the flaws are memory-safety bugs in how PHP handles fatal errors, particularly out-of-memory errors, scored at CVSS 9.2, and that every PHP version back to 5.4 is affected by at least one. It said it chained them into an exploit that gave unauthenticated code execution on default WordPress, Drupal and Joomla images, and that frontier models let its team adapt the exploit across targets “in hours”. Wiz used its own Wiz Atlas tool, Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol. OpenAI said Calif identified a flaw with GPT-5.6 Sol under its Patch the Planet initiative, with Wiz independently reporting both, and called the issue “one of the most impactful security issues in recent memory”. The post also restated its $1bn of subsidised Daybreak access for under-resourced defenders and proposed a five-stage framework for coordinating responses to critical vulnerabilities. It follows XBOW’s use of GPT-5.6 Sol on a Chrome exploit chain a week earlier.

The PHP Foundation’s account adds history: the out-of-memory root cause was first glimpsed during a 2024 external audit, no exploit path was found, and fixing it stalled over compatibility trade-offs, a delay the Foundation called “a structural failure”. Calif’s report of unconditional code execution on 11 August made it the top priority. Wiz’s “70% of all websites” figure is its own framing; The Register qualified it as about 70 per cent of sites with a known server-side language.

A disputed embargo

The Foundation said the CVE identifiers began circulating on 20 October with a wrong release time and a wrong score of 10.0, so it moved the release forward a day. It said Calif then “mistakenly” published a proof-of-concept video, and that on 21 October at 07:41 UTC Chainguard “unilaterally broke the embargo” by publishing patched images more than six hours early. Chainguard’s chief executive Dan Lorenc told The Register his company “didn’t leak”: it had independently found the same bugs using an AI harness and a frontier model, and shipped because exploitation was already reported, which he said is an exception to coordinated disclosure.

Exploitation

Amazon reported a honeypot exploitation attempt on 17 October, four days before disclosure, and proof-of-concept exploits from about 02:00 UTC on 21 October; it said it was unclear whether any would have worked. The Foundation’s executive director, Elizabeth Barron, said it had no evidence of successful exploitation before disclosure. Cloudflare reported millions of attempts. VulnCheck said most of the hundreds of GitHub proofs of concept do not work, but it demonstrated an exploit that defeats address-space randomisation (ASLR), initially on PHP 8.4.26, offered only to its customers. Mandiant’s chief technology officer, Charles Carmakal, said some public exploits are “vibe-coded” and non-functional while others achieve code execution against default mod_php. The two CVEs were not in CISA’s Known Exploited Vulnerabilities catalogue as of its 23 October release.

Government response

Baroness Lloyd of Effra, a UK minister, told the House of Lords that 32 government services were unavailable and four partly so, largely as a precaution, with no confirmed compromise, and that OpenAI had briefed the NCSC the week before. The Register reported similar shutdowns in several European countries. The European Commission, ENISA, CERT-EU and Europol issued a joint statement urging patching.

On 23 October the Foundation said it had reserved a third CVE, CVE-2026-115560, needing an unusual configuration, and would fix it in the next regular release rather than an emergency one.

Timeline

• 30 Jul: Calif begins a PHP audit under Patch the Planet (PHP Foundation).
• 11 Aug: Calif reports unconditional remote code execution (PHP Foundation).
• 19–24 Aug: Wiz finds the first bug and reports to PHP on 24 August (Wiz).
• 17 Oct: Amazon’s honeypots log an exploitation attempt.
• 20 Oct, about 15:00 UTC: CVE identifiers leak; PHP brings its release forward.
• 21 Oct: Chainguard publishes images at 07:41 UTC; PHP releases fixes at about 14:00 UTC.
• 22 Oct: Lords answer on UK services; VulnCheck ASLR bypass.
• 23 Oct: Third CVE announced without an emergency fix.