AI Found the PHP Zero-Day First. Now What?

On October 21, 2026, the PHP project shipped emergency patches for two critical remote code execution vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — collectively named PHP2Shell. With a CVSS v4.0 score of 9.2, they affect every PHP version released in the last decade, back to PHP 5.4, touching an estimated 70% of the web. WordPress, Drupal, Joomla — all vulnerable by default.

But the real story isn't the bugs themselves. It's who found them first: AI models, working under OpenAI's "Patch the Planet" initiative, discovered PHP2Shell weeks before public disclosure. Security firm Calif used GPT-5.6 Sol to identify the flaws in August. Independently, Wiz Research used Gemini 4 Argon, GPT-5.6 Sol, and its own Wiz Atlas tool to reach the same conclusion. For the first time in a major internet-scale vulnerability, AI-assisted discovery beat the attackers to the punch — or did it?

View discussion on Hacker News →

The Vulnerabilities: Memory Corruption Meets Stale State

PHP2Shell comprises four bugs grouped under two CVEs:

CVE-2026-109618 (OOM Corruption): When PHP runs out of memory at precisely the wrong moment during request setup, internal data structures are left half-initialized. Cleanup code trusts this corrupted state, opening a use-after-free. Researchers demonstrated unauthenticated remote code execution against Apache mod_php with default settings.

CVE-2026-109619 (Stale Global State): A fatal error leaves internal pointers alive across request boundaries. A subsequent request served by the same PHP worker can hijack these dangling pointers, enabling another use-after-free. A related memory-disclosure variant leaks passwords, API keys, and certificates from other requests through a PHPSESSID cookie — even without session_start().

The attack surface is severe: pre-authentication RCE was demonstrated against the latest WordPress, Drupal, and Joomla container images. A proof-of-concept exploit — aptly named php2shell — appeared on GitHub within hours and has amassed over 900 stars. The barrier to exploitation is effectively zero for anyone with the PoC.

How AI Found It: The Patch the Planet Timeline

OpenAI launched Patch the Planet in June 2026 as part of its Daybreak cybersecurity initiative. Built with Trail of Bits and partners HackerOne and Calif, the program pairs AI-assisted vulnerability research with human expert review. By October, it had reviewed 50 codebases and merged 160 patches upstream.

Here's how the PHP2Shell discovery unfolded:

2024: A PHP core developer first noticed the out-of-memory error pattern during an OSTIF/Quarkslab audit funded by the Sovereign Tech Agency. No exploit was found. The fix stalled — the PHP Foundation later called this "a structural failure" in their consensus-based security process.

July 30, 2026: At the PHP Foundation's request, Calif researchers began auditing PHP's source code using OpenAI's GPT-5.6 Sol through Patch the Planet.

August 1, 2026: Calif's Ryan Austin identified the first exploitable vulnerability. The AI model didn't just find the bug — it helped develop working exploit chains across multiple PHP versions and deployment configurations.

August 19, 2026: Wiz Research independently discovered the same vulnerabilities using Gemini 4 Argon, GPT-5.6 Sol, and Wiz Atlas. Within two days, they confirmed unauthenticated RCE against Drupal and WordPress.

August 24, 2026: Both teams reported to the PHP security team. OpenAI learned of Wiz's parallel work through the PHP Foundation and coordinated a unified response.

September 21, 2026: PHP acknowledged the reports and began coordinated fixes.

The Defender's Window — Or Was It?

OpenAI frames the PHP2Shell episode as a "Defender's Window": advanced AI models found the flaws before attackers could exploit them, giving the community time to prepare patches, WAF rules, and mitigations. The coordinated response involved the PHP Foundation, Cloudflare, AWS, Akamai, Google, Microsoft, Vercel, Quarkslab, and multiple government agencies — from the NSA and FBI to Japan's prime minister's office and the EU's CERT.

Cloudflare deployed temporary WAF rules before the scheduled October 21 patch. The PHP Foundation added OpenAI's Daybreak Red to validate reports and reproduction environments.

It looked like the system worked. Except for one problem.

This isn't the only leak. CVE details leaked on October 20 with incorrect timing and CVSS scoring. Calif accidentally published a proof-of-concept video. Chainguard released patched container images roughly six hours before the coordinated release, giving attackers a binary diff to reverse-engineer.

View discussion on Hacker News →

The result: Cloudflare reported "tens of thousands" of exploit attempts within 45 minutes of the news spreading, "hundreds of thousands" within two hours, and millions by evening. AWS confirmed the vulnerability was "broadly exploited in the wild." The Netherlands and Finland took government websites offline as a precaution. Archive.org went temporarily dark.

The Real Inflection Point: AI on Both Sides of the Fence

PHP2Shell matters beyond the immediate scramble because it demonstrates that AI vulnerability discovery is now production-grade. Not a benchmark score. Not a controlled evaluation. Production.

Consider the numbers:

• 66,000 CVEs projected for 2026, up from 48,000 in 2025. The Forum of Incident Response and Security Teams (FIRST) attributes the surge primarily to AI tools finding flaws.
• Negative seven-day mean time-to-exploit. Mandiant's incident response data shows exploitation now starts, on average, a week before a patch exists.
• Anthropic's Project Glasswing reportedly uncovered over 10,000 high-or-critical vulnerabilities in its first months using Claude Mythos Preview.
• OpenAI's GPT-5.6-Cyber scores 95% on advanced cyber request completion, compared to 1.5% for the base GPT-5.6 Sol model.
• At Pwn2Own Berlin 2026, researchers armed with AI tools uncovered 47 unique zero-day vulnerabilities across browsers, AI databases, coding agents, and enterprise applications.

The dual-use dilemma is not theoretical. As OpenAI itself acknowledged: "The same capabilities can also help attackers rapidly develop offensive tools and exploits." Bruce Schneier described this as a dual-use paradox — defenders hold an advantage only while comparable capability stays out of adversaries' hands.

And the evidence suggests it hasn't stayed out. Google's Threat Intelligence Group reported in May 2026 what it described as the first publicly documented use of an AI-generated zero-day exploit — a 2FA bypass with tell-tale AI fingerprints (hallucinated CVSS scores, educational docstrings, textbook-format Python). They disrupted it before mass exploitation, but the capability threshold had been crossed.

The Community Reaction

The security community's response has been a mix of urgency and uncomfortable recognition.

View discussion on Hacker News →

On Hacker News, the Wiz disclosure post and the PHP Foundation's response both hit the front page. The discussion centered on the coordination complexity — getting patches into PHP distributions, Docker images, and managed hosting platforms simultaneously while an embargo was leaking. Multiple threads flagged that end-of-life PHP branches (7.4, 8.0, 8.1) have no official binary releases, leaving millions of servers dependent on distribution backports.

View discussion on Reddit →

On Reddit's r/technology, the Cloudflare exploitation data — 1.6K upvotes, 96 comments — drove home the scale. Comments ranged from "every shared host running cPanel just became an incident" to debates about whether the PHP Foundation's consensus-based security process is fit for the AI era.

The Wiz team's podcast deep-dive with researchers Sagi Tzadik and Thai Duong (Calif) is worth the listen — it covers how AI agents handled the version-specific exploit adaptation that would have taken human researchers months in a lab.

View on Latent Space →

The Arms Race in Numbers

The broader context makes PHP2Shell's significance clear. This isn't the first AI-assisted vulnerability discovery — it's the one that broke through to mainstream awareness.

Google's Big Sleep project found an exploitable SQLite flaw (CVE-2025-6965) before it reached an official release in late 2025. In April 2026, Anthropic's Project Glasswing reportedly uncovered over 10,000 high-or-critical vulnerabilities using Claude Mythos Preview. In May, Google's Threat Intelligence Group documented the first in-the-wild AI-generated zero-day exploit — a 2FA bypass with telltale LLM fingerprints in its code. In June, autonomous security startup depthfirst found 21 previously unknown FFmpeg vulnerabilities for roughly $1,000 in compute.

OpenAI has released increasingly permissive models for security research. GPT-5.5-Cyber launched in June 2026 with Patch the Planet. GPT-5.6-Cyber followed in August with "reduced safeguards for exploit development" — completing 95% of advanced cyber requests versus 1.5% for the base model. Trusted partners including CrowdStrike, Cloudflare, Palo Alto Networks, and IBM received access through Daybreak Red.

The numbers tell the story of a capability curve going vertical. But capability without process is just a faster way to find bugs nobody patches.

What This Means for You

If you're a builder, a security lead, or anyone running infrastructure, PHP2Shell crystallizes a new operational reality:

1. Patch timelines are now measured in hours, not days. AWS's recommendation is blunt: "Measure patch and mitigation timelines for critical internet-facing vulnerabilities in hours." The Oct 17 exploitation — four days before disclosure — means your window starts before you even know there's a window.

2. WAF-first, patch-second is the new order of operations. Cloudflare's pre-disclosure WAF deployment saved countless sites. If your stack doesn't include a WAF that can receive emergency rules from vendor threat intelligence, you're structurally behind.

3. AI-speed disclosure changes severity triage. When an AI model finds a bug, the disclosure-to-exploit timeline compresses. Treat AI-assisted advisories as inherently higher urgency. A traditional 90-day disclosure window assumes human-speed discovery on the attacker side. That assumption is dead.

4. End-of-life software is now an active emergency. PHP 7.4 through 8.1 have no official binary patches. With a public PoC sporting 900+ GitHub stars, running EOL PHP on the public internet is the equivalent of leaving your front door open with a sign that says "free stuff inside."

5. Monitor the pre-disclosure window. Amazon's MadPot IOCs date to October 17. If you haven't checked your PHP logs back to mid-October, do it now. The indicators: unusual multipart requests followed by memory-limit errors, malformed PHPSESSID cookies, unexplained PHP worker churn, and suspicious files in web roots.

The Bigger Picture

PHP2Shell is not an isolated incident. It's the clearest signal yet that we've entered an era where AI finds bugs faster than humans can fix them. The Cloud Security Alliance puts it starkly: in Anthropic's Project Glasswing, fewer than 1% of the vulnerabilities Mythos found were actually patched. The bottleneck isn't discovery. It's remediation.

OpenAI's Patch the Planet is one attempt to close that gap — pairing AI discovery with human-led patching at scale. Trail of Bits engineers review every finding. Calif and HackerOne handle triage and coordinated disclosure. It's the right architecture: AI finds, humans verify, humans fix. As of October, the program has reviewed 50 codebases and merged 160 patches upstream — a meaningful start, but a drop in the bucket against 66,000 projected CVEs.

But the PHP Foundation's own post-mortem reveals the fragility. A two-year delay between first noticing the OOM pattern and shipping a fix. A consensus-based security team that couldn't agree on trade-offs. A coordinated disclosure that leaked from three directions simultaneously. The new Ecosystem Security Team, formed in May 2026, is a step forward — but it took a CVSS 9.2 internet emergency to force the structural change.

View discussion on Hacker News →

The defender's toolbox got a major upgrade with AI-assisted discovery. The defender's process didn't keep pace. As Wiz put it: "It marks an AI inflection point." The question is whether the organizations that depend on PHP — which is to say, most of the internet — can operate at inflection-point speed.

If your organization's security posture still assumes human-speed vulnerability discovery on both sides, PHP2Shell is the wake-up call. The attackers have AI too. And as the October 17 exploitation shows, they may already be ahead.

For more on supply-chain security in the AI era, see our coverage of the LiteLLM supply chain attack and OpenAI's API dependency risks.