PHP shipped emergency patches on Wednesday for two critical flaws. The bugs let an attacker run code on almost any server running the language, Wiz Research said1. Out of every 100 websites online, 70 run PHP, and the other 30 run some other language.
OpenAI's and Google's AI models helped researchers find both bugs6. The work ran through OpenAI's Patch the Planet program2. That program pairs security firms with its models to hunt bugs in software everyone relies on.
The patches close two bugs tracked as CVE-2026-109618 and CVE-2026-109619, each rated 9.2 on a 10-point severity scale1. Every PHP release since version 5.4 carries at least one of them. That version shipped in 2012.
How Calif and Wiz found it
OpenAI invited the security firm Calif to audit PHP's source code in July2. Calif's researcher, listed only as Ryan A., started hunting on July 303. He asked an AI model to study PHP's old interruption bugs and look for cousins the industry missed.
Within days, the model and Ryan A. found a way to crash a PHP request at the exact wrong moment2. That crash leaves bad data behind for the next visitor to inherit. He reported the bug to PHP on Aug. 113. OpenAI reported the same root cause the same day, working independently.
Wiz Research started its own hunt on Aug. 19, using Google's Gemini 4 Argon model alongside OpenAI's1. It confirmed working exploits against Drupal on Aug. 20 and against WordPress on Aug. 21. Wiz reported its findings to PHP's security team on Aug. 24.
PHP also runs MediaWiki, the software behind Wikipedia1. A flaw in PHP itself reaches every site built on it, Wiz said, even one with careful code of its own.
What the AI actually did
A 2004 PHP Bug Takes 22 Years to Reach a Fix
Dated events in the PHP2Shell bug's history, 2004 to Oct. 21, 2026
Each dot is one dated event; the magenta dot marks Wednesday's patch, the only step that needed an AI model.
Sources: Calif Blog [2]; The PHP Foundation [3]. Chart by Ryan Elliott Dennis.
The numbers behind this chart
| Date | Event |
|---|---|
| 2004 | Esser finds the OOM bug |
| 2020 | A user reports bug 78876 |
| 2024 | Audit flags it again |
| Aug. 11, 2026 | Calif reports the bug |
| Oct. 21, 2026 | Patch finally ships |
Wiz says the underlying flaw sat in plain sight for more than a decade. Turning it into a reliable exploit took something else: patient, repetitive engineering across memory layouts that shift with every PHP version1.
"Using Gemini 4 Argon, the team at Wiz has shown why frontier AI is a game-changer for cyber defense," said Raluca Ada Popa, head of Gemini security at Google DeepMind1. She said the model helped Wiz "bridge that gap, finding vulnerabilities and helping patch them."
Wiz put a number on the shift. With AI, the firm said, a single researcher finished in a week what once took a world-class team months1. That is the real story behind Wednesday's release. A bug sat in plain view for years, until the price of weaponizing it dropped.
The bug PHP already knew about
Here is the fact that complicates the story. A PHP core developer found hints of the same root problem in 2024, two years before any model joined the hunt3. The developer was patching a different bug from PHP's first outside security audit, funded through the Sovereign Tech Agency and carried out by Quarkslab. A user had already filed a related report, bug 78876, back in 2020, years before anyone connected it to a working exploit2.
An exploit for the bug stayed theoretical back then, so the fix sat on a shelf3. Engineers debated three competing repairs. Each one carried its own cost: broken compatibility, a new denial-of-service risk, or changes forced on thousands of extensions.
"We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources," the PHP Foundation wrote on Wednesday3. Volker Dusch now serves as the Foundation's AI security engineer in residence. The group also decides security calls by majority vote today, a change meant to end the old stalemate.
Who gets the credit
Two camps read the same timeline differently. OpenAI's president and co-founder, Greg Brockman, called the find a defining moment for his company's security push.
"Over the past two months, we have been leading a coalition to mitigate one of the most severe bugs in open source software found in recent memory, php2shell, found as part of our Patch the Planet initiative," Brockman wrote on X5.
Ryan A., the Calif researcher who reported the first bug, pushes back on that framing. He says the credit belongs mostly to a human who already knew where to look.
"I focused on something I had a background in, knew its vulnerability history well, and held a theory that specific bugs lurk within the codebase," Ryan A. wrote on Calif's blog2. He added a warning for anyone reading AI into every new disclosure. "No model is simply capable of unearthing 'all bugs' with simple prompts. At least for now."
Stefan Esser found the earliest version of this bug class back in 2004, and he recently joined Calif's research team2. His old work gave Ryan A. the lead a model alone would have missed.
The scramble to patch
Governments moved fast once the patch landed. The European Union's CERT-EU and Britain's National Cyber Security Centre both told organizations still waiting on a patch to take systems offline8. America's National Security Agency issued its own alert.
Cloudflare turned on firewall rules for every customer, free accounts included, at 3:02 a.m. UTC on Wednesday4. That was nine hours ahead of the public release. TNW reported that Cloudflare watched attackers try new payloads against the rules within hours of launch8.
The release came a day early. Two CVE numbers leaked onto forums on Tuesday with a wrong severity score, forcing PHP to move its date up9. Calif then mistakenly posted a demonstration video of its own exploit, deleted it, and watched copies spread anyway. A vendor named Chainguard broke the embargo and shipped patched images more than six hours before the coordinated release.
PHP Runs 70 Percent of the World's Websites
Share of all websites built on PHP, as measured by Wiz Research, Oct. 21, 2026
Each cube is one percent of websites online; magenta cubes run PHP, and the gray cubes run something else.
Source: Wiz Blog [1]. Chart by Ryan Elliott Dennis.
The numbers behind this chart
| Item | Value |
|---|---|
| Runs PHP | 70 |
| Runs another language | 30 |
| Whole | 100 |
The bookmarking site Pinboard, the GrapheneOS forum, and the streaming tool OBS all pulled parts of their websites offline during the gap8. Laravel paused new cloud deployments while it rebuilt on patched images.
What to do
Check every server you run for its PHP version today. Waiting a week leaves a public flaw open that long, including on the staging boxes everyone forgot about.
When a patch has to wait, turn on your host's or CDN's PHP2Shell rule and lower post_max_size in the meantime. Both steps only buy time; the update is the actual fix.
Ask your hosting provider directly whether its PHP build is current. WordPress, Drupal and Joomla sites inherit the fix only when the server beneath them does.
By the numbers
- 70 percent: Share of the world's websites that run PHP, as measured by Wiz Research1.
- 9.2: Severity score, out of 10, the PHP security team gave each of the two bugs1.
- 22 years: Span from Stefan Esser's 2004 discovery of the root bug class to Wednesday's patch2.
- Four: Number of PHP branches, 8.2 through 8.5, that received a full patch on Wednesday3.
- 360: Points the disclosure earned on Hacker News within hours, with 118 comments10.
- 8,773: Likes on OpenAI's announcement on X by Wednesday afternoon6.
What to watch
Watch how many of the roughly 883,000 end-of-life PHP installs ever receive even a backported fix. The PHP Foundation's new majority-vote process faces its first real test the next time a fix stalls like this one did. OpenAI, Google and Wiz keep one number private so far: how much compute their models spent on the find.
Sources
- Wiz Research, "PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet," Wiz Blog, Oct. 21, 2026, https://www.wiz.io/blog/php2shell-php-rce
- Ryan A., "php2shell," Calif Blog, Oct. 21, 2026, https://calif.io/php2shell/
- The PHP Foundation, "Today's PHP Security Release, and How We're Strengthening PHP Security," Oct. 21, 2026, https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
- Cloudflare, "Cloudflare deploys protections against php2shell vulnerability," Cloudflare Blog, Oct. 21, 2026, https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
- Greg Brockman (@gdb), X post, Oct. 21, 2026, https://x.com/gdb/status/2112921529650688312
- OpenAI (@OpenAI), X post, Oct. 21, 2026, https://x.com/OpenAI/status/2112907856018309586
- Wiz (@wiz_io), X post, Oct. 21, 2026, https://x.com/wiz_io/status/2112899813264277528
- Ana Maria Constantin, "PHP rushes out emergency patches for two critical bugs AI found first," TNW (The Next Web), Oct. 21, 2026, https://thenextweb.com/news/php2shell-php-rce-ai-openai-wiz
- Ana Maria Constantin, "PHP knew about one of the flaws in 2024 but could not agree a fix," TNW (The Next Web), Oct. 21, 2026, https://thenextweb.com/news/php-foundation-structural-failure-2024-flaw-leak
- Hacker News, "PHP2Shell: AI uncovers critical RCE in PHP," Oct. 21, 2026, https://news.ycombinator.com/item?id=50180836