A pair of critical vulnerabilities in PHP, the programming language behind a large share of the web, has forced governments and companies into an emergency patching cycle. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively called PHP2Shell, can let attackers run malicious code on vulnerable servers, according to CNBC.
The unusual part is how they were found. OpenAI says its GPT-5.6 Sol model helped uncover the bugs as part of its Patch the Planet initiative. The Decoder reported that security firm Wiz independently found the same flaws using Google’s Gemini 4 Argon model plus OpenAI’s GPT-5.6 Sol. The discovery is a landmark for AI-assisted security research. It is also a warning: the same models can help attackers adapt exploits faster.
What PHP2Shell does
PHP powers WordPress and many other content management systems and web applications. The two flaws could give attackers access to files and databases on affected servers, according to the U.S. National Security Agency. The agency urged organizations to apply vendor updates and said affected systems should be taken offline if immediate patching is not possible.
The FBI also warned that the bugs could be used for remote code execution. Cybersecurity authorities in the U.K., Singapore, Australia, Canada and the European Union issued their own alerts. Cloudflare deployed web application firewall rules to block known exploit requests, and the PHP project released security fixes.
How AI found PHP2Shell, and how attackers moved first
OpenAI described the flaws as one of the most serious security episodes in recent memory. The company said it spent two months coordinating with PHP maintainers, Wiz, Cloudflare and U.S. agencies, including CISA and the White House, to prepare fixes before public disclosure. A checker published on GitHub can tell operators whether their installed PHP release contains the bugs.
But the disclosure did not stay clean. The PHP Foundation told The Verge that details began leaking on forums and social media before the official release, and some security firms published information early. The foundation said the fix had been delayed by hard trade-offs: backward compatibility breaks, new denial-of-service risks and changes that would have required coordinating many third-party extensions.
Amazon’s threat intelligence team added a more troubling data point. It detected an attempt to exploit PHP2Shell on Oct. 17 through a honeypot, days before the patch was released, and saw more attempts on Oct. 21. Amazon said it is unclear how the attacker obtained information about the flaws before disclosure. The PHP Foundation said it was not aware of a successful remote-code-execution attack, but it called updating imperative.
Why the PHP2Shell patch race matters
The PHP2Shell episode shows how AI is compressing both sides of security work. A model can scan huge codebases and propose exploit paths that once took human researchers weeks to find. The same capability can help an attacker adjust an exploit across PHP versions, configurations and memory layouts, which is exactly the barrier that used to slow mass exploitation.
Wiz said that adaptation used to require significant effort; large language models can automate it. That lowers the cost of scaling attacks across many deployments. OpenAI itself warned that findings on this scale will increase sharply in the coming months, while acknowledging that the defensive and offensive uses of the technology cannot be separated.
The immediate priority is mundane: identify affected PHP versions, apply the vendor patch and check firewall logs for exploitation attempts. The longer-term question is whether coordinated disclosure can keep pace with AI-assisted discovery. If models can find critical bugs faster than maintainers can ship fixes, the bottleneck shifts from research to patching, and the window between discovery and attack gets shorter. For more context on how AI is changing security work, see our Tech coverage.
I am a person who is positive about every aspect of life.I have always been an achiever be it academics or professional life. I believe in success through hard work & dedication.
Technology Blogger at TechnoSecrets.com
