PHP Security Flaws Patched After AI Tools From OpenAI and Google's Wiz Find Decade-Old Holes

The PHP Foundation on Wednesday released emergency security updates for two critical vulnerabilities that researchers say have sat undetected in the programming language's core engine for more than two decades, exposing a majority of the world's websites to potential unauthenticated takeover. The flaws were uncovered independently by security researchers using artificial intelligence tools built by OpenAI and by Wiz, the cloud-security firm owned by Google Cloud, whose teams said the same AI systems that found the bugs also made them dramatically easier to exploit.

The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, each carry a severity score of 9.2 out of a possible 10, according to the PHP Foundation's own account of the release. Both stem from the same underlying problem: when a PHP process runs out of memory or hits a fatal error mid-request, the engine can be left holding corrupted or stale internal data that a later request, on the same worker, mistakenly treats as valid. On servers running Apache with the mod_php module — which the PHP security team called the highest-risk configuration — an unauthenticated attacker could trigger code execution before any application code even runs.

A flaw that predates most of today's internet

According to detailed technical write-ups from Wiz Research, the vulnerable code paths trace back to PHP 5.4, meaning the bugs have existed since roughly 2012 and, in some form, potentially since PHP 5.0 was released in 2004. PHP remains the server-side language behind 69.3 percent of websites whose server language is known, according to tracking by W3Techs, underpinning content-management systems including WordPress, Drupal, Joomla and MediaWiki. Wiz said its researchers demonstrated working exploit chains against unmodified WordPress, Drupal and Joomla container images, and that memory leaked through the flaw could expose passwords, session tokens, API keys and certificates even on a server running nothing more complex than a basic PHP script.

Fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, detailed in the project's advisories for CVE-2026-109618 and CVE-2026-109619. PHP 8.1 and earlier no longer receive official updates, though the project published limited source-code backports for versions 7.4 through 8.1 for organizations building PHP themselves. The security firm VirusTotal estimated in a post analyzing the exposure window that more than 5.1 million PHP hosts are reachable from the internet, with roughly 3.8 million exposing at least one open port to attackers.

Machines built to defend, and to attack

The discovery credits illustrate how quickly AI-assisted vulnerability research has moved from novelty to routine practice at major technology companies. Calif, a research firm working under OpenAI's "Patch the Planet" initiative to audit open-source software, and OpenAI's own security team each reported the same root cause in mid-August, using the company's GPT-5.6 Sol model. Wiz said its researchers used a combination of tools — its own Wiz Atlas AI agent alongside Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol — to chain the underlying bugs into full exploits against real applications and to adapt those exploits across different PHP versions, configurations and memory layouts.

Wiz credited the models with compressing what it called months of work by a world-class research team into roughly a week for a single researcher. In its writeup, the company acknowledged assistance from Google Cloud, Cloudflare, Amazon Web Services, Microsoft, Automattic, Fastly, Akamai, Imperva and Vercel in testing detections and mitigations ahead of the public release.

Wiz "has shown why frontier AI is a game-changer for cyber defense," Raluca Ada Popa, head of Gemini security at Google DeepMind, said of the research.

Wiz's own post struck a more cautious note about the same technology, stating plainly that AI has also erased a barrier that once limited who could turn an obscure memory bug into a working attack. Historically, the company said, chaining and adapting an exploit like this one across the enormous variety of PHP configurations in production would have required rare, specialized expertise; with current models, it does not.

A leak forced the release forward

The rollout was itself disrupted. The PHP Foundation said the vulnerability identifiers leaked online on October 20 carrying an inflated severity score of 10.0 and an incorrect release date, prompting the project to move its coordinated release up from Thursday to Wednesday at 14:00 UTC. The security firm watchTowr, which had been briefed under embargo, noted publicly that researchers had expected to wait until Thursday morning. Compounding the disruption, the container-image company Chainguard published builds already containing the fix at 7:41 a.m. UTC Wednesday — more than six hours before the coordinated release — and Calif separately and mistakenly published a video demonstrating its proof-of-concept exploit, which the PHP Foundation said may have accelerated the timeline for attackers to develop their own working exploits. The project said it had not identified any functional, publicly available exploit at the moment of release.

Who is affected, and what comes next

The U.S. National Security Agency urged organizations that cannot immediately patch to take affected servers offline, and Britain's National Cyber Security Centre issued similarly direct guidance in an advisory published Wednesday, telling organizations to inventory every internet-facing PHP installation, update immediately, apply temporary mitigations if an update is not yet possible, and consider disconnecting systems that cannot be protected quickly. Cloudflare said it had deployed temporary firewall rules and was already observing early attack attempts against its network hours after the patches shipped, underscoring the urgency facing hosting providers, web agencies and the small businesses that depend on them.

• Administrators unable to patch immediately were advised to disable session upload-progress tracking, set conservative memory and upload-size limits, and isolate PHP workers using container or cgroup limits.
• Organizations running PHP 8.1 or earlier, which no longer receives official security support, were urged to migrate to a supported release rather than rely on mitigations alone.
• The PHP Foundation said administrators should treat official patching as the only complete fix, since none of the interim mitigations fully closes the underlying flaw.

The episode has also become an occasion for PHP's stewards to confront how thinly resourced the project's security work has long been. The Foundation disclosed that an earlier, Quarkslab-led security audit from 2024 had identified early warning signs of the same bug class but that follow-up work stalled for what it described as structural reasons within its small volunteer security team. In response, the Foundation said it created a new Ecosystem Security Team in May, brought on a developer as an "AI Security Engineer in Residence," and is shifting decision-making on security fixes to majority votes among several maintainers rather than a single person. It is also seeking new funding from hosting companies, cloud providers and governments that depend on the language, arguing that the volunteer-heavy model that has protected a large share of the internet for more than two decades is no longer adequate to the task.