Critical vulnerabilities in PHP, the open-source language that powers a large share of the web, were disclosed on October 21, 2026 after being found with the help of AI models. The discovery was serious enough that governments and organisations in Europe and the United States took websites offline temporarily while they applied fixes.
Cloudflare, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, collectively referred to as “php2shell”. According to Wiz, the flaws enable remote code execution and Heartbleed-style memory disclosure in the core PHP engine.
How the flaws were found
OpenAI said its Calif system identified a critical flaw using GPT-5.6 Sol as part of its Patch the Planet initiative, with Wiz independently discovering and reporting both vulnerabilities. OpenAI described the disclosure as one of the most impactful security issues in recent memory, and warned that the same capabilities can also help attackers build exploits faster.
OpenAI also said frontier AI found these vulnerabilities before attackers did, creating what it calls a “Defender’s Window” for maintainers to prepare fixes. PHP’s maintainers led the fixes and release, with partners contributing research and coordination.
What to do if you run a website
The advice from PHP’s maintainers is direct: all PHP users are strongly encouraged to update immediately. Cloudflare deployed WAF protections ahead of the public disclosure so that customers behind its network had some coverage in place.
OpenAI published a PHP version checker as a Codex skill to help operators identify whether they are running a potentially vulnerable version. If you manage a site, the useful first step is to find out which PHP version your server actually runs, then check it against the patched versions rather than guessing from your hosting panel.
One practical caution: an automated check can flag a version that turns out to be fine after your host applied a patch outside the normal release cycle. Confirm with your host before changing anything.
If you are also responsible for site access, our guide to adding a second WordPress admin account covers the recovery setup worth having before an emergency.
What we did not do
We did not run a PHP environment, test the exploits, or verify any patched version ourselves. We also could not verify the affected-version range independently of the disclosures cited below. OpenAI’s own account of the discovery is a first-party statement, not an independent audit.
Sources
- Cloudflare — Cloudflare deploys protections against php2shell vulnerability
- Wiz — PHP2Shell: AI uncovers critical RCE vulnerabilities
- OpenAI — Patch the Planet: global response coordination
- BBC News — PHP: What is it and why did it spark a global cyber security scramble?
- Honest Fred — GitLab Patches Critical CI/CD Flaw
