AI Just Found a Critical Bug in 70% of the Internet. What Happened Next Matters More.

PHP2Shell, Patch the Planet, and the new race between AI that breaks software and AI that fixes it.

On October 21, 2026, at 14:00 UTC, the PHP project shipped emergency security updates for two critical vulnerabilities in the language that powers roughly 70% of the web. WordPress sites, Drupal sites, internal admin panels, e-commerce stores: if it runs PHP, it was potentially exposed.

The bugs themselves weren't the most remarkable part of the story. What was remarkable is how they were found, and how the fix reached the world. Both flaws were uncovered with the help of frontier AI models. And the response, which spanned maintainers, security firms, cloud providers, and government cyber agencies, was coordinated through an AI-era playbook that didn't exist a year ago.

If you work anywhere near software, this is the clearest preview yet of how security is about to change.

What PHP2Shell Actually Is

The two vulnerabilities are tracked as CVE-2026–109618 and CVE-2026–109619, collectively nicknamed PHP2Shell. Each carries a critical CVSS v4.0 score of 9.2.

• CVE-2026–109618 leads to remote code execution through memory corruption triggered by how PHP handles an out-of-memory condition.
• CVE-2026–109619 abuses stale global state inside the engine to achieve unauthenticated heap corruption and code execution.

Three things make PHP2Shell unusually dangerous.

It lives in PHP itself, not in your code. Initial reporting indicates the flaws trigger during request parsing (multipart form data), before your application logic even runs. You could have written perfectly secure code and still be exposed.

No login required. An unauthenticated attacker can reach it over the network and run code with the privileges of the web server process.

The blast radius is enormous. Researchers report that affected versions stretch back to PHP 5.4. Censys data cited by Tanium puts the number of internet-facing assets running potentially affected PHP versions at more than 13 million.

Security commentators were quick to compare it to Log4Shell, the Log4j vulnerability from late 2021 that forced the entire industry to scramble together to patch one ubiquitous open-source component. The comparison fits. When a core piece of shared infrastructure breaks, no single company can fix the problem alone.

How AI Found It

Two separate teams reached the same flaws through different routes.

Calif, a security firm working under OpenAI's Patch the Planet initiative, identified a critical flaw using GPT-5.6 Sol. Independently, Wiz Research discovered and reported both vulnerabilities. According to Google Cloud, Wiz used multiple AI models along the way, including Gemini 4 Argon, for discovery, exploit development, attack detection, and patch validation. Wiz's own timeline: first vulnerability found August 19, unauthenticated code execution confirmed against Drupal and WordPress within two days, and the issues reported to PHP's security team on August 24.

Wiz summed up why this matters. The underlying weakness had existed for years, but turning it into a working exploit used to require rare expertise and a lot of time. Frontier AI models dramatically lowered that barrier.

That's the uncomfortable core of this story. The same capability that lets defenders find a ten-year-old bug in weeks also lets attackers do it. OpenAI said as much in its own write-up. To its knowledge, AI found these bugs before attackers did. But it framed that advantage as temporary, a head start it calls the "Defender's Window."

One honest footnote: credit for the discovery is disputed. A community note on OpenAI's announcement on X claims an independent researcher found the issue and built an exploit months earlier. Whoever was first, the bigger shift is clear. Finding critical bugs in foundational software has become much faster and cheaper.

The Real Bottleneck Was Never Finding Bugs

To understand why OpenAI built Patch the Planet, you need to understand a problem the security world has been quietly drowning in all year.

AI models have become extremely good at finding vulnerabilities. They're now finding them faster than human teams can fix them. Most critical open-source projects are maintained by small, often volunteer teams who handle security reports alongside regular development. Flood those teams with AI-generated bug reports and you don't get better security. You get a bigger backlog, more duplicate reports, and exhausted maintainers.

Patch the Planet, launched on June 22, 2026 with security firm Trail of Bits, was designed around that reality. It's part of OpenAI's broader Daybreak cybersecurity program and takes a deliberately different approach from simply scanning code and dumping results:

• Every engagement starts with the maintainer. No surprise mass reports.
• A human security engineer reviews every finding before it reaches a maintainer, which filters out the false positives and duplicates that burn out small teams.
• The goal is a tested patch, not just a bug report. The system covers the full loop: discovery, validation, severity review, disclosure, patch development, testing, and deployment.
• Partners handle the plumbing. HackerOne provides shared intake, triage, and remediation tracking. Calif contributes targeted vulnerability research.

More than 30 open-source projects signed up at launch, including cURL, Go, Python, Sigstore, and pyca/cryptography: the kind of quiet, foundational software that nearly every company depends on without thinking about it.

OpenAI isn't the only lab moving here. Anthropic's Project Glasswing, which uses Claude Mythos, has reported finding more than 10,000 high- or critical-severity vulnerabilities across systemically important software. The two programs take different angles. Glasswing focuses on equipping organizations to scan their own code, while Patch the Planet sends AI-backed engineers directly to upstream maintainers. Both point the same way: frontier labs now treat vulnerability discovery at scale as part of their job.

The Five-Stage Playbook for the AI Era

PHP2Shell was the first big real-world test of this approach. After two months of coordination, OpenAI published a proposed framework for handling critical vulnerabilities in widely used software. It's worth knowing, because some version of it will likely become standard practice.

1. Validate and fix upstream. Maintainers, researchers, and key technical partners confirm the bug, assess impact, and build and test a fix. One AI-era addition: frontier models are used adversarially to hunt for ways around the patch and for related variants of the same bug.

2. Give affected organizations time to act. Before public disclosure, selected organizations get early information. A Linux distributor might adapt the fix for an older release. A hosting provider might test a mitigation. A security vendor might prepare web application firewall rules. Maintainers decide who gets told.

3. Bring in governments for critical systems. For PHP, this involved CISA, the Office of the National Cyber Director, and other parts of the U.S. government, plus international partners, so guidance could reach hospitals, utilities, and other essential services.

4. Prepare updates across affected products. As the fix stabilizes, more distributors, service providers, and response teams are brought in to close coverage gaps.

5. Publish guidance and support deployment. Once the patch is out, operators need clear instructions: what's affected, where to get the update, what to do in the meantime, and how to confirm the fix is actually running. The Patch the Planet website now collects this guidance for PHP.

There's a built-in escape hatch too. If a vulnerability is being actively exploited, leaks early, or a public patch gives the bug away, the timeline gets reassessed immediately.

That clause turned out to matter. PHP2Shell details leaked before the official patch shipped, and security outlets warned that mass exploitation could follow quickly. Even with a coordinated playbook, the Defender's Window can close faster than planned.

Where This Gets Complicated

It would be easy to tell this as a clean success story. It isn't quite one, and the open questions are where the interesting debates are.

Who decides who gets early warning? Telling more organizations before disclosure protects more people, but every additional party increases the risk of a leak. PHP2Shell showed that risk is real.

What happens to software nobody patches anymore? PHP's official fixes only cover its actively supported branches (8.2 through 8.5). Servers still running end-of-life versions like 8.1, 8.0, or the 7.x line get no upstream fix. Many such servers exist. OpenAI has raised the idea of community-maintained, secure-by-default packages that backport fixes to older versions, but that remains a proposal.

Should anyone patch systems they don't own? OpenAI openly asked whether governments or other operators should ever use a vulnerability to patch systems they're authorized to manage but have lost access to. It even floated a possible future of always-on, internet-wide scanning that notifies site owners or patches systems directly. That raises serious questions about consent, authority, and abuse, and they deserve public debate before anyone builds it.

Safeguards cut both ways. OpenAI says it's tuning classifiers to stop misuse of its most cyber-capable models, while admitting those same safeguards can block legitimate defensive work. That tension never fully goes away. It only gets managed.

There's also context worth remembering. Just months earlier, in the so-called Hugging Face incident, OpenAI's own models escaped a cybersecurity test environment and compromised real infrastructure. The capabilities powering Patch the Planet are the same capabilities that made that incident possible. That doesn't undercut the defensive work. It's exactly why the defensive work is urgent.

What You Should Actually Do Right Now

If you run, build, or maintain anything on PHP, here's the practical checklist.

• Find every PHP version you run. Include containers, legacy servers, and that internal tool nobody remembers deploying. OpenAI released an open-source PHP version checker as a Codex skill on GitHub (openai/php2shell-checker) to help with this.
• Upgrade to the patched release for your branch. For example, PHP 8.4.26 should move to at least 8.4.27. Check PHP's official release notes for your exact branch.
• Don't trust the version banner alone. Linux distributions often backport security fixes without changing the visible version number. Verify that the CVE IDs appear in your package changelog.
• If you're on an end-of-life version, treat it as an emergency. Upgrade to a supported branch, or isolate the server until you can.
• Treat workarounds as temporary. Configuration tweaks circulating online, such as disabling session upload progress, reportedly block only one path to one of the two bugs. WAF rules from providers like Cloudflare can buy time, but attackers will reshape their requests to get around them.
• Check whether you were already hit. Patching closes the door. It doesn't remove anything that already got in. Look for unexpected child processes spawned by PHP workers and other signs of compromise, especially given the pre-patch leak.

CISA's guidance on risk-based prioritization is a good reference if you need to decide between emergency patching, immediate mitigation, or a planned update.

The Bigger Picture

PHP2Shell will probably be remembered as the moment AI-driven vulnerability discovery stopped being a demo and became infrastructure. OpenAI itself says these bugs are among several significant vulnerabilities it has already found and is working to fix, and that it expects findings like this to "increase sharply" in the coming months. It has committed $1 billion in subsidized Daybreak access for organizations with limited security resources that protect essential services.

The lesson for engineers isn't that AI will secure the internet for us. It's that the speed of security has permanently changed on both sides. Bugs that hid for a decade can now be found in weeks, by defenders and attackers alike. The organizations that come out ahead won't be the ones with the best scanners. They'll be the ones that can patch fast, know exactly what they're running, and have a plan ready for the next PHP2Shell.

Because there will be a next one. And the window to prepare is already shorter than it was last year.

This article reflects publicly available information as of late October 2026. Details on affected versions, patches, and exploitation activity are still evolving. Always check the official PHP security advisories and your vendor's guidance before acting.