PHP knew about PHP2Shell's flaw in 2024. AI made it exploitable.

PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October, closing two memory-safety holes that let an unauthenticated request execute code on a web server. The patches are the least interesting part. The root cause had been written down inside the PHP project two years earlier, the fix had stalled on a design argument the security team could not resolve, and what finally forced a decision was three separate groups producing working exploits within a fortnight.

What the patches close

Both CVEs are rated CVSS v4.0 9.2 by the PHP security team, and both sit in the parts of the engine every request touches: memory allocation and fatal-error handling. CVE-2026-109618 leaves partially initialised internal data behind when a request reaches memory_limit at the wrong moment. CVE-2026-109619 lets request-owned state outlive the memory it points at, so a later request handled by the same worker reads freed memory. Wiz Research, which reported both, stresses that the bugs are in PHP itself, not the application on top: a memory disclosure alone can leak passwords, session tokens, API keys and certificates from other requests.

CVE	Primitive	What Wiz demonstrated
CVE-2026-109618	Out-of-memory corruption, remote process-memory disclosure	Pre-auth RCE on WordPress, Drupal and Joomla
CVE-2026-109619	Fatal-error backtrace use-after-free, OPcache type confusion	Pre-auth RCE on Drupal and WordPress

The version range is the part to read twice. Wiz puts every PHP release of the past decade in scope, back to 5.4, while the patch covers four supported branches. PHP added minimal backports for 7.4, 8.0 and 8.1; anything older is on its own unless a distribution still carries it, and 8.2 stops receiving security fixes on 31 December. Apache with mod_php is the worst case, where an unauthenticated request reaches the vulnerable path before any application code runs. PHP's own advice: there are no complete mitigations, and updating is the only safe choice.

The note from 2024

The PHP Foundation's post-mortem, published the same day, is unusually candid, and it complicates the story the vendors told. In 2024, while fixing a finding from the project's first external audit in years, a developer contracted by the Foundation found the first signs of the out-of-memory problem behind CVE-2026-109618. That audit was Quarkslab's, funded by the Sovereign Tech Agency through OSTIF. A potential exploit was theorised that year; no concrete vector was found, and other bugs took priority.

Fixing it became a design argument rather than a coding task. Each candidate patch broke backward compatibility, opened a new denial-of-service path, or required changes across the extension ecosystem. A security team that works by consensus could not choose, and the Foundation does not soften what followed: "We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources."

That is the load-bearing correction to this week's coverage. The decade-old flaw was not invisible. It was known, documented, judged real, and left alone because nobody could agree on the shape of the repair.

Three teams, two model vendors, one fortnight

The disclosure record now has at least four start dates, and the earliest is not an AI lab's. Calif, working an audit that began on 30 July under OpenAI's Patch the Planet programme, reported an unconditional remote code execution on 11 August, with the same root cause as the 2024 out-of-memory note. OpenAI says it reported the same root cause independently on the same day. Wiz's timeline starts on 19 August, confirms Drupal on the 20th and WordPress on the 21st, and reaches PHP on the 24th.

So this is not one discovery. It is a root cause sitting in the open plus a burst of independent proofs that it could be turned into code execution, which is the harder claim.

Which model deserves credit is, conveniently, unresolved. OpenAI credits GPT-5.6 Sol, used by Calif, and describes Wiz as independently finding both bugs. Wiz credits three systems, Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, and singles out Argon for "an invaluable contribution to finding the vulnerability, exploit development, attack detection, and validation of the patch." Both accounts can be true. Neither is auditable from outside, because no published artifact maps a specific finding to a specific model decision.

Wiz's strongest quantitative claim is that "a single researcher completed in a week what previously would have taken a world-class team months of work." That is a fair description of one team's experience, not a measurement; there is no control group in the post.

What can be checked, and what cannot

Sorting the claims is worth the trouble, because the two piles are very different sizes.

Checkable: the CVE identifiers, the 9.2 score, the range back to 5.4, the four fixed releases, the 7.4, 8.0 and 8.1 backports, the 21 October date, PHP's interim configuration flags (memory_limit=-1, a low post_max_size, session.upload_progress.enabled=0, fatal_error_backtraces=0), the pre-staged detections and WAF rules from Cloudflare, Fastly, Google Cloud, Akamai, AWS, Imperva, Microsoft, Vercel and Automattic, and a PHP version checker published as a Codex skill.

Not checkable: "To our knowledge, frontier AI found these vulnerabilities before attackers did," which is OpenAI's sentence and carries its own hedge in the first three words. Also unverifiable: Wiz's "among the most severe vulnerabilities discovered in PHP, and arguably in software history," which no one can adjudicate, and the 70% of websites figure, which is Wiz's estimate and doing a lot of rhetorical work.

There is also a counterexample to the tidy version of the story. The Foundation had already run Anthropic's Claude Mythos over the PHP codebase earlier in 2026, with Alpha-Omega. That scan did not produce this. A model pointed at a large codebase is not a switch.

The window closed early

OpenAI calls the gap between discovery and disclosure a Defender's Window. This one opened on 11 August and was scheduled to shut on 22 October at 14:00 UTC. It shut a day early, and not because of an attacker.

On 20 October at about 15:00 UTC the two CVE identifiers began circulating on forums and social media, attached to a wrong release time and a CVSS score of 10.0. No technical details leaked, but PHP moved its pre-announcement to 19:30 UTC and pulled the release forward by a day. Around 20:00 UTC, Calif mistakenly published a proof-of-concept video showing the exploit working against several targets. It was deleted. Copies were not, and the Foundation says the video "contributed to accelerated development of various PoCs."

Then, at 07:41 UTC on 21 October, Chainguard published built images containing the fix, more than six hours before the coordinated release, according to the Foundation. Anyone who wanted to could study the patch in binary form while the rest of the world waited for the advisory. PHP says it monitored the proof-of-concepts that appeared afterwards and had not identified a functional exploit at the moment of release. That is a careful sentence, and it is the only one available.

The bill for the next one

OpenAI's post concedes the dual use with almost no hedging: the same capabilities that found these bugs "can also help attackers rapidly develop offensive tools and exploits." Its answer is a billion dollars of subsidised Daybreak access for organisations with limited security budgets. A company that names a risk and sells access to the tooling against it is doing nothing unusual in 2026, but the circularity is worth stating.

The PHP Foundation's ask is smaller and more structural. It has published 15 CVEs since 1 July and worked through more than 100 reports that turned out to be invalid, duplicated or irreproducible. AI helps triage that queue, but "a person makes every call and works on every patch," and the constraint is a handful of engineers who understand the engine. Anthropic's Frontier Red Team made the offensive half of this argument in September, reporting that an open-weight model could develop working exploits end to end.

PHP2Shell makes the defensive half. The flaw was known in 2024, the exploit took a fortnight in 2026, and the fix still needed two years of argument and a foundation's budget. If your installation is on 7.3 or older, the project has no backport for you.