PHP2Shell: AI models find critical flaws in the PHP core

What this is about

The AINews newsletter (Latent Space) leads with the story of the day: two parties independently discovered two memory bugs in the core of the PHP scripting language, which the newsletter says powers about 70% of the web. The flaws are called PHP2Shell (CVE-2026-109618 and CVE-2026-109619). One discovery came from Ryan Austin of security firm Calif, as part of OpenAI's "Patch the Planet" project in August 2026, using GPT-5.6 Sol. The other came from Wiz (now part of Google Cloud), which used Gemini 4 Argon, GPT-5.6 Sol and its own tool, Wiz Atlas. The newsletter notes that every big security announcement also carries some marketing, and that it's an open question whether this is a Log4Shell- or Heartbleed-scale event.

Background: just under two months ago, OpenAI introduced "Daybreak for Frontline Defenders", a USD 1 billion grant for access to cyber models.

What the flaws are

According to the researchers' description, the bugs lie in PHP's internal handling of out-of-memory situations (memory is full) and fatal errors, not in a WordPress plugin or login logic. Demonstrated impacts:

• Unauthenticated remote code execution (RCE, running foreign code on the server) against WordPress, Drupal and Joomla.
• Remote memory disclosure against any PHP application ("Heartbleed-style").

These are the researchers' claims. The newsletter cautions against concluding that every installation is instantly exploitable.

Timeline

1. Discovery and quiet coordination: About two months before disclosure. OpenAI says it led a coalition of maintainers, researchers, security firms and governments; the patch required a major change to the PHP engine. One researcher involved confirms the collaboration with the PHP Foundation. These are participants' accounts, not an independently verified timeline.
2. Warnings and patch window: Japanese posts warned of a release at 23:00 JST on October 21, matching Cloudflare's 14:00 UTC.
3. Pre-emptive filtering: Cloudflare switched on WAF rules (web application firewall, which filters attacks before they reach a site) for all customers, including the free tier. Its CTO explicitly called them a stopgap and said operators must patch. "Early attacks" had appeared, with no figures on successful breaches.
4. Warnings: The NSA advised preparing an immediate update and taking systems offline if no prompt fix is possible. OpenAI later said upgrades were available.
5. Claimed fallout: The Rundown reports that details leaked early. Viral roundups cite about 1.5 million servers without a fix (per Censys), shutdowns at Dutch institutions, Wikipedia, Archive.org, Asana, GOG and others, and a warning from Japan's prime minister. None of this is backed up in the material by an advisory, measurement or status page; it also remains unclear whether outages were precautions, patch interruptions or attacks. SemiAnalysis does report that Japan's prime minister urged immediate patching or disconnecting from the network.
6. Checking aid: OpenAI published a repository with a Codex skill meant to help operators check their systems. It doesn't replace a vendor advisory.

Missing from the material: a PHP Foundation advisory, the exact affected and fixed versions, CVSS scores and the patch commit. So the source doesn't support a concrete instruction like "update to version X".

The role of AI and the credit dispute

According to the newsletter, the evidence is stronger than a mere benchmark promise: researchers describe working exploit chains, patch development, detectors and patch validation. OpenAI talks about the "Defender's Window", meaning models finding bugs before attackers do. But the wording is "to our knowledge", which is no proof that nobody else knew about the flaw. Google touts Wiz tests in which Gemini 4 Argon found more than twice as many vulnerabilities as baseline models; the dataset, baselines and false positives aren't disclosed.

Access policy is hotly debated: one researcher praises OpenAI's vetted Daybreak access, while another sharply criticizes Anthropic (that's opinion). Anthropic reportedly delayed broad access to Mythos models by four months to strengthen cyber defenses. A rise in reports is not automatically a rise in AI-caused breaches.

Practical consequences for operators

• The problem is as much about distribution as discovery: PHP lives in hosting, containers, appliances, workers and legacy applications.
• A WAF reduces risk but can give a false sense of security; patching remains mandatory.
• The NSA's take-offline advice is conditional, not for everyone.
• The suggestion to use the RCE to patch all servers automatically would be unauthorized access.
• There's a dilemma between constant updates (supply-chain risk) and delay (open vulnerabilities).
• Sarah Guo cites a rise in CVEs from roughly 4,000 to 15,000 per month since April; not independently verified.

The newsletter recommends: get the official advisories, inventory affected runtimes, deploy temporary protection, install vetted packages, verify running processes and hunt separately for exploitation. An update closes the hole, but it doesn't prove credentials were never stolen.

Reactions

Cautious voices such as Joshua Achiam compare the situation to March 2020 and advise keeping backups. Skeptics call for precision: Alex Johnson distinguishes unauthorized transfers from fraud, and Kelsey Piper warns of the mental toll of doom rhetoric. Personal security tips (password managers, MFA) don't help against an unauthenticated engine flaw. SemiAnalysis reports 18 Japanese companies with data breaches since September 25; a link to PHP2Shell is not established.

More from the newsletter

• Flint (Recursive): Apache-2.0 coding MoE with about 40B total parameters, 2.5B active, 262K context, and per LM Studio roughly 24 GB needed locally; vendor figure: 74.2% on SWE-bench Verified.
• DeepSeek DeepInfer: Open-source inference framework; the revenue of about USD 38 per accelerator-hour is revenue, not profit.
• Mirendil: Claims a base model built by one researcher in 3.5 months for under USD 10 million; independent verification is pending.
• Anthropic: Claude Duet as a research preview; API version 2026-10-21 removes temperature, top_p and top_k.

Takeaway

The case shows that AI models can now find vulnerabilities in critical base software, with demonstrable benefit for defense, as the coordination with PHP maintainers, Cloudflare and government agencies shows. At the same time, the picture is noisy: versions, severity, the extent of exploitation and the causes of the reported outages aren't backed up in the source. As an operator, check the official PHP and distribution advisories, not viral summaries. The newsletter expects at least a year of further findings like this and thinks blaming the messenger is wrong.