Independent newsroom

Thursday, October 22, 2026

The File

Every claim traces to a primary source. Uncertainty is labeled. Corrections are public.

Security · Thursday, October 22, 2026

PHP ships emergency fixes for two flaws found with AI

The File desk · Oct. 22, 2026, 6:40 a.m. ET

Confirmed4 primary sources

Status

Confirmed from the PHP project's Oct. 21, 2026 advisory and a same-day alert from the Cybersecurity and Infrastructure Security Agency. Who found the flaws is attributed to the companies that wrote it. The share of the web that runs PHP is a company claim.
  • Confirmed
    PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619. CISA said to patch immediately and that it had not seen exploitation as of publication.
  • Confirmed
    OpenAI says a researcher named Calif found one flaw using GPT-5.6 Sol, and that Wiz independently found and reported both. Wiz says it used Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol.
The people who maintain PHP, software that runs a large share of websites, released emergency fixes on Wednesday for two flaws that can let a stranger take over a server without a password. The U.S. cyber agency told organizations to patch “immediately.”12
The PHP project said that versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619. It said every PHP installation that serves web pages is affected, and that the risk is highest when PHP runs inside the Apache web server. It also said there is no complete workaround, and that updating is the only safe choice. Older PHP 8.1 and earlier no longer get project updates, though the security team said it offered minimal source fixes for PHP 7.4, 8.0, and 8.1.1
The Cybersecurity and Infrastructure Security Agency used the name “php2shell” and said it had not observed exploitation “as of the time of publication.” Organizations that cannot update, or that still run PHP 8.1 or earlier, “should take PHP-based systems offline until they can be patched or updated,” the alert says.2
OpenAI wrote that Calif found one critical flaw using GPT-5.6 Sol, and that Wiz independently discovered and reported both. Wiz wrote that it discovered the first flaw on Aug. 19, 2026, using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol. Wiz's claim that PHP “powers 70% of all websites” is the company's. OpenAI's line that frontier AI found the bugs before attackers did is also the company's, qualified with “to our knowledge.” OpenAI said it committed $1 billion in subsidized access for frontline defenders. That figure is the company's.34
Why it matters (Estimate). Estimate. If you run a website, a blog, or an online store, there is a real chance it uses PHP, including through WordPress or a host you do not think about. The fix is to update, or to ask the host to update, and to take an unpatched older system offline until that happens. The same tools that helped find the flaws can help attackers, which is why the patch matters now, while the agency says it has not seen the bugs used.
The PHP release notes for 8.5.12 say there are no complete mitigations, and that updating is the only safe choice.
How we know

Notes

  1. 1.PHP Group, “Security advisory: Critical remote code execution vulnerabilities, update now,” Oct. 21, 2026. https://www.php.net/ “PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.” CVE-2026-109618 is described as remote code execution via out-of-memory corruption. CVE-2026-109619 is described as remote code execution via stale global state. “We consider the risk highest for mod_php.” Release notes for 8.5.12, 8.4.27, 8.3.36, and 8.2.35, same day: “There are no complete mitigations, updating is the only safe choice.” PHP 8.1 and older “no longer receive updates from the PHP project.” The security team “provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1.”
  2. 2.Cybersecurity and Infrastructure Security Agency, “Critical Vulnerabilities in PHP Require Immediate Patching,” Oct. 21, 2026. https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching “CISA strongly urges organizations to immediately patch” CVE-2026-109618 and CVE-2026-109619. “These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP.” “While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched.” Organizations that cannot update, or that use PHP 8.1 or earlier, “should take PHP-based systems offline until they can be patched or updated.”
  3. 3.OpenAI, “Patch the Planet: global response coordination as agents uncover critical vulnerabilities,” Oct. 21, 2026. https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities “Calif identified a critical flaw using GPT-5.6 Sol as part of our Patch the Planet initiative, with Wiz also independently discovering and reporting both vulnerabilities. PHP’s maintainers led the fixes and release.” “To our knowledge, frontier AI found these vulnerabilities before attackers did.” “we’ve committed $1 billion in subsidized Daybreak access through Daybreak for Frontline Defenders.” The model name is printed as OpenAI writes it.
  4. 4.Wiz Research, “PHP2Shell,” Oct. 21, 2026. https://www.wiz.io/blog/php2shell-php-rce “core PHP, a popular general-purpose scripting language that powers 70% of all websites in the world.” Timeline: “August 19, 2026: Wiz Research discovers the first PHP vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol.” The model names are printed as Wiz writes them. The 70 percent figure is Wiz's claim.

What is still unknown or disputed

  • Whether anyone started exploiting the flaws after the alert. CISA's “not observed” line is as of publication.
  • Which of the two flaws Calif found. OpenAI says one flaw. Wiz says it reported both.
  • A precise share of websites on PHP, beyond Wiz's claim.

Primary sources

Every claim in this story is drawn from the documents below. If a fetch failed, that is recorded on the card.

  1. Source 1

    Security advisory: Critical remote code execution vulnerabilities

    PHP Group · October 21, 2026

    PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution.

    https://www.php.net/

  2. Source 2

    Critical Vulnerabilities in PHP Require Immediate Patching

    Cybersecurity and Infrastructure Security Agency · October 21, 2026

    CISA strongly urges organizations to immediately patch CVE-2026-109618 and CVE-2026-109619. Exploitation had not been observed as of publication.

    https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching

  3. Source 3

    Patch the Planet

    OpenAI · October 21, 2026

    Calif identified a critical flaw using GPT-5.6 Sol. Wiz also independently discovered and reported both vulnerabilities.

    https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities

  4. Source 4

    PHP2Shell

    Wiz · October 21, 2026

    Wiz Research discovers the first PHP vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol.

    https://www.wiz.io/blog/php2shell-php-rce

Ask this story

Answers come only from this story and its sources. Free test: limited questions per day.

0/300