AI-Discovered PHP2Shell Flaws Trigger Global Patching Race as Exploit Attempts Hit Millions

Two critical vulnerabilities in PHP, collectively dubbed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, were patched on October 21, 2026, after being uncovered with AI assistance by researchers at cybersecurity firms Calif and Wiz, working alongside OpenAI. The flaws, which affect a programming language powering roughly 70% of the internet, can allow unauthenticated attackers to remotely execute malicious code on vulnerable servers and read memory containing sensitive information such as passwords. CVE-2026-109618, rated 9.2 on the CVSS scale, enables remote code execution through memory corruption during out-of-memory handling.

OpenAI's GPT-5.6 Sol model independently identified CVE-2026-109618 through the company's "Patch the Planet" initiative in August 2026, while Wiz Research independently discovered and reported both flaws using a combination of Google's Gemini 4 Argon, Wiz Atlas, and GPT-5.6 Sol. The coordinated disclosure was complicated when details of the vulnerabilities leaked publicly on October 20, one day ahead of the planned embargo date, forcing the PHP security team to accelerate its release timeline. Fixes shipped on October 21 at approximately 13:30-14:00 UTC in four simultaneous PHP releases: versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35.

Cloudflare logged the first exploit attempts at 07:43 UTC on October 21, hours before the patch window opened, and subsequently reported millions of exploit attempts in total. Cloudflare CTO Dane Knecht deployed web application firewall rules to all customers including free-tier users as a stopgap, while urging operators to apply the official patches directly. OpenAI pledged $1 billion in subsidized access to its Daybreak platform for frontline defenders. The European Commission, ENISA, CERT-EU, and Europol jointly advised organizations to identify PHP-based applications, coordinate with hosting providers, and apply updates immediately. A potential CISA listing on the Known Exploited Vulnerabilities catalog would impose mandatory patching deadlines for U.S. federal agencies.