Researchers used Frontier AI models to bring light to two of the most severe vulnerabilities found in PHP-the open-source programming language that powers roughly 70 percent of the web, and help patching the fixes.
According to Open AI, cybersecurity firm Calif and Google owned Wiz used frontier AI models like OpenAI’s GPT-5.6 Sol and Google’s Gemini 4 Argon to find the two vulnerabilities in PHP, made public on October 21.
However, it was an independent researcher by the X handle @lcfr_hax who had first discovered php2shell and developed a working exploit on August 5 this year, thereby leading to the PHP Foundation joining the OpenAI’s Patch the Planet Initiative in the same month.
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: https://t.co/I88EQFrUHa
His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
— Calif (@calif_io) October 21, 2026
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
https://t.co/TW3jrSbB3f— OpenAI (@OpenAI) October 21, 2026
“Over the past two months, we led a coalition of maintainers, researchers, and security providers to address critical vulnerabilities in PHP, an open-source programming language used to run websites and web applications. Calif identified a critical flaw using GPT‑5.6 Sol as part of our Patch the Planet initiative, with Wiz also independently discovering and reporting both vulnerabilities,” read a statement from OpenAI.
The public release of PHP patches for CVE-2026-109618 and CVE-2026-109619, two critical unauthenticated RCE flaws affecting most PHP versions, were discovered with the help of frontier models.
The flaws allow unauthenticated remote code execution on web servers.
How Severe is this Incident?
The PHP2Shell incident (CVE-2026-109618 and CVE-2026-109619) is a pair of critical unauthenticated remote code execution (RCE) vulnerabilities in the PHP language itself. They affect nearly every PHP installation that serves web requests, going back to PHP 5.4 (around 2004). PHP powers an estimated ~70% of websites whose server-side language can be identified (W3Techs data), including major CMS platforms such as WordPress, Drupal, Joomla, Magento, MediaWiki, Laravel, Symfony, among others and government/enterprise systems.
Fallouts of PHP Leaks: Governments Across The Globe Say Brace for Impact
The episode has forced cybersecurity agencies worldwide to issue urgent advisories, recommending quick updates of their devices’ operating systems and software. Many countries including the USA are shutting down government websites if the update is not available for the two patches.
The U.S. National Security Agency and CISA advised organizations to patch immediately or take affected systems offline. CERT-EU issued Advisory 2026-018 recommending isolation of internet-facing applications where immediate remediation was not feasible. The UK’s National Cyber Security Centre, Canada’s Centre for Cyber Security, Australia’s Signals Directorate, India’s CERT-In, Japan’s IPA, and Singapore’s Cyber Security Agency issued parallel alerts. Several European governments temporarily took public websites offline as a precaution.
Patching the PHP: How AI is Helping Fix the Internet Leak
OpenAI claims that through its Patch the Planet initiative, it worked with PHP maintainers, Calif, Wiz, Cloudflare and other partners to validate findings, test fixes, coordinate disclosure and prepare protections before public disclosure. OpenAI is also adversarially testing patches with frontier models to identify potential bypasses and related vulnerabilities.
However, AI does not replace human security expertise as PHP’s maintainers led the fixes and release, while researchers and security engineers helped verify findings and test remediation, according to OpenAI.
