AI-assisted PHP memory-safety flaws disclosed and patched October 21, 2026
Article timeline
The articles in this story. Times are ET.
Greg BrockmanOfficialPickGreg Brockman says a coalition coordinated disclosure of the PHP php2shell bugAIGreg Brockman says a coalition led by OpenAI spent two months mitigating php2shell, a PHP bug present for 14 years that allows attackers to execute code on nearly all deployed PHP applications. The bug was found using OpenAI's models as part of its Patch the Planet initiative, and the public release moved up to October 21 after details leaked early. Brockman says current manual patching will not scale and that defenders need stronger models than attackers.
Ethan MollickXOpenAI models help find critical security flaws in PHP before disclosureAIEthan Mollick says companies he talks to are struggling with the rate of patches they must apply because AI defenses find issues before attackers' AI can use them. He adds that consumers will soon face the same frequent, fast updates. Quoting OpenAI, he cites its Patch the Planet work, in which OpenAI models helped researchers find critical flaws in PHP, a language used to run an estimated 70% of websites. OpenAI says a coalition spent two months preparing fixes ahead of disclosure.
- Wired · AINewsPickPHP Foundation releases emergency patches for two critical vulnerabilities
AIThe PHP Foundation released emergency security updates on Wednesday for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which it says affect all PHP installations serving web requests back to PHP 5. Only PHP 8.2 and newer still receive official patches, while some distributions and vendors provide legacy fixes, and the foundation says there are no complete mitigations. Security firms and agencies warned that attacks could begin quickly, and some government and port websites went offline while updates were applied.
Andrew CurranXPickOpenAI says AI-found PHP flaw is part of a larger vulnerability waveAIOpenAI says models helped researchers find critical security flaws in PHP, an open-source language used by an estimated 70% of websites, and that fixes were prepared with maintainers before disclosure. OpenAI also says it has found several other significant vulnerabilities and expects similar findings to increase in coming months. The author is relaying OpenAI's post and image text, which the source does not quantify beyond these claims.
OpenAIOfficialPickOpenAI models help find critical PHP security flaws before disclosureAIOpenAI says its models helped researchers find critical security flaws in PHP, an open-source language it says runs an estimated 70% of websites. The company led a two-month coalition of maintainers, researchers, and security providers to prepare fixes and protections before disclosure. Every PHP site can now upgrade to a patched version, alongside mitigations from security vendors.
- Hacker News · AI (150+ points)BlogPickWiz finds critical PHP flaws that AI helped turn into remote code execution
AIWiz Research reports multiple memory-safety vulnerabilities in core PHP, grouped under two CVEs with severity up to CVSS 9.2, that allow unauthenticated remote code execution and memory disclosure. Every PHP version released in the last decade is affected by at least one bug, and PHP released patches on October 21, 2026. Wiz says frontier AI models helped chain the flaws and adapt working exploits across WordPress, Drupal and Joomla in hours, and urges immediate patching.