AI helped researchers find two critical PHP flaws

The PHP project on Wednesday issued a security advisory and released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities that “can allow unauthenticated remote code execution,” urging all users to update immediately. Researchers who reported the flaws said frontier AI models helped them find and exploit the bugs, which they call PHP2Shell.

The flaws: The researchers’ disclosure site describes PHP2Shell as a family of memory-safety vulnerabilities in core PHP, rated as severe as CVSS 9.2. CVE-2026-109618 involves out-of-memory handling that can interrupt PHP while request data is only partly set up, and CVE-2026-109619 involves stale global state that survives across requests, according to PHP’s advisory. The site says websites can be affected even when their own application code is secure.

Who is at risk: PHP said all installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, and that it considers the risk highest for mod_php. PHP 8.1 and older no longer receive project updates, though PHP said its security team provided minimal source backports for PHP 7.4, 8.0 and 8.1, and that Linux distributions and LTS vendors received the patches in advance. PHP powers about 70% of websites, including WordPress, Drupal and Wikipedia’s MediaWiki, the disclosure site says. Wiz said every PHP version released in the last decade is affected by at least one of the flaws, “going back to version 5.4,” and Calif said the earliest affected path it found dates to PHP 5.4.0.

What attackers could do: The researchers said they demonstrated pre-authentication remote code execution against WordPress, Drupal and Joomla using those projects’ latest container images, and that the flaws can also expose process memory holding passwords, tokens, API keys and certificates.

Who found them: The disclosure site credits Wiz Research’s Sagi Tzadik, Shir Tamari, Nir Ohfeld and Tomer Schwartz; Amy Burnett of OpenAI Codex Security; and Ryan Austin of Calif, who Calif says did the research and write-up for its post.

The AI role: Wiz said it used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout the research, and that Gemini 4 Argon made “an invaluable contribution” to finding the vulnerability and building exploits. “With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work,” Wiz wrote. OpenAI said Calif identified a critical flaw using GPT-5.6 Sol through its Patch the Planet initiative and that Wiz independently discovered and reported both flaws. OpenAI said that “to our knowledge, frontier AI found these vulnerabilities before attackers did.” Calif’s Austin wrote that no special harness or unreleased models were used in the initial discovery, and that he relied on his own knowledge of PHP’s vulnerability history, adding that “no model is simply capable of unearthing ‘all bugs’ with simple prompts.” OpenAI said that, given the flaws’ severity and PHP’s widespread use, it considers this “one of the most impactful security issues in recent memory.”

If you can’t patch: PHP said only an update is a complete fix. It listed partial measures, such as setting memory_limit=-1, that it said reduce exposure to specific attack paths but “do not make an installation safe.”

Why it matters: PHP sits underneath a large share of the web, so a flaw in the language itself reaches sites whose own code has no bugs, as the disclosure site notes. The case also shows how the researchers describe AI’s place in security work. Wiz credits frontier models with turning decade-old weaknesses into working exploits far faster than before, and OpenAI ranks it among the most impactful security issues in recent memory. Calif’s account adds a counterweight: its researcher says human knowledge of the target steered the discovery. Taken together, the sources describe people using AI as a tool rather than AI working alone. OpenAI itself warns that the same capabilities could help attackers build exploits quickly, which puts weight on how fast operators install the fixes now that the details are public.

What’s next: OpenAI said these bugs are among several significant vulnerabilities it has found and is working to fix, and that it expects similar findings to “increase sharply in the coming months.” It has asked the security community for feedback on its proposed framework for coordinating such disclosures.