AI Found Decade-Old Flaws in PHP, the Code Behind Most of the Web, and the Patch Race Is On
PHP shipped emergency fixes on October 21 for two critical core-engine flaws, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell, which allow unauthenticated remote code execution and memory disclosure across PHP versions 5.4 through 8.5.11. The bugs had been present for over a decade and were found with help from frontier AI: Calif used OpenAI's GPT-5.6 Sol under OpenAI's Patch the Planet effort, while Wiz independently found both with help from Google's Gemini 4 Argon. CISA urged immediate patching to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and OpenAI warned that similar AI-driven…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.