On October 21 the PHP team shipped patches for two vulnerabilities in the language core: CVE-2026-109618 and CVE-2026-109619, with severity up to CVSS 9.2. Wiz Research found them, and the startup Calif found them independently using GPT-5.6 Sol. Wiz calls the pair PHP2Shell.
What the flaws allow
Two things: unauthenticated remote code execution, and reading process memory in the Heartbleed sense. That memory can hold passwords, auth tokens, API keys and certificates belonging to other requests.
Where the bug lives is what matters. Not in WordPress, not in Drupal, not in your code — in the PHP engine itself. A cleanly written application gives you nothing here. Wiz puts PHP on 70 percent of all websites, WordPress, Joomla, Drupal and MediaWiki among them, which means Wikipedia too.
At least one of the two flaws affects every PHP release since 5.4. Both are remotely exploitable, in some cases without much work. Patching comes first.
Why only now
Wiz writes that the underlying architecture decisions are more than a decade old and the flaws had been there the whole time. What was missing was proof of exploitability: a chain of steps right at the edge of what human researchers can practically sustain. Frontier models lowered that barrier sharply and turned an old structural problem into a working exploit.
That’s the sentence worth keeping. The hole wasn’t new. The ability to prove it was.
Patch the Planet
OpenAI spent two months coordinating a group made up of the PHP maintainers, researchers and vendors. Wiz and Cloudflare took part, and government cyber agencies were brought in so the guidance would reach critical operators. The fix itself stayed with the PHP team.
Operations teams get a PHP version checker shipped as a Codex skill. OpenAI has also committed a billion dollars to subsidised Daybreak access, aimed at organisations protecting essential services on a small security budget.
OpenAI makes two claims that belong together. First: as far as it can tell, frontier AI got there before the attackers, and that opened a window for defenders. Second: there will be more of these, and considerably more over the coming months.
The window closes as the gap closes
This case only works because there is distance between “a frontier model can find it” and “any available model can find it.” OpenAI names that distance as the condition itself: when it’s small, maintainers have no time to coordinate. On October 20 Anthropic reported 493 security issues across 25 open source projects, with PHP in the test set. Two labs, one week, the same direction.
So the proposed framework is less a security process than a race against a lab’s own product strategy. Push capabilities out broadly and fast, and you shorten your own window.