Two flaws in the core of PHP, the programming language that serves most of the web, let an attacker run code on a server without any password at all. Both had been sitting in the language for about 14 years. Neither was found by a person reading code.
The PHP project released fixed versions on October 21, 2026 — the same day the research went public — and told administrators to install them at once, or to take their sites offline until they could.
What the bugs do
The two vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, and the PHP project describes both as routes to unauthenticated remote code execution. They carry a combined severity rating of 9.2 out of 10.
The first abuses the way PHP handles running out of memory: the interpreter can be interrupted while internal request data is only half-built, and the cleanup that follows treats the broken data as if it were sound. The second leaves internal state belonging to one request alive after the memory holding it has been released, so a later request handled by the same worker process can pick up the stale version before initialization clears it.
Wiz Research, which published the findings under the name PHP2Shell, says the pair also allows the contents of PHP's process memory to be read remotely. That memory routinely holds passwords, authentication tokens, API keys and certificates.
Because the defect is in PHP itself and not in any particular application, a site can be exposed even when its own code is written carefully. The PHP project singles out mod_php installations as the highest risk, since there an unauthenticated request can trigger the problem before a single line of application code runs.
How they were found
The discovery ran on two tracks that did not know about each other.
Calif, an AI red-teaming firm, turned up the first issue on August 1 using OpenAI's GPT-5.6 Sol. Wiz arrived independently on August 19, using Google's Gemini 4 Argon, GPT-5.6 Sol and its own Wiz Atlas system; according to Wiz, Gemini 4 Argon contributed not only to finding the bug but to building a working exploit, detecting attacks and checking the patch. Wiz reported what it had to the PHP team on August 24.
OpenAI then coordinated a group that included Wiz, Calif, the PHP project, Cloudflare, Quarkslab and US government agencies to prepare the fix before anything was said publicly.
A narrower version of the same weakness had surfaced in 2024 and was judged minor at the time.
The patch, and the scramble after it
PHP shipped four security releases on October 21: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Versions 8.1 and older no longer receive project updates; minimal backports for PHP 7.4, 8.0 and 8.1 were published for administrators willing to build from source.
The project also listed configuration changes that reduce exposure — capping request size, disabling session upload progress — while stating plainly that they do not make an installation safe. Updating is the only complete fix.
The scale of what needed updating is the uncomfortable part. PHP runs roughly 70% of all websites, and WordPress alone, which is built on it, accounts for about 40%. Palo Alto Networks identified 22.6 million instances that could be vulnerable.
Attackers moved faster than most administrators. Cloudflare recorded tens of thousands of exploit attempts within 45 minutes of the news leaking, hundreds of thousands within two hours and millions by the evening of October 21. Amazon Web Services said the flaw was "now being broadly exploited in the wild" and reported probing days before the public disclosure, which suggests the information escaped the coordinated group early.
Government agencies in the Netherlands and Finland pulled websites down as a precaution, and Archive.org went offline temporarily. The FBI's cyber division, the National Security Agency, Japan's prime minister and the European Union's computer emergency response team all urged organizations to patch.
Why this one is being read as a turning point
The technical lesson is familiar: a decade-old memory bug in widely deployed infrastructure, a rushed patch, a race against people already scanning for it.
The new part is who found it. Wiz argues the episode "marks an AI inflection point," and the reason is symmetry — the same capability that located a bug hidden for 14 years also compresses the work of turning it into a usable attack. OpenAI made the same point about its own models. TJ Sayers, of the Center for Internet Security, said the case shows AI can both surface buried flaws and convert complex exploit chains into practical attacks.
Gang Wang, of the University of Illinois, called the potential impact "massive" for sites that do not patch in time.
That cuts in a specific direction. Defenders got months of lead time here because the researchers reported privately and the patch was coordinated. Nothing about the tooling guarantees that order next time.
Reporting from the PHP project's release archive, Wiz Research and Fortune.
