Today for AI
HOT RADAR
toolsHEAT 0.0°

AI CURATED HOT STORY · 10/21/2026

AI Discovers Critical PHP Flaws, Urging Global Upgrades

10 reports archived0 independent sourcesupdated 10/23/2026, 19:04:53
Synthesis & Latest Updates

Security firms Calif and Wiz utilized frontier models like GPT-5.6 Sol and Gemini 4 Argon to independently discover two critical remote code execution (RCE) vulnerabilities in the PHP core engine. Dubbed "PHP2Shell," these flaws allow unauthorized attackers to hijack servers, impacting major CMS platforms like WordPress and Drupal across all versions since PHP 5.4, affecting approximately 70% of global websites.

Cross-verified reports indicate that while human audits identified similar weaknesses in 2024, fixes stalled; AI completed months of work in just one week. OpenAI and Google confirmed their models enabled a "defender's window," allowing patches to be released before malicious exploitation. Although Cloudflare detected early attack attempts, official emergency patches were issued on October 21, 2026, emphasizing that temporary configurations or CDN blocking are insufficient solutions.

This event validates AI's disruptive efficiency in automated code auditing and zero-day discovery, sparking industry debates on AI as both a defensive tool and a potential attack enabler. Developers must immediately upgrade to specific PHP maintenance versions to mitigate server takeover risks, highlighting the critical value of AI-driven security response mechanisms in the open-source ecosystem.

LATEST/PHP officially released emergency patches a day early, with OpenAI launching Codex skills to help users identify vulnerable versions. Cloudflare has detected early attack attempts, urging all sites running PHP 5.4+ to upgrade immediately to eliminate RCE risks.

Hourly heat curve

168 fully observed hours
Now
0.0
Peak
58.007:00
24h change
–

The line compares only sources observed throughout; gap hours are interpolated to keep the trend continuous.

Coverage timeline

Total 10 reports · Latest first
  2. Latent SpaceT1·78 pts

    OpenAI Discovers Critical PHP Vulnerabilities Using GPT-5.6 Sol

    • GPT-5.6 Sol successfully identified widespread core PHP vulnerabilities, validating AI's effectiveness in complex code auditing.
    • OpenAI funded security research via the Daybreak program, accelerating the commercialization of AI-assisted cyber defense.
    • Multiple parties (including Wiz/Google) independently discovered the same flaw, highlighting the proliferation of AI tools in the security ecosystem.
  4. IT之家 · IT业界T2·78 pts

    OpenAI Helps Patch Critical PHP Flaws Affecting 70% of Web

    • Two critical PHP vulnerabilities (CVE-2026-109618/19) with CVSS 9.2 allow unauthorized RCE; emergency patches released.
    • OpenAI used GPT-5.6 Sol to assist in vulnerability discovery, demonstrating AI's role as a 'defender's window' tool.
    • OpenAI commits $1 billion to 'Daybreak for Frontline Defenders' to subsidize AI security tools for resource-constrained critical infrastructure.
  5. The DecoderT2·78 pts

    GPT-5.6 and Gemini 4 Discover Critical PHP Vulnerability

    • Both GPT-5.6 Sol and Gemini 4 Argon successfully located a severe PHP RCE vulnerability before malicious actors did.
    • Wiz leveraged these models to accelerate the entire lifecycle from vulnerability discovery and exploit development to patch validation.
    • The incident fuels industry debate on AI serving as both a defensive tool and a potential enabler for attackers.
  7. 宝玉 (@dotey)T2·88 pts

    AI-Assisted Discovery of Critical PHP RCE Vulnerabilities Forces Urgent Global Patching

    • PHP disclosed unauthenticated RCE vulnerabilities affecting all versions since 5.4, impacting major CMSs like WordPress and Drupal.
    • OpenAI and Google confirmed that GPT-5.6 Sol and Gemini 4 Argon assisted security firms in early vulnerability discovery, validating AI as a defensive tool.
    • Temporary configs or CDN blocking are insufficient; the only complete fix is immediate upgrading to PHP 8.5.12/8.4.27/8.3.36/8.2.35.
  8. Hacker News AIT2·85 pts

    AI Uncovers Critical PHP2Shell Vulnerabilities Affecting 70% of Web

    • PHP2Shell is a family of memory-safety vulnerabilities in core PHP involving OOM handling corruption and stale global state.
    • Discovered via AI assistance by Wiz Research and OpenAI Codex Security, the vulnerabilities carry a critical CVSS score of 9.2.
    • With PHP powering ~70% of websites (including WordPress and MediaWiki), the potential impact scope is massive.