AI Found PHP's Holes First. Then the Secret Leaked

For about seventy-two hours this week, a large slice of the public internet behaved like a building with a gas leak: everybody knew something was wrong, the people who knew where were arguing about who got to open the windows first.

The technical facts are simple enough. Two flaws in PHP, the server-side language that still runs an estimated seventy percent of the web, allowed unauthenticated remote code execution. They were tracked as CVE-2026-109618 and CVE-2026-109619, scored 9.2, and nicknamed "php2shell." CISA told organizations to patch to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 immediately, and to take systems offline if they could not (CISA alert).

The more interesting facts are about how the bugs were found and how the announcement fell apart. That part is a preview of the next several years of software security.

A Fourteen-Year-Old Hole, Found in Weeks

The bug had been sitting in PHP for roughly fourteen years. A limited version surfaced in 2024 and was dismissed as low-impact (BBC). Frontier models turned that vague suspicion into working exploits.

The discovery came out of OpenAI's Patch the Planet program. The security firm Calif found the flaw class on August 11 using GPT-5.6 Sol, Google-owned Wiz independently discovered both vulnerabilities with its own AI stack, and OpenAI's internal team found a fuller version in September (OpenAI, TechCrunch). Wiz called them among the most severe vulnerabilities ever discovered in PHP and estimated seventy percent of websites are exposed; the BBC said it could not verify that figure.

Read that timeline again. A fourteen-year-old hole in the world's most-deployed web language, found within weeks once capable models were pointed at the codebase. That is not a one-off. It is a new baseline rate of discovery, and nobody has refitted the institutions around it.

The Embargo Collapsed Before the Patch Did

Coordinated disclosure exists because the gap between "fix exists" and "fix installed" is where people get hurt. This week that gap was measured in hours and it did not hold.

CVE identifiers started circulating on forums on Tuesday, October 20. The PHP maintainers pulled their release forward a day. Calif published a proof-of-concept video against live targets and deleted it, but copies spread. Then Chainguard, a distributor that had received the patch in advance so its users could update instantly, published images containing the fix at 07:41 UTC on October 21, more than six hours before the scheduled release. The PHP Foundation called that a unilateral break of the embargo that "disregarded weeks of work by many parties toward a coordinated disclosure" (Politico).

The result: for part of a day, anyone could diff the patch and reverse-engineer an exploit while ordinary operators were still waiting for the advisory. VulnCheck soon demonstrated an exploit that defeated ASLR on x86-64, and a third PHP2Shell-class bug was identified without an emergency fix being issued.

The response was improvised at national scale. Finland shut down government public web services. The Dutch cyber agency took its own site offline. More than thirty UK government services went dark, along with Edinburgh council pages and parts of the BBC itself. The NSA and the UK's NCSC both told operators to patch or pull the plug, and Japan's prime minister posted the advice publicly (AP).

The Defender's Window Is Now a Logistics Problem

OpenAI's framing is that frontier AI found these flaws before attackers did, opening a "Defender's Window." That is true and it is also the narrowest possible reading of the situation. A window only helps if defenders can move through it faster than the leak spreads, and this week they could not, because the defenders are thousands of separate organizations with ageing PHP builds and no inventory.

OpenAI's answer is a five-stage framework: validate and fix upstream, give affected organizations advance notice, coordinate with government agencies, prepare updates across affected products, then publish guidance and push deployment. It also committed one billion dollars in subsidized Daybreak cyber tooling for "frontline defenders" protecting essential services, and shipped a PHP version checker as a Codex skill so operators can audit their own exposure.

Worth noting how much of that is institutional work rather than model work. Maintaining a disclosure list, deciding who gets a working proof of concept and when, briefing NCSC and CISA, and getting a WAF rule to hosting providers: none of this is a capability problem. It is coordination latency, and coordination latency is now the binding constraint on AI-era security.

OpenAI president Greg Brockman went further, arguing that authorized defenders such as governments should be able to scan for vulnerable servers and, in extreme cases, patch them remotely. That idea is a policy minefield, and it is coming anyway, because the alternative is watching critical services stay unpatched for months.

What Builders Should Change on Monday

If you run production systems, four things follow from this week.

Inventory your runtime, not just your dependencies. PHP hides inside WordPress installs, abandoned admin panels, vendor appliances and FrankenPHP sidecars. The reason thirty UK services went offline is that nobody had a complete list. Run the scan before the next emergency, not during it.

Treat patch latency as a design constraint. The exploitable window now opens the moment a patch ships, because distributors publish fixed artifacts and researchers diff them. If your deploy pipeline needs a change-freeze window to ship a PHP update, that pipeline is the vulnerability.

Stop assuming the embargo protects you. Two parties broke this one within hours. Plan for disclosure to arrive simultaneously with the exploit, and pre-stage WAF rules and feature flags.

Assume AI on both sides. Wiz used its Atlas agent with Gemini and GPT-5.6 Sol. Attackers will point equivalent tooling at your stack, and OpenAI expects similar findings to "increase sharply in the coming months."

For teams building agents, there is a second lesson. OpenAI shipped its PHP checker as a Codex skill rather than a standalone tool, which is the shape most security work will take: a capability packaged as an agent skill and dropped into an operations workflow. If your platform cannot execute and audit third-party skills, you inherit the same coordination problem in a different place.

What Comes Next

The uncomfortable conclusion is that the discovery problem got solved faster than the deployment problem. Models can now find internet-scale vulnerabilities in weeks. Getting a fix into a ten-year-old WordPress install in a small municipality still takes a procurement cycle.

Expect three things: more AI-found critical bugs in widely used open-source components, a hardening fight over disclosure norms, and pressure to give defenders automated remediation powers they have never had.

For AI builders specifically, the strategic read is straightforward. The bottleneck moved from intelligence to logistics. Anyone selling patch orchestration, software inventory, sandboxed execution, or agent-driven remediation is selling into the exact gap this week exposed.