PHP: 2 Critical Zero-Day Vulnerabilities Found by Frontier AI Models and Patched in Coordinated Disclosure

Two critical zero-day vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed and patched on October 21, 2026, after frontier AI models identified flaws that had persisted in the language for more than a decade, according to OpenAI's coordinated disclosure advisory and Krebs on Security. The bugs allow remote code execution and affect every PHP release from version 5.4 onward, meaning roughly a decade of PHP deployments is exposed until patched. The disclosure followed a roughly two-month coordinated response involving PHP maintainers, the security firm Wiz, Cloudflare, OpenAI and government cyber agencies.

What was the specific vulnerability?

The vulnerabilities are two critical flaws in PHP that together permit remote code execution, giving an attacker the ability to take over affected servers. Wiz, which independently discovered and reported both bugs, described their severity in stark terms: "These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history," according to the firm's reporting cited by Krebs on Security.

The affected code spans all PHP versions 5.4 or later, which Wiz characterizes as every PHP release of the last decade. The company noted that the flaws themselves were old: "The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit," Wiz said, per the OpenAI advisory. Wiz compared the flaw pair to Log4Shell, the 2021 vulnerability in the Java logging library that triggered worldwide emergency patching.

OpenAI's assessment of the pair was similar in scale. "Given the severity of these flaws and PHP's widespread use, we consider this one of the most impactful security issues in recent memory," the company stated in its advisory.

How was the incident detected?

The flaws were found twice, independently: once by Calif using OpenAI's GPT-5.6 Sol model under OpenAI's "Patch the Planet" initiative, and once by Wiz researchers, according to the OpenAI advisory. OpenAI framed the timing as a defensive advantage. "To our knowledge, frontier AI found these vulnerabilities before attackers did, opening a Defender's Window for maintainers and security providers to prepare fixes and protections ahead of disclosure," the company wrote.

Detection led into a coordinated response rather than immediate publication. OpenAI led a coalition that included PHP maintainers, Wiz and Cloudflare, and engaged the White House's "Super Intelligence Force," the Office of the National Cyber Director, CISA and international partners over roughly two months before the October 21, 2026 disclosure, per the advisory. Krebs on Security reported that Cloudflare detected some exploitation attempts and deployed web application firewall rules at 3:02 am UTC on October 21, the day of disclosure.

What is the current impact?

The impact is broad by any measure of the PHP installed base, and exploitation has already been observed. According to Krebs on Security, a Censys scan counted approximately 2.58 million Internet-facing hosts and 54.9 million web properties running PHP, and about 70% of websites need to update core software in response to the flaws. Platforms affected include WordPress, Drupal, Magento and Joomla.

Krebs also reported that experts say working exploits exist and the bugs are "already being exploited in the wild," and that widespread site outages were expected on disclosure day as operators took sites offline rather than risk compromise on unpatched servers. Wiz expects mass exploitation to install web shells on vulnerable hosts, according to the advisory coverage. The counterweight is that fixed versions shipped on disclosure day: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, meaning exposure now depends on how quickly operators apply the updates.

What are the next steps?

The immediate step for operators is patching to the fixed PHP versions, and the reporting indicates that will be slow and uneven. Wiz warns organizations will struggle to patch for some time, given the size of the installed base. Ubuntu has released updated PHP packages for its distributions, per the reporting, and OpenAI shipped a PHP version checker as a Codex skill to help administrators identify exposed deployments.

On the defensive side, OpenAI committed $1 billion in subsidized Daybreak access through a "Daybreak for Frontline Defenders" program aimed at resource-limited organizations, according to OpenAI's advisory. The disclosure also establishes a documented precedent: AI-assisted discovery of decade-old flaws is now part of the vulnerability lifecycle, and the coordination model used here, spanning vendors, researchers and government agencies, is the process OpenAI and Wiz describe for handling AI-found bugs. Operators running PHP on Internet-facing systems should treat unpatched hosts as actively targeted, based on the exploitation Cloudflare has already observed.

By the numbers

Source snapshot