AI turned a decade-old PHP flaw into a working exploit

The biggest security story of the week is also the clearest sign yet of what AI did to exploit development. On October 21, PHP shipped patches for CVE-2026-109618 and CVE-2026-109619, a pair of memory-safety flaws with a CVSS of 9.2 that reach back to PHP 5.4 in 2012. According to Wiz Research, which documented the chain in a post titled PHP2Shell, the vulnerable code had been sitting in the engine for over a decade, and what frontier models changed was the effort needed to turn it into a working remote code execution. One researcher completed in a week what Wiz says would have taken a world-class team months.

The mechanics are worth understanding, because they are odd. The flaws are not buffer overflows in an application. They sit in PHP's own error handling: when a request hits the memory limit at the wrong moment, or a fatal error lands mid-allocation, PHP can leave partially initialized internal state behind. A later request handled by the same worker can consume that stale state, which leads to memory disclosure or code execution. Because the buggy paths run during request startup, the attack lands before application code ever runs, and Calif demonstrated unauthenticated RCE against WordPress, Drupal, and Joomla on default configurations. The bug is in the engine, so the applications' own code quality does not matter. A hello-world script on an affected version is exposed.

What the models changed

The history here is longer than the headlines suggest. The PHP Foundation's own postmortem says a core developer first found signs of the out-of-memory problem in 2024 while fixing something else, and that a potential exploit was theorized but no concrete vector surfaced. Work on a fix stalled for months because the security team could not choose between competing approaches, each with real trade-offs. That is the detail worth dwelling on: humans found the bug, humans understood the bug, and the fix still sat in a drawer.

What changed in 2026 is the exploitation half. Calif researcher Ryan Austin reported an unconditional RCE on August 11 during an audit conducted through OpenAI's Patch the Planet program, and he is blunt about method: his writeup says he picked PHP because he knew its vulnerability history, then used his LLM companion to find ways past post_max_size, to exhaust the memory limit with nested empty file uploads, and to generalize the "count before key allocation" pattern into a reusable skill. Wiz ran the same race separately with Gemini 4 Argon and GPT-5.6 Sol, and credits Gemini 4 Argon with contributions across discovery, exploit development, detection, and patch validation. OpenAI used its own models to validate reports, then spent disclosure day coordinating a five-stage response that reached from Cloudflare and Fastly to CISA and the White House's Super Intelligence Force.

Two AI claims from the disclosure deserve precision. First, OpenAI frames this as a Defender's Window: to its knowledge, frontier AI found these bugs before attackers did. That framing survives only if defenders patch within the window, and the window is not long. Second, the models did not find the decade-old flaw on their own. In both accounts, a researcher with deep domain knowledge directed the search and the model did the scaling work. Calif's Ryan Austin says no special harness or unavailable models were involved, and that knowing your target still matters. That matches the honest reading: models compress the tedium between knowing and showing, and the person still supplies the knowing.

A disclosure that leaked three times

The coordination effort deserves its own record, because it nearly failed in public. On October 20 at around 15:00 UTC, two days before the planned release, the two CVE numbers began circulating on forums with a wrong release time and an inflated CVSS of 10.0. The PHP project pre-announced at 19:30 UTC and moved the release forward a day to October 21 at 14:00 UTC. That evening, Calif accidentally published its exploit video, revealing limited details, and copies spread on social media within hours. The next morning, Chainguard broke the embargo outright, publishing fixed container images at 07:41 UTC, more than six hours before the official release. The PHP Foundation notes the obvious problem: any attacker could study the fix in binary form while every other PHP user was still waiting for their update. The team monitored appearing PoCs overnight and found no functional exploit by release time.

The counterpoint: where is the botnet?

Not everyone buys the catastrophe framing, and the skeptics have a point worth stating plainly. A widely read post from Elias Taylor, which reached the Hacker News front page, observes that ten hours after disclosure there was still no public working exploit, while GitHub filled with thousands of fake PoC repositories that fail against vanilla PHP. Some of those repos quietly install a local file inclusion flaw into their own test server so their exploit has something to exploit. His argument is that this is harder to weaponize than Log4Shell, where botnets were sweeping the internet within hours, and that LLMs are now mass-producing confident nonsense exploits on top of that noise. The PHP security team's position matches the middle ground: real vulnerability, demonstrated RCE by the researchers, no observed in-the-wild exploitation at release. Patch anyway.

What this changes for anyone running servers

The practical readout is short. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, and the PHP Foundation's instruction is blunt: if you run PHP, update now. OpenAI published a PHP version checker as a Codex skill for operators mapping their exposure. For teams that cannot patch immediately, Calif lists partial mitigations that disable session upload progress and remove the memory limit, while warning that those settings trade one risk for another. Distributions were still packaging fixes at disclosure, so check what your distro ships before assuming you are covered.

The structural question sits underneath the patching. Wiz closes its post by placing PHP2Shell next to Heartbleed and Log4Shell as a turning point, on the grounds that the decade-old flaw only became dangerous when the effort to exploit it collapsed. The PHP Foundation ends on the same worry from the other side: AI-assisted research is flooding the security team with reports, 15 CVEs since July and more than 100 invalid or duplicate submissions worked through, and finding bugs is no longer the bottleneck. Their conclusion is that experienced engineers who can review a fix for a decade-old design decision are the scarce resource now. The bugs were always there. The excuse for leaving them was the effort, and that excuse just expired for everyone, defenders included.