AI Models Helped Find Two Critical PHP Flaws. Here Is What Site Owners Should Do
OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon helped uncover two serious bugs in PHP, the language behind much of the web. Patches are out on October 21.
Two critical security flaws in PHP, the programming language that runs a huge share of websites, were disclosed on October 21, and AI models played a real part in finding them. OpenAI says its GPT-5.6 Sol model helped the security team at Calif spot one of the bugs as part of the Patch the Planet initiative. Separately, the security company Wiz found both flaws on its own, using its Wiz Atlas platform together with Google’s Gemini 4 Argon and GPT-5.6 Sol. The PHP maintainers released fixes the same day.
Wiz calls the bugs “PHP2Shell”. They sit in PHP’s core engine and involve how it handles fatal errors, especially running out of memory. In plain terms: when one request crashes badly, it can leave a bit of corrupted internal state behind, and the next request handled by the same worker may trip over it. The bugs are tracked as CVE-2026-109618 and CVE-2026-109619, with a severity of up to 9.2 out of 10. The worst outcome is remote code execution, meaning a stranger could run commands on your server without logging in, or read memory that may hold passwords and API keys. Wiz says almost every PHP version of the last decade, back to 5.4, has at least one of the bugs. It demonstrated the attack against current WordPress, Drupal and Joomla container images, though it does not report attacks in the wild.
The fix was coordinated over two months with PHP’s developers, Wiz, Cloudflare and US agencies including CISA. OpenAI also published a small tool, php2shell-checker, that lets operators check their PHP version. Cloudflare, Fastly and Vercel offered temporary protections for people who cannot patch right away.
What’s behind it: finding bugs like these used to take specialist researchers a lot of time. Frontier models now speed up the hunt, and also the work of turning a bug into a working attack and checking that a patch holds. That cuts both ways. OpenAI itself warns that the same skills help attackers, and Wiz says exploits that once looked too costly to build are now within reach. Worth knowing: the claims about how much the AI contributed come from the companies involved, and neither post gives much detail on method.
What this means for you: if you run a website, a blog or an online shop on PHP (WordPress counts), the one thing that matters is updating. Ask your hosting provider whether the October 21 PHP security release has been applied, or run the checker if you manage your own server. Patching is the only complete fix. If you only visit websites, there is nothing for you to do, and that is fine. For the rest of us, the lesson is that security patches are about to arrive faster and in larger batches, so turning on automatic updates is a sensible habit.
Sources
Source: https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/
Reflection's Beam: A US-Built Open-Weight Coding Model You Can Try Free on Ollama
Reflection AI's first open-weight model, Beam, targets coding and agents under an Apache 2.0 licence and is free on Ollama Cloud for a limited time.
