- Researchers at Calif, OpenAI and Wiz used GPT-5.6 Sol and Gemini 4 Argon to build unauthenticated remote code execution exploits for a PHP flaw first noticed in 2024, rated CVSS 9.2.
- Amazon saw an exploit attempt on October 17, the CVE IDs leaked on October 20, and a vendor shipped the fix more than six hours before the coordinated release.
- The PHP Foundation calls its two-year delay in fixing the root cause “a structural failure,” which points to maintainer capacity as the real bottleneck.
Frontier AI models turned a memory flaw that PHP's own developers had spotted in 2024 into working attacks on the language that runs about 70% of websites, and the episode shows that AI has shortened the road from bug to exploit faster than the industry's disclosure system can adapt. PHP shipped fixes for the two vulnerabilities, known as PHP2Shell, on October 21. Amazon's threat intelligence team says it logged an exploit attempt four days earlier.
Frontier models turned a two-year-old PHP flaw into exploits for WordPress, Drupal and Joomla
The underlying bug lives in how PHP cleans up after a request runs out of memory. A fatal error at the wrong moment can leave internal state pointing at memory from a previous request, which a later request can then hijack. A PHP core developer found the first signs of the problem in 2024 while fixing an issue from an external audit, but no one found a practical path to an attack, and work on a fix stalled and restarted for months.
The picture changed in August, when frontier models joined the hunt. Security firm Calif, auditing PHP through OpenAI's Patch the Planet program, reported unconditional remote code execution on August 11 using GPT-5.6 Sol, and OpenAI independently reported the same root cause that day. Wiz followed on August 24 with further attack paths built with Gemini 4 Argon, GPT-5.6 Sol and its own Atlas tool, demonstrating pre-authentication takeovers of WordPress, Drupal and Joomla. Every PHP version released in the last decade is affected by at least one of the bugs.
The models did the part that used to stop attackers. Exploiting a memory bug means chaining several flaws and adapting to each server's memory layout through repeated testing, and Wiz says AI let a single researcher do in a week what would previously have taken an expert team months. OpenAI calls PHP2Shell “one of the most impactful security issues in recent memory.”
The Defender's Window closed before the patch shipped
OpenAI's case for AI-led vulnerability hunting rests on a simple premise, set out in its Patch the Planet post: if defenders' models find a bug first, maintainers get a quiet period to fix it.
“To our knowledge, frontier AI found these vulnerabilities before attackers did.”
OpenAI, Patch the Planet, October 21, 2026
The timeline that followed tested that premise hard. Amazon's honeypot network recorded a PHP2Shell exploit attempt from an anonymized IP address on October 17, and Amazon says it remains unclear how the actor obtained exploit information during the embargo. On October 20 the CVE IDs began circulating online, a researcher's proof-of-concept video was published by mistake and copied, and on the morning of October 21 Chainguard shipped patched images more than six hours ahead of the agreed release, giving attackers a fix to reverse-engineer. PHP pulled its release forward by a full day to 14:00 UTC on October 21.
Within hours of the release, Amazon reported, multiple actors were using public exploits against its sensors, and the company now describes PHP2Shell as broadly exploited in the wild. Its conclusion is the most useful line anyone has published about the episode:
“An embargo protects defenders only until someone else finds the same bug.”
CJ Moses, CISO, Amazon Integrated Security, AWS Security Blog, October 21, 2026
Fixing the bug, and the people available to fix it, set the real limit
Discovery was the fast part of this story. The slow part ran from 2024 to August 2026, while a small team of engineers weighed competing fixes that each carried compatibility or performance costs. The PHP Foundation is blunt about it in its account of the release, calling the delay “a structural failure” caused by the security team's decision process and its lack of resources.
AI is now adding to that load faster than it relieves it. The PHP security team has published 15 CVEs since July 1 and worked through more than 100 reports that proved invalid, duplicated or impossible to reproduce. That pattern matches what Santage has tracked across the year, from XBOW's AI-built Chrome exploit chain to CISA's warning about AI-assisted attacks on critical infrastructure: models multiply findings, and the scarce resource becomes the handful of engineers able to judge and ship a fix in a decades-old codebase.
AI compressed the hunt for PHP2Shell into a week. The fix still took two years, because the bottleneck was always the handful of people who understand PHP's engine well enough to change it safely.
OpenAI's response is money and process. It has committed $1 billion in subsidized access to its Daybreak security models for under-resourced defenders and proposes a five-stage framework for coordinating fixes across maintainers, providers and governments. The PHP Foundation's request is narrower and harder: sustained funding from the companies, hosts and governments that run on PHP, so more engineers learn the engine deeply enough to make these calls.
Patch timelines for internet-facing systems now run in hours
For operators, the practical lessons are immediate. Amazon advises treating 7-day and 30-day patch targets as obsolete for critical internet-facing flaws, and starting any PHP2Shell investigation from October 17 rather than the disclosure date. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Versions 8.1 and older receive no patch, and US cyber agency CISA advises taking those systems offline until they can be upgraded.
Enter the version from php -v, for example 8.3.30.
Fixed releases: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Guidance from the PHP project and CISA, October 21, 2026. Check your distribution's advisory too, since some vendors backport fixes without changing the version number.
PHP2Shell will be remembered for the scale of its exposure, yet its more durable lesson concerns time. AI took a flaw that had sat in plain sight for two years and made it exploitable within days, and the industry's best coordination effort, backed by OpenAI, Google's models, Amazon and every major cloud, still finished behind at least one attacker. Every critical bug that frontier models uncover from here will start a race measured in hours, and maintainers will win it only if the engineers who write the fixes are funded as seriously as the models that find the bugs.
Santage is committed to independent, transparent journalism. This article is produced in accordance with Santage's Editorial Standards and aims to provide accurate and timely information. Readers are encouraged to verify information independently.