GPT-5.6 Sol Uncovers PHP Flaws Threatening 70% of the Web

Two vulnerabilities in core PHP have triggered a global security response after AI-assisted research revealed remote code execution and memory disclosure flaws that could affect up to 70% of the web. The vulnerabilities, named CVE-2026-109618 and CVE-2026-109619 and collectively called php2shell, can expose websites to attacks before a user authenticates.

The discovery puts one of the web’s most important software foundations under a bright security spotlight. Demonstrations showed pre-authentication remote code execution against WordPress, Drupal, and Joomla, creating a path for attackers to steal private user data or modify websites.

AI Finds a Dangerous Weakness in PHP

OpenAI’s Patch the Planet program is one of two parties that discovered the PHP2Shell vulnerabilities. OpenAI says Calif researchers used its models to find the flaws, while Wiz independently identified the same bugs. Multiple security organizations found the issue around the same time in August, using AI as part of their research.

OpenAI’s GPT-5.6 Sol model played a key role in the first discovery. Calif found the first issue using GPT-5.6 Sol on August 1, 2026, and Ryan Austin was involved in the research. Wiz identified the vulnerabilities on August 19, 2026, creating a second independent path to the same security problem.

The flaws sit inside PHP’s internal handling of out-of-memory conditions and fatal errors. Researchers disclosed two PHP-engine memory-corruption vulnerabilities, then demonstrated unauthenticated exploitation against major content management systems. That combination turns a deep engine defect into a direct risk for websites running familiar publishing software.

OpenAI described the stakes in clear terms: “Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory.”

Fourteen Years of Exposure, Two Months of Remediation

The vulnerabilities have been present in PHP for 14 years, while a limited version of the issue was discovered in 2024. Their age and reach helped drive a coordinated response involving security organizations, the PHP Foundation, Cloudflare, the NSA, and U.S. government agencies.

The discovery led to approximately two months of coordinated remediation before public disclosure. Greg Brockman, OpenAI cofounder and president, said, “Over the past two months, we have been leading a coalition to mitigate one of the most severe bugs in open source software found in recent memory.”

Cloudflare deployed initial WAF mitigations before the scheduled patch release, adding security measures while teams prepared the public fix. Public disclosure and the patch release arrived on October 21, 2026, after AI news reports on October 20-21 brought attention to the vulnerabilities.

The scale of the exposure helps explain the urgency. Palo Alto Networks identified 22.6 million potentially vulnerable instances, while the vulnerabilities’ reach extends across websites that depend on PHP for core functions.

• The flaws allow remote code execution and memory disclosure.
• Demonstrations included pre-authentication RCE against WordPress, Drupal, and Joomla.
• Attackers could steal private user data or modify websites.
• Cloudflare deployed initial WAF mitigations before the patch release.
• Coordinated remediation continued for approximately two months before disclosure.

Why PHP2Shell Reaches So Far

Most web pages run using PHP, which the PHP Foundation maintains. PHP powers roughly 40% of all websites, including Facebook, Microsoft.com, Wikipedia.org, Archive.org, TheGuardian.com, and Baidu.com. The figures also place PHP at 70 percent of all websites around the world, while WordPress powers roughly 40% of all websites, underscoring the massive footprint behind the security response.

That reach gives a flaw in PHP’s engine an impact far beyond one product. A vulnerable server can host a news site, a business platform, a public archive, or a major online service, and the same underlying defect can create an attack path across each environment.

Gang Wang captured the immediate danger: “The impact of the PHP vulnerabilities is massive, [and] can expose a large number of websites to immediate attacks if not patched in time.”

Greg Brockman issued an equally direct warning: “Hackers could exploit the vulnerability to steal private user data or modify websites.”

PHP2Shell now stands as a major test for how the software world responds when AI-assisted research uncovers a flaw embedded in a foundation used across the web. The October 21 patch release closes the coordinated disclosure phase, but the next stage depends on organizations updating vulnerable systems and applying available security measures.

AI helped find the weakness. The speed of the response will determine how far its consequences travel.

Stay connected via Google News

Follow us for the latest AI News