The vulnerable lines had been in PHP for more than a decade. What changed was the cost of turning them into a shell.
On 21 October 2026, Wiz Research published PHP2Shell, and OpenAI framed the same day as the public face of its Patch the Planet response: critical remote code execution and memory disclosure in the PHP engine itself, patched by the PHP project after a multi-party coordination that also pulled in Calif, Cloudflare, cloud vendors, and CISA. The story is partly a pair of CVEs. It is also an argument about who gets the first working exploit when frontier models can chain decades-old memory bugs in hours.
Core PHP memory-safety bugs outrank the CMS layer above them
PHP still powers a large share of the public web, including WordPress, Drupal, Joomla, and MediaWiki. Wiz's post stresses that the flaws live in the engine: even a trivial application on an affected interpreter can be reachable. Nearly every PHP version from 5.4 forward is described as affected by at least one of the issues until the 21 October patches.
That framing matters for operators who patched their plugins last month and assumed the language runtime was boring. Application logs may show little more than odd multipart traffic, memory-limit errors, HTTP 500 spikes, strange PHPSESSID cookies, or worker churn. The durable fix is the PHP security update.
Two CVEs, four primitives, and unauthenticated RCE demos
Wiz groups the work under CVE-2026-109618 and CVE-2026-109619. Reported primitives include an upload-progress unserializer use-after-free paired with remote process-memory disclosure, a fatal-error backtrace use-after-free, and an OPcache type confusion. Demonstrated impact includes pre-authentication RCE on WordPress, Drupal, and Joomla container images current at test time, plus application-agnostic disclosure of worker memory that can hold passwords, tokens, and keys from other requests.
Mechanically, fatal out-of-memory paths can destroy request heaps while leaving executor or session globals pointing at freed storage. A later request on the same worker reinterprets attacker-controlled reclaim as live bookkeeping. Wiz packaged the chains as php2shell. Severity in the disclosure materials reaches CVSS 9.2.
OpenAI's Patch the Planet post states that Calif identified a critical flaw with GPT-5.6 Sol, that Wiz independently discovered and reported both vulnerabilities, and that PHP maintainers led the fixes. Wiz credits Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol, with Argon highlighted for discovery, exploit development, detection, and patch validation.
Wiz's disclosure trail starts with a first finding on 19 August 2026. Drupal RCE was confirmed the next day, WordPress the day after, and the report reached PHP on 24 August. PHP acknowledged on 21 September; patches and public disclosure landed together on 21 October.
Patch the Planet turns one engine bug into a multi-vendor response drill
OpenAI describes a five-stage response pattern: validate and fix upstream with adversarial testing; give distributors and providers time to prepare; coordinate with government partners including CISA and other US and international bodies; prepare product-level updates; then publish guidance and support deployment. For PHP, that meant WAF rules, hosting mitigations, and a Codex skill that checks PHP versions, alongside maintainer releases.
CISA's 21 October alert told operators to patch immediately. Cloud and edge vendors named by Wiz (including AWS, Cloudflare, Fastly, Google, Microsoft, Automattic, Akamai, Imperva, and Vercel) prepared interim guidance for sites that cannot upgrade in one step. Interim controls reduce risk; they do not replace the engine patch.
Upgrade PHP first; treat complexity as a weak defence
Monday action is blunt. Inventory every runtime that embeds PHP, including container bases, shared hosts, and appliance images. Apply the 21 October security releases or your distributor's backport. Where you cannot move yet, enable vendor mitigations and watch for the multipart and session-cookie signals Wiz lists, then schedule the real upgrade. Do not wait for a CMS plugin advisory: the vulnerable code is below your application.
For security programmes, the deeper rule is about exploit economics. Wiz and OpenAI both argue that chaining these bugs once sat near the edge of practical human research. Frontier models compressed that work. Defenders used that compression inside a coordinated window. The same compression is available to whoever is next.
No public mass-exploitation ledger is attached to the launch posts
Neither Wiz nor OpenAI publishes a confirmed in-the-wild exploitation timeline in the launch materials Frontier reviewed. Impact demos are laboratory chains against representative CMS images. Variant bugs beyond the four detailed primitives are acknowledged as likely; the PHP patch is described as addressing the pattern at its root. Independent reproduction of every chain outside the coordinating parties is unsettled here.
How long the Defender's Window lasts on the next engine bug remains open
OpenAI calls this a Defender's Window: frontier AI found the issues before attackers, in its telling, and used that lead to stage patches and mitigations. The company also says similar findings will increase sharply and that it has committed substantial subsidised Daybreak access for frontline defenders. What is still missing for operators is a durable public metric for how often that window will exist, and a clear inventory of other critical runtimes already under the same microscope. Until those answers arrive, assume the next memory-unsafe engine bug will move on an AI timetable and keep PHP fleets current.