It has been revealed that the critical PHP vulnerability 'PHP2Shell' was discovered using AI by security companies Calif and Wiz, and that countermeasures were implemented using the OpenAI framework.
A critical vulnerability called ' PHP2Shell ' has been discovered in the PHP programming language, and an emergency update has been released. It has been reported that two vulnerabilities in 'PHP2Shell' were independently discovered in August 2026 by security companies Calif and Wiz.
PHP2Shell — AI uncovers critical vulnerabilities in the backbone of the web
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog
https://www.wiz.io/blog/php2shell-php-rce
Patch the Planet: global response coordination as agents uncover critical vulnerabilities | OpenAI
https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/
php2shell by Calif Research
https://calif.io/php2shell/
'PHP2Shell' refers to two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. These are critical vulnerabilities that, if exploited, could allow attackers to take over servers, steal confidential data, or modify websites running on those servers. PHP released an emergency update late at night on October 21, 2026, Japan time.
PHP releases emergency updates '8.5.12', '8.4.27', '8.3.36', and '8.2.35' - GIGAZINE
According to security firm Calif, as part of OpenAI's 'Patch the Planet' security initiative announced in June 2026 , they discovered the first vulnerability on August 1, 2026, and reported it to PHP on August 11. Furthermore, they discovered a second vulnerability on August 21.
Google's AI platform Wiz discovered the vulnerability on August 19, 2026, independently of Calif's actions, and reported the vulnerability to PHP on the 24th.
Calif and Wiz collaborated with OpenAI's Codex Security team, PHP's security team, and Google Gemini's team to discover vulnerabilities, coordinate responses, and verify patches.
Meanwhile, Google Cloud, Cloudflare, AWS, Microsoft, Automattic, Fastly, Akamai, Imperva, Vercel, and other industry partners helped organizations that were unable to immediately update PHP by providing guidance, detection methods, and temporary mitigation measures.
Calif has released a demonstration video showing an exploit that can be executed against Nginx.
php2shell PHP-FPM exploit - phpMyAdmin, WordPress, and phpbleed - YouTube
Related Posts:
