PHP2Shell: NSA and allies say patch or go offline after AI-found PHP flaws

Cyber agencies in the U.S., Europe, Australia, Canada and elsewhere urged organizations on Wednesday to take their websites offline immediately after OpenAI tools found critical bugs in PHP, the programming language behind a large share of the web. PHP released patches the same day, October 21, 2026, for PHP2Shell, a pair of critical memory-safety vulnerabilities that Wiz Research says affect software powering an estimated 70% of all websites.

The NSA's cyber arm put it bluntly on X: "Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities." The FBI's cyber division warned that the flaws could let malicious actors execute code remotely, and recommended that operators take websites offline if they cannot update immediately. The Financial Times headlined its report "NSA warns on 'critical' cyber vulnerabilities detected using AI." Some European and U.S. organizations have already taken sites down temporarily.

What PHP2Shell actually is

The flaws are grouped under two CVEs, with severity reaching CVSS 9.2. Here is the breakdown as Wiz describes it:

• CVE-2026-109618: an upload-progress unserializer use-after-free plus remote process-memory disclosure. Wiz says it demonstrated pre-authentication remote code execution on WordPress, Drupal and Joomla, along with unauthenticated disclosure of PHP worker memory.
• CVE-2026-109619: a fatal-error backtrace use-after-free plus OPcache type confusion. Wiz demonstrated pre-authentication RCE on Drupal and WordPress.

The detail I would underline is that you do not need a sloppy application. As our earlier report put it, even a simple "Hello World" application running on an affected PHP version can be vulnerable. The bug lives in the language runtime, not in your plugin.

On age, three sources give three answers. Wiz says every PHP version from the last decade, going back to 5.4, is affected by at least one of the flaws. TechCrunch reported the holes have been in all versions since PHP 5, released in 2004. OpenAI President Greg Brockman said Wednesday the bug has been in the code for 14 years, and that a limited version was found in 2024 but was not deemed significant. Those are not the same claim, and nobody in the material has reconciled them.

A timeline with a four-week hole in it

Wiz's account runs like this:

• August 19: Wiz discovers the first vulnerability using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol.
• August 20: unauthenticated RCE confirmed against Drupal.
• August 21: unauthenticated RCE confirmed against WordPress.
• August 24: Wiz reports the flaws to the PHP security team.
• September 21: PHP acknowledges the reports and begins developing a coordinated fix.
• October 21: patched releases and public disclosure.

That is four weeks between report and acknowledgment. The material does not explain why. It also does not say whether anyone exploited these flaws before disclosure, a key question for administrators.

The disclosure itself was messy. The PHP Foundation said in a statement Wednesday that the flaws leaked before the intended release date through a mixture of mistaken and intentional breaches. It said cybersecurity company Chainguard "unilaterally broke the embargo." The intended release date is not stated.

Who gets the credit

This is where the press releases collide. OpenAI says researchers "operating as part of our Patch the Planet initiative" used OpenAI models to find the flaws, and that it "led a coalition of maintainers, researchers, and security providers" over two months to prepare fixes. In its own post, OpenAI says Calif identified a critical flaw using GPT-5.6 Sol, with Wiz also independently discovering and reporting both vulnerabilities. It adds: "To our knowledge, frontier AI found these vulnerabilities before attackers did."

Wiz says it used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol "throughout this research," and portrays remediation as a distributed effort. Its named partners include Automattic, Akamai, AWS, Cloudflare, Fastly, Google Cloud, Imperva, Microsoft and Vercel. Raluca Ada Popa, Head of Gemini Security at Google DeepMind, said: "We're pleased to see Gemini 4 Argon help defenders bridge that gap, finding vulnerabilities and helping patch them."

So three parties each describe an AI-assisted discovery, and each emphasizes a different model or team. What is missing is the number that would settle it: the division of labor and success rate among GPT-5.6 Sol, Gemini 4 Argon and Wiz Atlas, finding flaws versus building working exploits. "AI found it" is a headline. "AI found it, and here is the hit rate" would be an eval.

What to do, and what to watch

TechCrunch recommended updating to the current PHP version, 8.5.12, and noted that PHP 8.1 and older are no longer supported, so operators on those branches have real migration work. The material does not list fixed version numbers for every supported branch, which is worth checking against PHP's own release notes. OpenAI is also sharing a PHP version checker as a Codex skill to help operators identify potentially vulnerable versions.

Watch three things. First, any evidence of exploitation before October 21. Second, whether the PHP Foundation and Chainguard settle their dispute over the embargo, since coordinated disclosure only works if the coordination holds. Third, whether anyone publishes the methodology behind the AI-assisted discovery. The agencies have spoken, the patches exist, and the story of how a 14-year-old (or 22-year-old, pick a source) bug fell to machines is, for now, mostly self-reported.