Three Separate Teams Used AI Models to Find the Same Critical PHP Bug This Summer
In August, three unconnected groups went looking inside PHP's source code and came back with the same bug. Security firm Calif, working through OpenAI's "Patch the Planet" audit program, used GPT-5.6 Sol to trace a route to remote code execution. OpenAI's own researchers independently flagged the same underlying issue the same week. Weeks later, Wiz's team found it again, using a mix of its own Wiz Atlas tooling, Google's Gemini 4 Argon, and GPT-5.6 Sol. PHP's eventual advisory credits all three.
A bug PHP's own maintainers had already seen — and missed
The flaw, now tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed "PHP2Shell," stems from how the engine mishandles fatal out-of-memory errors: corrupted state left behind by one request can be reused by the next on the same worker, eventually enabling unauthenticated code execution. PHP developers had actually spotted signs of the problem during a 2024 audit but didn't find a path from the memory corruption to a working exploit. What changed this year wasn't the bug, which has likely existed since PHP 5.4, but the speed at which separate teams could chain a decade-old crash into something that reads passwords and tokens out of server memory.
Scale, and a disclosure that didn't go to plan
PHP runs roughly 70% of the web, and Palo Alto Networks counted more than 22.6 million internet-facing instances as potentially exposed — a reach figure, not a confirmed-compromise count. The coordinated disclosure also slipped: Chainguard, which said it found the issue independently around October 16-17 using its own testing harness and an unnamed frontier model, broke the embargo and shipped patched container images early, citing signs of active exploitation. The PHP Foundation disputed that it had seen a working exploit among the proofs-of-concept then circulating, and a leak on October 19-20 pushed everyone, including an accidentally-published demo video, into the open before the planned release.
No model is simply capable of unearthing 'all bugs' with simple prompts. At least for now.
That line, from Calif, is a useful corrective to OpenAI's own framing. OpenAI has cast the episode as proof of a "Defender's Window" — AI finding internet-scale flaws before criminals do — and used it to promote a $1 billion subsidized-access commitment through its Daybreak cyber program. But OpenAI's claim that its models surfaced the bug first is hedged with "to our knowledge" and hasn't been independently verified by any outlet covering the story. Calif, by contrast, says it used generally available models with no special tooling, and that what mattered was researchers who already knew PHP's history — the model filled in gaps in a search a human was already running, rather than discovering something no human could have found.
What's still unclear: how much of the hard part — chaining four separate memory bugs into a reliable exploit across different PHP versions and memory layouts — was genuinely model-driven versus directed by specialists who knew where to look. No vendor has published indicators of compromise, so, as one analyst quoted by TechTarget put it, a clean scan doesn't rule out that an attacker got in before the patch. And this is reportedly the second time in a few months that AI-assisted bug-hunting has forced an emergency, internet-wide patch cycle for widely used web software — a pattern worth watching rather than celebrating or panicking over on the strength of one vendor's self-reported timeline.