Talk Around Town: Did AI Beat Hackers to the Worst PHP Bug in a Decade?

What the Gossip Train Is Hauling

Well, slap the mud off your boots and sit down, because the cybersecurity barn is on fire and everybody's talkin' about it. The chatter goin' around says that two mean-as-a-cornered-possum software vulnerabilities, officially tagged CVE-2026-109618 and CVE-2026-109619 and collectively nicknamed PHP2Shell, scored a 9.2 on the CVSS v4.0 severity scale — a number so high it'll make your eyes water like you bit into a jalapeño at a church potluck. Multiple independent outlets including CyberScoop, SecurityWeek, and The Next Web are all reporting that these flaws could let an unauthenticated attacker run arbitrary code on any web server running PHP 5.4 or later, which, according to Wiz's published blog, potentially touches an estimated 70% of all websites on the internet.

The part that's got everybody's tongues waggin' is the claim — corroborated by CyberScoop, The Next Web, and RTÉ — that artificial intelligence models sniffed out these bugs before any known bad actor did. Security firm Calif says it found the first flaw in August 2026 using OpenAI's GPT-5.6 Sol model, during an audit that OpenAI says it funded through what OpenAI describes as its 'Patch the Planet' initiative. Wiz's blog independently claims that Wiz found both flaws using what Wiz describes as its Wiz Atlas platform together with Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol. That's two different outfits arrivin' at the same ugly creek by different canoes, which is about as close to independent corroboration as this kinda story gets.

What Is Actually Known and Nailed Down

Here's the solid fence post in all this muddy field: Cloudflare's own published blog documents that the company deployed web application firewall protections beginning at 3:02 am UTC on October 21, 2026 — a good nine hours before the patch went public. Cloudflare further states in that same blog that it observed attack traffic aimed at its customers, with adversaries apparently mutating their payloads to try to slip around those defenses like a coon trying every board on the henhouse. However — and this is important — Cloudflare explicitly reported no confirmed successful compromise of any customer.

Multiple major independent news organizations, including RTÉ, The Korea Times, and K24 Digital citing BBC reporting, independently confirmed that government websites in France, the Netherlands, Finland, and Belgium, along with the BBC, Edinburgh Council, and the Wikimedia Foundation, took pages or systems offline around the time of the patch release. That global lights-out moment is not disputed by any source in the packet. SecurityWeek and The Hacker News also independently confirm that details about the vulnerabilities leaked on Hacker News on October 20, a full day before the planned coordinated disclosure, forcing PHP to move its patch release up to October 21.

The PHP Foundation's own statements, quoted directly in multiple outlets including the Cyprus Mail, acknowledge that a researcher had flagged early signs of the underlying flaw back in 2024. The foundation called the failure to fully address that earlier signal what multiple outlets quote as a 'structural failure.' CyberScoop and RTÉ both confirm that researchers described the flaws as having lurked in PHP's codebase for more than a decade — longer than some of the folks patchin' 'em have been writing code.

What Is Still Murkier Than a Catfish Pond

Now here's where we gotta slow the truck down, because not everything comin' down this road is verified. Patchstack reportedly claimed that active exploitation of the vulnerabilities was already underway, but — and this is a barn-sized but — Patchstack published no supporting evidence for that assertion, according to the sources reviewed. On the other side of that fence, the Dutch NCSC reported no confirmed abuse as of the patch release, and no successful breach had been publicly confirmed as of October 21, per Cyber Kendra's reporting. So whether anybody's chickens actually got stolen, or whether the predators were just circlin' the yard, remains an open question.

There's also a scrappy little disagreement about severity scores. The Hacker News leak reportedly rated the flaws at a perfect CVSS 10.0 — the security equivalent of 'Lord have mercy, run.' PHP's official advisory, however, rates both CVEs at 9.2 on the CVSS v4.0 scale. That is still a number that'll put the fear of God into any sysadmin, but it ain't the same number, and the difference matters for how organizations prioritize their response. Separately, Cloudflare's blog states the flaws affect all PHP versions from 5.4 onward, while CERT-EU's advisory focused primarily on the actively supported 8.2 through 8.5 branches, with source-level backports noted only for PHP 7. Whether your particular old-growth installation is actually in the crosshairs depends on which of those framings you trust.

OpenAI's claim that, to its knowledge, frontier AI found these vulnerabilities before attackers did is framed by OpenAI as a defensive win. But Cloudflare's blog notes that exploitation attempts against its customers began at 07:43 UTC on October 21 — more than six hours before the 14:00 UTC patch release. If attackers were already probin' the barn before the patch was hung on the door, the question of who really got there first gets considerably more complicated, and OpenAI's framing — while not outright contradicted — deserves a raised eyebrow and a slow sip of sweet tea.

Analysis: A Defender's Window, or Just a Cracked One?

This next part is analysis, not reportin', so put your critical-thinkin' hat on. OpenAI says — and this is its own characterization, not a settled fact — that GPT-5.6 Sol finding this flaw before attackers represents a 'Defender's Window,' a period in which the good guys had the keys before the bad guys knew the lock existed. If that framing holds up under scrutiny, it would represent something genuinely significant: a case where AI-assisted code auditing delivered a meaningful head start to defenders in a category of vulnerability that, according to CyberScoop and RTÉ, researchers say would have been extraordinarily difficult for unassisted humans to discover.

But the analysis cuts both ways, and OpenAI itself seems to know it. CyberScoop reports that OpenAI warned the same AI capabilities that found this vulnerability defensively also lower the barrier for attackers to adapt and scale exploits across different PHP versions and configurations — and OpenAI said it expects similar findings to increase sharply in the coming months. That's a company essentially acknowledging that the tool it's celebratin' is also a sharper shovel for folks diggin' in the wrong yard. Wiz, for its part, describes PHP2Shell through its own blog as what it calls the most severe vulnerabilities AI has ever discovered, and multiple outlets report that a PHP Foundation security engineer compared the event's scale to Heartbleed, the landmark 2014 crisis that sent the whole internet into a patching panic.

Whether October 21, 2026 gets remembered as the day AI proved it could protect the internet, or as the day the world got its first real look at how fast AI-amplified threats can move, probably depends on details — successful breach disclosures, or the lack of them — that hadn't fully surfaced by the time the patch dropped. Right now, the most honest thing to say is: the barn door is shut, the herd appears to still be inside, but we ain't done countin' the cows yet.