[AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 months

What it is

PHP2Shell is the name given to two PHP-engine memory-corruption bugs, CVE-2026-109618 and CVE-2026-109619, disclosed on 21 October 2026 after about two months of coordinated remediation. The page is an AINews roundup (20-21 October 2026) that reconstructs the incident from social posts, not from a PHP Foundation advisory. Calif researcher Ryan Austin found the bugs under OpenAI's Patch the Planet project (August 2026, GPT-5.6 Sol). Wiz reportedly found them independently.

How it works

The researchers place the defects in PHP's internal handling of out-of-memory conditions and fatal errors. They are not in a WordPress plugin or an application's authentication logic. The researchers report two outcomes:

• Pre-authentication remote code execution against WordPress, Drupal and Joomla.
• A "Heartbleed-style" remote memory disclosure against any PHP application.

The page stresses these are researcher-reported results. They do not show an identical, immediately exploitable RCE path on every deployment.

Preconditions / Affected

The page gives no affected-version range, CVSS vector or deployment prerequisites. A viral compilation cites about 1.5 million servers on unfixed versions (attributed to Censys) and shutdowns at several large sites. The page says none of this is backed by an underlying advisory or status page, and it does not establish whether any outage was a precaution, a patching interruption or a compromise.

What to do

The page gives no fixed-version table, package identifiers or patch commit, so it cannot support an "upgrade to version X" instruction. What it does record:

• The patch window was 14:00 UTC on 21 October (23:00 JST), per Cloudflare's CTO. Cloudflare's free-tier WAF rules cover known exploit vectors and are being updated as early attacks appear. The CTO called them a stopgap and said to patch.
• The NSA advised preparing for an immediate update, and taking systems offline if timely mitigation is not possible.
• OpenAI published a repository with a Codex skill that guides operators through checking whether a site is affected. The page treats it as an aid, not a substitute for a vendor advisory or package verification.

The page's own incident sequence:

1. Get the authoritative PHP and distribution advisories.
2. Inventory exposed runtimes, including managed hosting, containers, appliances and background workers.
3. Apply temporary protections where justified.
4. Deploy authenticated fixed packages.
5. Verify the running build and restart processes.
6. Investigate for exploitation separately, since updating does not show that credentials or data were never exposed.

Caveats

• Early attacks are confirmed only by Cloudflare's statement. No compromise counts, victim counts or payload provenance are given.
• The Rundown reports that details leaked before the patch. The page says what leaked, and when, is not established.
• A WAF can create false confidence. Alternate ingress paths and origin exposure need checking.
• Enabling 2FA does not mitigate an unauthenticated engine bug.
• Whether this matches Log4Shell or Heartbleed in severity is disputed. The author notes all high-profile disclosures carry some marketing.
• OpenAI's "Defender's Window" framing says "to our knowledge" these were found before attackers, which is not proof that no attacker knew of them.
• The fetch was truncated at 60,000 of 61,840 characters. The cut falls in the Reddit recap, after all the PHP2Shell coverage.