About two months before public disclosure, researchers privately coordinated to fix memory‑corruption bugs in the PHP engine that were later published as PHP2Shell. The two vulnerabilities were assigned CVE‑2026‑109618 and CVE‑2026‑109619. The technical reports place the root cause in PHP’s internal handling of out‑of‑memory conditions and fatal error paths; the researchers describe demonstrations of full remote code execution (RCE) and “Heartbleed‑style” memory disclosure.
Who was involved
- OpenAI said researchers at the security firm Calif used OpenAI models under the “Patch the Planet” initiative and Daybreak/Daybreak for Frontline Defenders access—specifically GPT‑5.6 Sol—to find the flaws.
- Wiz, now part of Google Cloud, independently reported finding the same issues; Wiz credited Gemini 4 Argon plus its own tooling (including Wiz Atlas) for discovery, exploit development, detector creation, and patch validation.
- The PHP Foundation and core PHP maintainers provided the upstream remediation path and coordinated on the patch engineering.
- Cloudflare deployed Web Application Firewall (WAF) rules ahead of the public patch release.
- The U.S. National Security Agency (NSA) published guidance urging immediate updates and, where timely mitigation was not possible, temporary offline measures.
Coordination and timeline
Participants report roughly two months of private coordination between discovery and public disclosure, during which maintainers, researchers, security providers and some governments were notified and remediation work proceeded. OpenAI and involved researchers framed the effort under Patch the Planet and Daybreak access, distinguishing the access mechanism (Daybreak) from the remediation initiative (Patch the Planet).
Cloudflare’s announcement and Japanese‑language posts aligned on a planned release window around 14:00 UTC / 23:00 JST on 21 October 2026.
Technical claims and evidence
The public disclosures included demonstrations of pre‑authentication RCE against widely used CMSs such as WordPress, Drupal and Joomla, and researcher‑reported remote memory disclosure against arbitrary PHP applications. These are researcher demonstrations; the available material does not prove every deployment shares an identical, immediately exploitable RCE path.
OpenAI attributes discovery work to Calif researchers using GPT‑5.6 Sol; Wiz’s account attributes discovery and subsequent engineering to Gemini 4 Argon and Wiz’s tooling. The narrative is therefore multi‑party: separate discovery and validation efforts, rather than a single vendor finding and fixing the issue alone.
Operational response and impact
- Cloudflare: deployed initial WAF mitigations covering known exploit vectors, made rules available to all customers (including free tier) and updated protections as early attack traffic appeared. Cloudflare’s CTO described these rules as a stopgap and emphasized the need to apply the upstream PHP patch.
- NSA: advised organizations to prepare for an immediate update and to consider taking systems offline if they could not mitigate promptly.
- OpenAI: published a repository containing a Codex skill to help operators check whether their sites were affected; this is an assistance workflow and not a substitute for authoritative vendor advisories or package verification.
Some later reports compiled viral claims—about roughly 1.5 million servers lacking fixes (attributed to Censys), shutdowns at Dutch institutions, government sites in Europe, Wikipedia, Archive.org, Asana, GOG and others, and a 05:55 warning from Japan’s prime minister. The supplied materials do not independently corroborate each of these assertions, nor do they establish whether outages were precautionary, patching incidents, unrelated failures, or actual compromises.
Open questions and uncertainties
Publicly available threads and posts leave concrete evidence gaps: there is no direct PHP Foundation advisory in the supplied set that lists exact affected and fixed versions, distribution package identifiers or precise commit references. Other unresolved items include CVSS vectors, deployment prerequisites for exploitation, an independently verified discovery timeline, what (if anything) leaked before the patch, validated exposure counts, and whether reported shutdowns were caused by this vulnerability.
The role of AI, credit distribution and policy debate
Participants argue the case that models helped find, exploit‑chain, and validate patches is credible: reported exploit chains, detectors and validation work support the defensive discovery narrative. OpenAI framed the event as an example of the “Defender’s Window”—advanced models finding flaws before attackers and giving defenders time to prepare—while carefully phrasing claims as “to our knowledge.”
Credit is distributed across researchers, models and infrastructure providers: Calif/OpenAI and Wiz/Google Cloud present separate discovery accounts; PHP maintainers supplied the upstream fixes; Cloudflare provided pre‑release filtering. Google posted that Gemini 4 Argon found more than twice as many vulnerabilities than baseline models in its internal testing, but the public material does not disclose datasets, baselines, budgets or false‑positive rates and is not an independent comparative evaluation.
Access policies also drew discussion: some praised OpenAI’s Daybreak vetted access that enabled multiple findings across projects, while others defended stricter gating (for example Anthropic’s delayed access to Mythos‑class models for four months) as a safety measure. These are policy judgments rather than settled causal facts about this specific remediation.
Operational complications for operators
The emergency highlights distribution and ownership problems as much as discovery. Operators must locate PHP across managed hosting, containers, appliances, background workers and legacy apps; obtain and deploy appropriate packages; restart or replace affected processes; and verify running builds. WAF mitigations reduce immediate exposure but can create false confidence if proxied coverage or alternate ingress paths are overlooked. NSA guidance to take systems offline is conditional advice for operators who cannot mitigate promptly, not a blanket instruction to disconnect the internet.
Proposals to use RCEs to auto‑patch every server were raised in discussion as speculative and legally risky; unsolicited exploitation carries risks of unauthorized access, outages, incorrect fixes, evidence destruction and cross‑jurisdictional liabilities.
Why this matters
PHP2Shell shows a concerted, multi‑party remediation response to severe engine‑level bugs that affect a large ecosystem. It demonstrates both the potential of advanced models and coordinated human effort to improve security, and the operational and information‑management challenges of distributing fixes for widely deployed runtime components.
Practical guidance (summary)
- Obtain authoritative PHP and distribution advisories and verified fixed packages; do not rely only on social posts.
- Inventory exposed runtimes across hosting, containers and appliances.
- Apply temporary protections where justified (WAF rules, network restrictions) and then deploy authenticated fixed packages.
- Verify running processes and investigate for signs of exploitation separately; patching removes the vulnerability but does not prove that credentials or data were not already exposed.
Final note
The evidence supports a multi‑party defensive discovery and remediation effort involving models (GPT‑5.6, Gemini 4 Argon), human researchers and infrastructure providers. Many public claims about impact and outages circulated rapidly after disclosure, but the supplied materials leave several important technical and forensic questions unanswered.
