PHP2Shell vulnerabilities found via AI: coordinated response over two months
In brief
- Two critical PHP core vulnerabilities (PHP2Shell) discovered via GPT-5.6 Sol and Gemini 4 Argon.
- Unauthenticated remote code execution possible on WordPress, Drupal and Joomla, with Heartbleed-style memory leaks.
- Two-month coordinated response with patches, preemptive WAF rules, and diagnostic tools released by OpenAI.
According to Latent.Space, OpenAI reports that it discovered two critical vulnerabilities in PHP core, named PHP2Shell, using its GPT-5.6 Sol model as part of the "Patch the Planet" program, in collaboration with security firm Calif. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, enable unauthenticated remote code execution on major CMS platforms like WordPress, Drupal, and Joomla, alongside Heartbleed-style memory disclosure.
The response involved a two-month coordinated effort between researchers, PHP maintainers, security providers, and governments. Cloudflare deployed preemptive WAF rules before the patch release, while the NSA urged immediate updates. OpenAI also published a repository with a diagnostic tool, though no exact fixed version references are provided in the cited sources.
The vulnerabilities highlight concerns over patch reliability and deployment speed. While proof-of-concept demonstrations are documented, real-world exploitation remains unconfirmed. The open-source community and cloud providers reacted swiftly, but risks of premature leaks and service disruptions persist according to unverified sources.
What it changes for you
- CybersecurityCybersecurity professionals must urgently integrate PHP patches and deploy preventive measures like WAF rules, while monitoring post-announcement exploitation attempts.
This summary gives you the essentials. The full article, its figures and quotes are on Latent.Space.
Read the original articleAI-generated summary of the source, checked by rules. How we write · Report an error