PHP2Shell Puts Pre-Auth RCE on Unpatched PHP Workers

OpenAI models helped researchers in its Patch the Planet initiative find two critical remote code execution flaws in PHP, a language the lab says runs an estimated 70% of websites. Emergency builds for the supported PHP 8.x lines are out, and the PHP project tells every installation that serves web requests to update immediately.

Calif discovered the issues under Patch the Planet and Wiz discovered them independently, and OpenAI says it spent about two months coordinating maintainers and security providers before disclosure. The split that matters is discovery credit versus worker risk: the coalition timeline is one axis, and unauthenticated RCE on any PHP worker that has not taken the emergency builds is the other.

Patch the Planet bought maintainers two months before disclosure

OpenAI's public note on the episode says models helped researchers operating under Patch the Planet uncover critical flaws in PHP, then the lab led a coalition of maintainers, researchers, and security providers for about two months to prepare fixes and protections ahead of disclosure. The lab says that window was required because the fix was intricate and needed a major change to the PHP engine. In the same post, OpenAI frames the episode as a Defender's Window: frontier AI finding the issue ahead of attackers so defenders could prepare.

Independent discovery and public write-ups line up with that coordination claim. Per the PHP2Shell Wikipedia page, Calif found the issues as part of Patch the Planet, Wiz found them independently, and both sit alongside OpenAI in the discoverer list. Wiz's reporting, summarized there, says versions as early as PHP 5.4 through PHP 8 are affected. The same article records that PHP maintainers worked with Wiz, Cloudflare, and OpenAI on patched 8.2, 8.3, 8.4, and 8.5 lines, that the public existence notice landed on 20 October 2026, and that emergency patch details followed the next day. GitHub security advisories for the two CVEs published on 21 October at 13:34 UTC, slightly ahead of the announced release window, with php.net updated shortly after.

Unpatched PHP workers still face pre-auth remote code execution

The PHP project's 2026 news archive is blunt about who is exposed. PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. Risk covers installations serving web requests through PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed. The project rates risk highest for mod_php, with a demonstrated path where an unauthenticated request can trigger the attack before any application code runs. The bugs are tracked as CVE-2026-109618 (RCE via OOM corruption) and CVE-2026-109619 (RCE via stale global state). PHP developers rated the pair 9.2 under CVSS v4.0. watchTowr rated them 10.0, according to Wikipedia's citation of that firm's assessment.

Only an update is a complete fix. The PHP team lists interim knobs (memory_limit=-1 for the OOM path, session.upload_progress.enabled=0 and related steps for the stale-state path) and states plainly that those measures reduce specific attack paths without making an installation safe. PHP 8.1 and older no longer receive updates from the project. Minimal source backports exist for 7.4, 8.0, and 8.1 for people building from source or without an LTS vendor, but there are no official updated binaries for those EOL lines. Remi's volunteer RPM repo was called out as not shipping updates on release day. On the internet side of the same day, Wikipedia records Cloudflare reporting signs of early exploitation before the public patch, temporary WAF rules as a stopgap, PoCs and partial mitigations circulating before the embargo fully ended, and Sansec expecting mass attacks within minutes of release (as reported via Ars Technica in that article's references).

Hosting and PHP ops teams own this more than AI buyers do

Wikipedia records Cloudflare reporting signs of early exploitation before the public patch, so OpenAI's attributed Defender's Window claim does not mean exploitation waited for the public drop. Calif worked under Patch the Planet, Wiz found the same class of issue independently, and OpenAI says the coalition needed about two months because the PHP engine fix was intricate. Hosting and PHP ops teams clear CVE-2026-109618 and CVE-2026-109619 by shipping the emergency builds onto every public worker.

If you run WordPress, Laravel, Magento, custom PHP APIs, shared hosting, or anything else that still speaks PHP on the public internet, you are the buyer this advisory addresses. Your job is the version string on the worker: 8.5.12, 8.4.27, 8.3.36, or 8.2.35 from the PHP project, or the matching package from a distro or LTS vendor that received the patches in advance. EOL 8.1 and below need a vendor backport or an upgrade onto a supported line. Application-layer WAF rules and the documented interim settings are triage, not closure. The judgement that follows from the PHP advisory and the early-exploitation reporting is simple: treat every internet-facing PHP process that has not taken those builds as pre-auth RCE-capable until proven otherwise.

The PHP project's 2026 news archive says update immediately to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, check your Linux distribution or LTS vendor for packages shipped in advance, and treat only those builds as a complete solution.