 |
| Sammyhaskey/Images |
In July 2004, security researcher Stefan Esser warned that a critical flaw in PHP’s memory handling could let attackers run arbitrary code.
PHP, the language powering an estimated 70% of websites—including WordPress, Drupal, Joomla, and countless custom applications—had a dangerous interaction with its memory_limit setting. Force a request to exhaust memory at the wrong moment, and the engine could leave behind corrupted or stale state that a subsequent request might abuse.
The warning was real. Related issues surfaced again over the years. A 2019 bug report described multipart form data triggering out-of-memory conditions that skipped cleanup. A 2024 external audit (via OSTIF and Quarkslab) rediscovered the anomaly; researchers theorized exploitation paths but could not fully prove practical remote code execution. Partial mitigations appeared in some cases, yet the underlying architectural problem—how PHP recovers from fatal errors, especially out-of-memory events in long-running worker processes—persisted across versions stretching back more than a decade, in some paths to PHP 5.4.
Why did one of the most severe threats to the foundation of the web remain unresolved for so long? Because turning the theoretical weakness into a reliable exploit demanded mind-numbing, highly specialized work: precise timing of memory exhaustion, deep knowledge of PHP’s internal data structures (hash tables, request lifecycle, multipart parsing), adaptation across versions, configurations, and SAPIs, and careful chaining of edge cases. For human researchers, the effort-to-reward ratio made it impractical for widespread weaponization. “Security by exhaustion”—the idea that something is safe because exploiting it is too tedious—held for two decades.
AI collapsed that barrier in days.
How the discoveries unfolded
In late July 2026, researchers at security firm Calif, participating in OpenAI’s Patch the Planet initiative, began auditing PHP. Calif’s Ryan Austin, drawing on the language’s vulnerability history, directed a generally available large language model (identified by OpenAI as GPT-5.6 Sol) toward modern relatives of Esser’s 2004 memory-limit issues. By August 1, the first out-of-memory trigger and paths to remote code execution appeared. Calif reported the initial issue on August 11, delivered a working proof-of-concept shortly after, and followed with a second related bug.
Independently, Wiz Research (part of Google) began its own work. Using its Wiz Atlas agent together with Google’s Gemini 4 Argon and GPT-5.6 Sol, the team found the first vulnerability on August 19. Within two days it confirmed unauthenticated remote code execution against standard Drupal and WordPress installations.
Wiz reported to PHP on August 24. OpenAI’s own Codex Security team later contributed additional attack vectors. A PHP core developer had already noted the out-of-memory weakness while addressing the 2024 audit findings, but full exploitability had remained unproven.
The two critical issues—CVE-2026-109618 (RCE via OOM corruption) and CVE-2026-109619 (RCE via stale global state)—received CVSS v4.0 scores of 9.2. Researchers nicknamed them PHP2Shell. They live in the core PHP engine, not in any particular application. An attacker can trigger them remotely via carefully crafted requests (often multipart file uploads) before application code even runs. Successful exploitation enables remote code execution as the web server user or Heartbleed-style memory disclosure that can leak passwords, tokens, API keys, and other sensitive data from the process.
Even a minimal “Hello World” page on a vulnerable PHP version is at risk under default configurations. Nearly every PHP release from the last decade (and in some paths earlier) is affected by at least one of the issues.
OpenAI coordinated a coalition of maintainers, researchers, and security providers over roughly two months. The fix required intricate changes to the PHP engine’s error handling and state management—including turning the soft memory_limit into a safer recovery path and introducing a hard memory limit. Patches shipped on October 21, 2026 (PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35), one day earlier than planned after details leaked. Cloudflare observed attack traffic and payload mutation in the hours around disclosure; AWS honeypots recorded exploitation attempts as early as October 17. The NSA advised organizations unable to patch immediately to take affected systems offline.
Some public-sector sites in multiple countries temporarily went dark as a precaution.
Wiz described the findings as among the most severe in software history, comparable in impact potential to Heartbleed or Log4Shell given PHP’s ubiquity. OpenAI framed the episode as an example of a “Defender’s Window”: to its knowledge, frontier AI surfaced the issues before widespread criminal exploitation, buying time for coordinated response.
 |
| Master/Moment RF |
Why this changes the game
The internet’s digital infrastructure has long resembled the famous xkcd cartoon of a towering structure resting on a single, under-maintained project maintained by “some random person in Nebraska.” PHP is one of those foundational blocks. Its volunteer-driven and foundation-supported maintenance model has delivered enormous value, but the volume of code and historical design decisions create a large surface for latent, hard-to-reach flaws.
AI does not invent new classes of bugs so much as it radically lowers the cost of discovering and proving exploitability for existing ones. The tedious mechanical work of exploring state machines, generating edge-case inputs, adapting payloads across versions, and validating chains becomes something a capable model can iterate on rapidly while a human researcher guides direction and validates results.
Calif noted that no special proprietary models beyond generally available tools were required.
Wiz reported that a single researcher accomplished in a week what previously might have taken a world-class team months.
This democratization ends “security by exhaustion” as a reliable control. Theoretical vulnerabilities that once sat harmlessly on bug trackers or in audit reports because exploitation was too expensive now become practical. Nick Rogers of Fieldwork AI and others have pointed out that AI can keep churning until it figures out the mechanical steps; the human no longer needs to invest the same monotonous effort. The same capability that helps defenders find and fix problems also helps attackers. Anthropic’s earlier caution around highly capable models for security research reflected exactly this dual-use reality.
The PHP Foundation has already seen a surge in reports—many AI-assisted—and has worked through large volumes of noise alongside the genuine high-impact findings. OpenAI has indicated that PHP2Shell is among several significant vulnerabilities its initiative has already surfaced and that the rate of similar discoveries is expected to rise sharply. The cost of deep bug-finding is falling toward the price of model access plus skilled human direction. The cost of patching the global installed base has not fallen at all.
Practical reality and longer-term implications
Many sites still run older or unpatched PHP versions. Migrating away from PHP is expensive for complex applications; it is not a simple configuration switch. Distribution backports for unsupported branches exist in limited form, but the practical advice remains: upgrade to a fixed release on a supported branch (8.2 or newer as of the October 21 patches) and restart all PHP workers so no stale processes remain. Temporary mitigations (disabling certain upload-progress features, carefully adjusting memory limits and input sizes, edge filtering of multipart requests) can reduce risk but do not fully eliminate it for both CVEs.
Beyond the immediate patch, the episode forces a shift in mindset. Assume more latent, high-impact issues exist in widely deployed open-source foundations. Treat patching lag measured in days rather than weeks or months as unacceptable for internet-facing systems. Invest in the under-resourced maintainers who keep critical infrastructure alive—through funding, tooling, and coordinated disclosure processes that scale under higher discovery rates.
Defenders need faster detection, better isolation, and continuous validation that the “too hard to exploit” assumption no longer holds.
AI did not create the underlying design tension in PHP’s error recovery. It simply made the long-standing theoretical risk operational at internet scale, and it did so faster than many expected.
The good news is that coordinated researchers and maintainers reached the finish line first this time and delivered fixes. The sobering news is that the next such discovery may not wait 22 years, and the next actor to turn a theoretical flaw into a working exploit may not be working with the defenders.
The web was never as solid as it appeared. AI has simply made the thin spots impossible to ignore.
Samuel O. Sulaimon is the founder and Editor-in-Chief of Naijapiz. He covers Global, News, Sports, Finance, Faiths, Education, Politics and Technology.
Post a Comment