AI-Assisted Discovery of Two Critical PHP Bugs Prompted Global Patch Warnings

What happened

On the evening of 21 October 2026, Japan's prime minister Sanae Takaichi appeared on television and asked website owners to check whether their sites run PHP and to install a security update as soon as one became available. Where patching was not possible, she suggested temporarily switching off parts of the site. Roughly an hour later, PHP published fixes for two critical vulnerabilities, and the US National Security Agency went further, advising operators who could not patch to take their systems offline. These details come from a dev.to post, originally published on Medium, drawing on accounts from Calif, Wiz, php.net and official alerts.

Two old bugs that were never fixed

Both flaws abuse how PHP reacts when a request exhausts its memory allowance. PHP halts the request, but if that happens while an internal data structure is half-built, cleanup is skipped: the memory is released while pointers to it survive. The next request handled by the same worker process then trusts that freed memory, which an attacker can pre-fill with their own data. According to the post, a single crafted upload, well inside PHP's default 8 MiB upload limit, can exhaust the default 128 MiB memory limit, with no login required and no bug in the website's own code. PHP tracked the issues as CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10.

The problem was not new. In 2004, researcher Stefan Esser found a remote flaw in how PHP handled its memory limit. A 2020 bug report noted that long form variables could exhaust memory and was dismissed as harmless. A 2024 audit by OSTIF and Quarkslab rediscovered the issue, but with no demonstrated attack path it stayed unfixed.

AI found what audits could not

On 30 July 2026, OpenAI invited the security firm Calif into Patch the Planet, a program supporting open-source maintainers. Calif's Ryan Austin picked PHP, and by 1 August, working with OpenAI's GPT-5.6 Sol model, he had a working remote code execution against WordPress. Calif reported the first bug on 11 August and delivered a working exploit on 14 August. Separately, Wiz Research found the same family of flaws on 19 August using Gemini 4 Argon, GPT-5.6 Sol and its own Wiz Atlas tool, reporting its variants on 24 August.

Austin began from a theory that relatives of Esser's 2004 bug still lurked in the code. He prompted the model to hunt for controllable out-of-memory errors and code that could be interrupted mid-task, and it noticed that PHP counts a new internal table entry as live before it finishes building it. That finding became a reusable search pattern that surfaced further variants. Calif says it used no special harness and only publicly available models: the expert supplied direction, the model supplied speed. Wiz reports a similar dynamic on the exploitation side, with frontier models adapting working exploits across applications in hours, and a single researcher achieving in a week what a world-class team would previously have needed months for.

A leak forced an early release

The coordinated disclosure was planned for 22 October. On 20 October an anonymous Hacker News post claimed the bugs were real; it was deleted, but screenshots spread to X and Mastodon along with images and video of Calif's private exploit tool, PHP2Shell. PHP moved its release forward to 21 October at 14:00 UTC, and watchTowr confirmed the flaws were genuine. Attacks had already begun: Cloudflare recorded the first attempts at 07:43 UTC, more than six hours before any patch existed, according to Sansec. During the roughly eleven-week quiet window, Linux distributions had received patches early, major providers including Cloudflare, AWS, Google, Microsoft, Fastly and Akamai had prepared firewall rules, and OpenAI had briefed the White House's Super Intelligence Force, the Office of the National Cyber Director and CISA.

Patched versions, uneven deployment

PHP shipped versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the NSA, FBI, CISA, the UK's National Cyber Security Centre and CERT-EU all issued alerts. In the Netherlands, DigiD, MijnOverheid, the House of Representatives website and the Dutch national cyber security centre's own site were taken offline, per Patchstack citing NOS. Cloudflare's shares rose about 5 percent that day, per Investing.com, and after disclosure the company says exploit attempts jumped from thousands to millions.

Deployment remains the weak link. Mallory counted roughly 884,000 internet-facing hosts reporting PHP 8.1 or older on 20 October, according to The Hacker News, and those versions no longer receive fixes. That gap is why the NSA advised disconnecting unpatchable systems and why Japan's prime minister suggested disabling site features.

Why it matters

The PHP Foundation said afterwards that a possible exploit had been theorized as early as 2024, but with no concrete attack path and higher-priority issues competing for the same maintainers, work on a fix stalled and restarted for months. Finding bugs is no longer the hard part; fixing and deploying them is. OpenAI says these flaws are among several significant ones it has already surfaced and expects such findings to increase sharply in the coming months. A head of government asking a country to patch a programming language overnight may not remain a one-off.