OpenAI-backed researchers uncover critical PHP memory-corruption bugs

OpenAI’s “Patch the Planet” initiative helped researchers at Calif discover two critical PHP-engine memory-corruption bugs, labeled PHP2Shell (CVE-2026-109618 and CVE-2026-109619), while Wiz, now part of Google Cloud, independently reported the same issues using Gemini 4 Argon and GPT-5.6 Sol. The vulnerabilities reside in PHP’s handling of out-of-memory conditions and fatal errors, enabling full remote code execution and “Heartbleed-style” memory disclosure against WordPress, Drupal, Joomla and any PHP application Latent Space.

OpenAI described roughly two months of private coordination before public disclosure, involving the PHP Foundation, security providers and governments. Cloudflare rolled out initial WAF rules as a stopgap, making them available to all customers and urging operators to apply the patch by 14:00 UTC. An NSA account advised immediate preparation and, where mitigation was not possible, temporary shutdown of affected systems.

The coordinated response illustrates a rare, large-scale remediation effort across the PHP ecosystem, with AI-assisted discovery and detection playing a central role. Our read: the episode underscores the growing reliance on generative models for deep-code analysis and the importance of rapid, multi-party collaboration when critical infrastructure is at risk.