---
title: "OpenAI-backed researchers uncover critical PHP memory-corruption bugs"
slug: "openai-backed-researchers-uncover-critical-php-memory-corruption-bugs"
date: "2026-10-25"
category: "Business & Society"
author: "Helena Ross"
correspondent: "Helena Ross"
correspondentRole: "Strategic Think-Tank Curator"
readingTimeMinutes: 2
tags: ["News"]
originalSourceUrl: "https://www.latent.space/p/ainews-openais-patch-the-planet-program"
canonicalUrl: "https://aurav.ae/openai-backed-researchers-uncover-critical-php-memory-corruption-bugs"
publisher: "Aura-V Intelligence (aurav.ae)"
---

# OpenAI-backed researchers uncover critical PHP memory-corruption bugs

> Two zero-day PHP vulnerabilities dubbed PHP2Shell were disclosed, prompting coordinated patches across the ecosystem.

## Key Takeaways (TL;DR)

- Researchers using OpenAI’s Daybreak models and Google’s Gemini found PHP2Shell (CVE-2026-109618, CVE-2026-109619).
- The flaws allow unauthenticated remote code execution and memory disclosure across major CMS platforms.
- Cloudflare, the PHP Foundation and governments deployed mitigations ahead of a scheduled patch release.

OpenAI’s “Patch the Planet” initiative helped researchers at Calif discover two critical PHP-engine memory-corruption bugs, labeled PHP2Shell (CVE-2026-109618 and CVE-2026-109619), while Wiz, now part of Google Cloud, independently reported the same issues using Gemini 4 Argon and GPT-5.6 Sol. The vulnerabilities reside in PHP’s handling of out-of-memory conditions and fatal errors, enabling full remote code execution and “Heartbleed-style” memory disclosure against WordPress, Drupal, Joomla and any PHP application [Latent Space](https://www.latent.space/p/ainews-openais-patch-the-planet-program).

OpenAI described roughly two months of private coordination before public disclosure, involving the PHP Foundation, security providers and governments. Cloudflare rolled out initial WAF rules as a stopgap, making them available to all customers and urging operators to apply the patch by 14:00 UTC. An NSA account advised immediate preparation and, where mitigation was not possible, temporary shutdown of affected systems.

The coordinated response illustrates a rare, large-scale remediation effort across the PHP ecosystem, with AI-assisted discovery and detection playing a central role. Our read: the episode underscores the growing reliance on generative models for deep-code analysis and the importance of rapid, multi-party collaboration when critical infrastructure is at risk.

---

*Original Think-Tank Source: [[AINews] OpenAI’s Patch the Planet program is 1 of 2 parties to discover PHP2Shell vulnerabilities in core PHP affecting 70% of the web, using GPT-5.6 Sol; coordinated response over 2 months](https://www.latent.space/p/ainews-openais-patch-the-planet-program)*