Two holes in PHP, the language under a huge share of the web, pushed teams into emergency patching on October 21. The uncomfortable detail is how the bugs were found.
What broke
The flaws are tracked as CVE-2026-109618 and CVE-2026-109619. PHP said an attacker can execute code on a vulnerable server without logging in, and that installations serving web requests were the ones exposed. Fixed packages went out for the supported lines: 8.5.12, 8.4.27, 8.3.36, and 8.2.35.
The public mess was not theoretical. Finland temporarily shut government web services. Edinburgh’s council and the BBC took pages offline rather than leave them up. Amazon said a probing attempt, already being called PHP2Shell in some notes, hit one of its honeypots on October 17, days before the patches landed.
The part about the models
OpenAI said its Calif effort identified a critical flaw with GPT-5.6 Sol. Wiz said it found both vulnerabilities on its own. Researchers also used frontier models while building exploits and checking fixes. OpenAI has started calling the gap between an AI-assisted find and public disclosure a defender’s window: the time maintainers have before someone else with a similar model catches up.
If you run PHP, the action is dull. Check the version, install the matching release from the list above, and do it before you finish the thread about what this means for security research. Old, unsupported PHP does not get a tidy package. Those machines need to be isolated or upgraded, not argued with.