Frontier models turned a hole that survived a decade in PHP into unauthenticated code execution on 70% of the web, and the embargo broke three times
Frontier models turned a decade-old PHP memory bug into unauthenticated code execution across about 70% of websites; this brief lays out the nine-week fix, the three ways its embargo gave way, and the patching and process decisions a product team now faces.
A security firm called Calif reported a pair of critical vulnerabilities in PHP to the project's security team on 11 August 2026. 1 The fix became public on 21 October at 14:00 UTC. 2 Five days before the patch, on 17 October, something tried to exploit them against a honeypot that Amazon runs, from an anonymised commercial address. 3
Both bugs carry a CVSS score of 9.2 on a 0-to-10 severity scale, and both work without a credential. An unauthenticated request can execute code on the server, or read another user's passwords, tokens and API keys straight out of process memory. 4
Almost every PHP release from 5.4 onward carries at least one of them. PHP runs roughly 70% of the world's websites, including WordPress, Drupal and the MediaWiki software behind Wikipedia. 4
For anyone serving PHP traffic, the update is due this week, and the safe interval ends whenever someone publishes a working exploit.
What the flaw actually does
PHP frees the memory it used for a request once that request ends, and the four bugs Wiz Research reported all sit inside that teardown. 4 Each starts the same way: an allocation fails, or a fatal error fires, at a moment when the engine has already written down that something exists. 14
Calif's write-up has the cleanest example. To add an entry to an internal table, PHP increments the table's counter first and fills the entry in second. 1 Filling the entry allocates memory, and that allocation can die. The counter survives, one higher than the number of real entries. 1
Later, when the request shuts down, PHP walks its table up to the count it recorded. It reaches the half-built entry and reads whatever now occupies that memory. 1
Which server interface you run decides how far that goes. Apache with mod_php, where PHP runs inside the web server process, tears its request tables down even after startup has failed, so the stale entry gets consumed. 1 Under PHP-FPM, which gives PHP its own worker processes, a failed startup takes a different branch and the worker exits, table and all. 1 One bug, two outcomes: code execution on one setup, a crash on the other.
Reaching the memory limit at all takes a second trick. PHP checks the declared size of an upload against its
post_max_size setting, then trusts that number while consuming the bytes that follow. 1 A chunked request slips past it, and one empty file field nested a few levels deep expands into enough internal allocations to exhaust the default 128 MiB heap. 1The cheaper attack skips execution entirely. A request that leaves PHP's session pointer aimed at freed memory makes the engine URL-encode the reclaimed heap into a
PHPSESSID response cookie, and the attacker reads other requests' credentials out of it. 4
All of it lives in the engine, so a plain Hello World page on an affected build is exposed, and Wiz demonstrated working attacks against untouched container images of WordPress, Drupal and Joomla. 4 Calif's list runs longer: MediaWiki, Roundcube, Magento, phpMyAdmin, Nextcloud, Laravel, Symfony and WHMCS. 1
Why a known bug went a decade without a fix
A version of this problem has been public since 2004, when Stefan Esser found the first PHP memory-limit flaw and declined to release an exploit. 1 In 2020 a bug report noted that long variables could exhaust memory and leave temporary files uncleaned. 1
In 2024, an external audit by Quarkslab, funded through OSTIF, found the same out-of-memory issue again. Exploitation had not been proven, so the bug stayed open. 12
The PHP Foundation has since explained what happened next. Several fixes were possible, and each carried a cost: breaking backward compatibility, opening a new denial-of-service path, or forcing changes across a long tail of third-party extensions. 2
The security team operates by consensus. Weighing three bad options with no proof the bug could be exploited, it stalled, restarted, and stalled again over months. 2 The Foundation's own verdict: "the delay was a structural failure, caused by both the security team's decision process and its lack of resources." 2
The blocking resource was authority to pick between three bad options. That authority sat with a small group of core developers who knew the engine deeply and had other responsibilities.
What the models actually did
Calif began auditing PHP on 30 July, invited in through OpenAI's Patch the Planet programme, and surfaced its first memory-limit fatal within days. 1
The write-up is unusually specific about who did what. A human framed the question around Esser's 2004 finding. An LLM then reviewed Zend's memory manager, its fatal-error reporting and its request shutdown, and flagged the ordering problem in the hash-table add path. 1 Two more interrupt points followed, enough to build reliable exploits against both mod_php and PHP-FPM. 1
OpenAI reported the same root cause on the same day, 11 August. 2 Wiz's team found it independently on 19 August, using its Atlas agent with Gemini 4 Argon and GPT-5.6 Sol. 4
Wiz's account of what changed is the one to keep. The flaw had been sitting there for a decade, and making it work meant adapting to each target's memory layout through repeated testing and debugging. 4 Models run that loop cheaply. "A single researcher completed in a week what previously would have taken a world-class team months of work." 4
OpenAI describes the result as a defender's window: to its knowledge, frontier AI reached these bugs before attackers did. 5
Nine weeks, and then six days
| Date, 2026 | What happened |
|---|---|
| 30 July | Calif starts auditing PHP under Patch the Planet |
| 11 August | Calif reports an unconditional RCE; OpenAI reports the same root cause the same day |
| 19 August | Wiz finds the first of its four bugs with Atlas, Gemini 4 Argon and GPT-5.6 Sol |
| 20–21 August | Unauthenticated RCE confirmed against Drupal, then WordPress |
| 24 August | Wiz reports to the PHP security team |
| 18 September | OpenAI reports further attack vectors |
| 21 September | PHP acknowledges the reports and starts a coordinated fix |
| 17 October | First exploitation attempt, against an Amazon honeypot, five days before the patch |
| 20 October, 15:00 UTC | Both CVE identifiers circulate on forums with a wrong release time and a CVSS of 10.0 |
| 20 October, 19:30 UTC | PHP brings its pre-announcement forward and moves the release from 22 October |
| 20 October, ~20:00 UTC | Calif publishes a proof-of-concept video by mistake; copies spread |
| 21 October, 07:41 UTC | Chainguard publishes built images containing the fix, six hours early |
| 21 October, 14:00 UTC | PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 released |
The plan held for five weeks and then came apart three times in thirty hours.
At about 15:00 UTC on 20 October the two CVE identifiers began circulating on forums and social media, attached to a wrong release time and a severity of 10.0. The real score is 9.2, and no technical detail had leaked with them. 2
PHP moved its pre-announcement forward and pulled the release a day earlier, judging that an immediate release would leave distributors unable to package the fix. 2 That evening, Calif published a proof-of-concept video by mistake. Copies spread before it came down, and they accelerated other people's exploit development. 2
At 07:41 UTC the next morning, Chainguard pushed built images containing the fix, more than six hours ahead of the coordinated release. Anyone could study the patch in binary form while everyone else waited. 2
The PHP team says it found no functional exploits in circulation at the moment of release. 2 Amazon's account puts the first attempt four days earlier, from an anonymised network, and says it cannot tell how that actor got the information. 3
Cloudflare's chief executive counted thousands of exploitation attempts in the ten hours before the announcement, tens of thousands in the forty-five minutes after it, hundreds of thousands within two hours, and millions by the following morning. 6
What the exposure actually looks like
The population that needs patching is far larger than the population anyone can see. VirusTotal found about 5.1 million addresses running PHP and about 3.8 million with a port open. Only about 1.1 million announce a version in a header at all. 7
Among those that do announce, the outdated branches are the majority.
About 272,000 announce a supported branch, which is the only part of that population the PHP project still ships fixes for. About 758,000 announce an end-of-life branch between 5.4 and 8.1. A further 85,000 run the exact releases published on 24 September, the newest builds available before this fix. 7
Censys counted 2.58 million internet-facing hosts on 21 October, of which 1.58 million reported a PHP version and 1.57 million of those were unpatched. 3 The exposure is concentrated: about 920,000 of the hosts with an open port are in the United States, and five providers — AWS, DigitalOcean, Alibaba, OVHcloud and Hetzner — carry most of them. 7
Attempt volume has run well ahead of evidence that anything succeeded. WatchTowr's head of threat intelligence describes exploits sprayed indiscriminately that fail outright, measure timing differences, or crash the target. 3 CISA had observed no exploitation when it published its alert on 21 October. 8
The other thing that moved is who can build an exploit. On the evening the patch landed, a security educator who teaches exploitation on YouTube began trying to re-derive the bug with a coding agent and the hints in Calif's public demo, and published the attempt as a twelve-minute walkthrough. 9
Loading content card…
By the next morning that video had 77,000 views. Its own description says the point was to record what an AI-assisted workflow looked like in October 2026, for comparison later. 9
What a product team does with this
If your product touches PHP, this is a patching week. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. 8
Anything on 8.1 or earlier gets no fix from the PHP project at all, and CISA's advice for those systems is to take them offline until they are migrated or covered by a vendor backport. 8 For everyone else, the interim measure the community converged on is turning off the upload-progress feature —
session.upload_progress.enabled = Off — which disables progress bars on file uploads and, by the analysts' own warning, may not cover every route in. 7Edge rules from Cloudflare and others went live within hours and cover the payloads already seen. Cloudflare's chief technology officer posted the limitation himself: more variations will come, and updating PHP is the only way to fully protect a site. 10
The part worth carrying past this week applies to teams who will never run PHP.
| What this week changed | What to settle in your team | Urgency |
|---|---|---|
| A finding can reach your dependency faster than your release train moves | An inventory you can query by component and version, rather than by service name 7 | This quarter, before the next advisory |
| The embargo is a courtesy that can be withdrawn by anyone in the chain | Who may act on pre-disclosure notice, and what they may do before a patch exists 2 | Before your next coordinated fix |
| A distributor can make the fix public early, by shipping it | That any vendor artifact containing a fix is a disclosure event, whatever the plan said 2 | Before your next dependency upgrade |
| The fix can be a design decision no one is resourced to make | Which of your critical dependencies rest on one or two maintainers, and what you fund 2 | At the next budget cycle |
| Your own agents can now generate findings at volume | A disclosure policy written before you point them at code you did not write 5 | Before you turn findings on |
OpenAI has now published the five-stage process it ran for PHP: validate and fix upstream; give affected organisations time to prepare protections; coordinate with government partners; prepare updates across affected products; publish guidance and support deployment. 5
It calls the framework a proposal and lists four questions it has not answered, including who needs early notice and which evidence should pull disclosure earlier. 5 In practice this window was set by an unidentified poster, a participant's mistaken video and a distributor's early images.
There is a capacity side to this that a product manager can influence directly. The PHP security team has published 15 CVEs since 1 July, and worked through more than 100 reports that turned out invalid, duplicated or unreproducible. 2 Models help the team group reports by root cause; a person makes every call and writes every patch. 2
The Foundation's ask is money and engineers who know the codebase. 2 A dependency you cannot replace belongs in the budget, on the same terms as the servers it runs on.
The same bottleneck appears wherever machine output needs a human signature. A survey of 239 practitioners, posted to arXiv on 15 October, asked about AI-authored pull requests: 61.1% said they require more evidence than human-written ones, and 43.9% would block approval under residual uncertainty, against 19.4% for human code. 11 More findings arriving, the same number of people able to sign off.
Where the claim stops
| What this week establishes | What it leaves open | Your move |
|---|---|---|
| A flaw a funded audit examined in 2024 became working, unauthenticated code execution once models did the exploit development | How much of that belongs to the model, given that a human framed the question from a 2004 finding | Use model-assisted review as a fast search, and keep the human judgement that aims it |
| Unauthenticated code execution on eleven named applications running their default configurations | Whether each path works across every server interface and version you run | Test your own stack against the fixed build rather than reasoning from the list |
| 1.57 million hosts reporting a PHP version were unpatched the day after release | Whether any of them was actually taken over | Patch those hosts first, and keep watching them for signs of compromise |
| An exploitation attempt on 17 October, four days before disclosure | How that actor obtained enough information to try | Assume pre-disclosure knowledge is possible and watch for probing before a patch exists |
| Edge rules covering known payloads within hours of the leak | How long those rules hold once variants appear | Buy days with edge rules, and spend them on the update |
What this week establishes: a flaw that an external audit looked at and left open in 2024 became working, unauthenticated code execution in 2026 once frontier models carried the exploit development, and three separate parties broke the release plan on the way to a patch. What it leaves open: how a lone attacker knew enough to probe on 17 October, and whether any unpatched host was taken. Every fix in this story was written by a person, and the report that started it was written by a person with a model pointed at the right question.
References
- 1php2shell, Calif Research
calif.io
- 2
- 3PHP2Shell Exploitation Started Days Before Patches
securityweek.com
- 4
- 5
- 6Matthew Prince on X
x.com
- 7Sizing the PHP exposure window for CVE-2026-109618 and CVE-2026-109619
blog.virustotal.com
- 8
- 9The race to the first exploit // php2shell
youtube.com
- 10Dane Knecht on X
x.com
- 11
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.