Critical PHP vulnerability PHP2Shell was discovered by security companies Calif and Wiz using AI, with response measures implemented using OpenAI's framework
It has been revealed that the critical PHP vulnerability 'PHP2Shell' was discovered using AI by security companies Calif and Wiz, and that countermeasures were implemented using the OpenAI framework.
Critical PHP vulnerability PHP2Shell (including two vulnerabilities, CVE-2026-109618 and CVE-2026-109619) was independently discovered by security companies Calif and Wiz using AI, and PHP released emergency updates 8.5.12, 8.4.27, 8.3.36, and 8.2.35 late at night on October 21, 2026 Japan time. If exploited, attackers could take over servers, steal confidential data, or tamper with websites running on the servers. According to Calif, as part of OpenAI's Patch the Planet security program announced in June 2026, it discovered the first vulnerability on August 1, reported it to PHP on August 11, and discovered the second vulnerability on August 21; Wiz independently discovered it on August 19 and reported it on the 24th. Calif also released a demo video of the exploit executable on Nginx.