PHP Security Vulnerability: What to Do About the Two Critical Flaws OpenAI Found
We explain which version you need to move to for the two critical PHP flaws found through OpenAI's Patch the Planet initiative, and what your business should do.
Contents 9
The PHP security vulnerability came to light in October 2026 thanks to an AI initiative. OpenAI's "Patch the Planet" effort coordinated the discovery and fixing of two critical remote code execution flaws in PHP, which is estimated to power around 70 percent of websites. The flaws are registered as CVE-2026-109618 and CVE-2026-109619. Both scored 9.2 on CVSS v4.0. Updating is no longer optional; it is a necessity.
In short:
- Two critical flaws were found in PHP: CVE-2026-109618 and CVE-2026-109619.
- Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- There is no official patch for PHP 8.1 and older versions.
- There is no complete workaround; the only safe path is to update.
What exactly is the PHP security vulnerability?
Both flaws fall into the remote code execution class. That means an attacker can run their own code on a vulnerable server. The community has nicknamed the pair "PHP2Shell". Both sit at the critical level with a CVSS v4.0 score of 9.2. Hosting panels such as Plesk have also published separate bulletins for the PHP builds in their packages.
One of the flaws was found by the security firm Calif, working with OpenAI's GPT-5.6 Sol model. Wiz independently discovered and reported both flaws. In other words, the finding does not rest on a single source, which is an important assurance that the vulnerabilities are real.
What is Patch the Planet and how did it work?
Patch the Planet is OpenAI's initiative to coordinate a global response to vulnerabilities uncovered by its AI agents. It was first announced on June 22, 2026. OpenAI says that over the past two months it has led a coalition of PHP maintainers, researchers and other stakeholders. The process took this long because the fix required a major change in the PHP engine.
OpenAI also proposes a five-stage coordination framework and is asking the security community to critique it. The company expects findings like these to rise sharply in the coming months. It has also committed $1 billion to subsidized Daybreak access for under-resourced organizations. This is not a cash grant; it is access support.
Which PHP versions are safe?
The fix was released on four active branches. The table below summarizes what to do for each version.
| Version you use | What to do |
|---|---|
| PHP 8.5 | Update to 8.5.12 |
| PHP 8.4 | Update to 8.4.27 |
| PHP 8.3 | Update to 8.3.36 |
| PHP 8.2 | Update to 8.2.35 |
| PHP 8.1 and older | No official patch; move to a supported version |
The version numbers were published on the official PHP website. The PHP team states that there is no complete workaround and that updating is the only safe option. For those running systems such as Joomla and WordPress, this assessment of the PHP security release reaches the same conclusion: staying on old versions means risk.
Are the flaws being exploited right now?
Sources differ on this. CISA issued an urgent call to patch and said it had not observed these flaws being exploited at the time of publication. watchTowr, on the other hand, reports that the flaws are being exploited. That claim has not been confirmed by official PHP or CISA sources.
In practice it makes no difference. With a critical remote code execution flaw, studying the patch details is usually enough for exploit code to appear. There is no benefit in delaying the patch.
What does this PHP security vulnerability mean for your business?
If your website or internal system runs on PHP, this news affects you directly. Pay particular attention to the following:
- Find out your server version. Check the running version from your hosting panel or with the
php -vcommand. - Plan the update. Move to the fixed version that matches you in the table above.
- Leave the old version behind. If you use PHP 8.1 or earlier, no patch is coming; moving to a supported branch is a must.
- Ask your hosting provider. On shared hosting, the provider does the update. Confirm that they have done it.
- Test your dependencies. Make sure plugins and frameworks work without problems on the new version.
Businesses that worry about their application breaking after an update tend to postpone it. This shows how valuable it is to make version upgrades a regular habit. To think about security from the very start of the software development process, you can also look at our guide to GDPR-style (KVKK-compliant) software development.
Why has AI become important in finding vulnerabilities?
The most striking aspect of this event is that the flaws were found with an AI model. OpenAI's GPT-5.6 Sol model was among those that flagged the flaw before attackers did. This cuts both ways: defenders can find vulnerabilities faster, but the same capability could fall into attackers' hands.
That is why OpenAI stresses coordination. Finding a flaw is not enough on its own; maintainers must prepare the fix, distributors must package it, and users must update. The weakest link in the chain is often the last step, actually applying the update.
For another security risk involving AI agents, see our post on prompt injection.
Frequently asked questions
What is PHP2Shell?
PHP2Shell is the name the community has given to the CVE-2026-109618 and CVE-2026-109619 flaws together. Both allow remote code execution. If an attacker succeeds, they can run commands on the server.
What should I do if I use PHP 8.1?
There is no official patch for PHP 8.1 and older versions. You need to move to a supported version, that is, the 8.2, 8.3, 8.4 or 8.5 branch. The safest approach is to try the migration in a test environment and then roll it out to production.
Does any measure other than updating help?
According to the PHP team, there is no complete workaround and updating is the only safe option. Extra layers such as firewall rules may reduce risk but do not close the flaw. The real fix is moving to a patched version.
Who does Patch the Planet help?
The initiative aims to get critical vulnerabilities found with AI fixed in a coordinated way. OpenAI has also committed $1 billion to subsidized Daybreak access for under-resourced organizations. This is not a cash grant; it is access support.
Conclusion
The two critical flaws in PHP show that AI-assisted security research now produces real, large-scale results. What your business needs to do is clear: check your version, move to the right fixed version, and get rid of unsupported versions. For details, you can read OpenAI's official post. If you would like to review the currency and security of your software together, the EngerekTech team can help.
Sources
