OpenAI-led coalition fixes PHP2Shell bug after early leak

OpenAI President Greg Brockman stated that his company led a two-month coalition to fix the PHP2Shell bug. The vulnerabilities were discovered and addressed using OpenAI's models as part of its Patch the Planet initiative. These bugs allowed an unauthenticated attacker to execute their own code on servers running the PHP language. The two vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619.

A limited version of the bug surfaced in 2024 but was not considered significant at the time. The original target date for the PHP patch release was October 22. PHP maintainers moved the release forward to October 21 because details started leaking early. Rumors about the CVE IDs began circulating on online forums and social media around 15:00 UTC on Tuesday. Chainguard unilaterally broke the embargo and published built images containing the fix on October 21st at 07:41 UTC. PHP developers accused Chainguard of revealing critical bugs ahead of the planned official disclosure.

Governments in Finland, the Netherlands, and France pulled their websites offline due to the PHP bugs. Security researchers at Amazon Threat Intelligence say attackers began targeting the PHP2Shell flaws four days before patches were released. The PHP security team struggled to choose between competing approaches to fix an OOM problem due to trade-offs like backward compatibility breaks. Greg Brockman called for authorized defenders like governments to scan for vulnerable servers.