AI Models GPT-5.6 Sol and Gemini 4 Argon Uncover Critical PHP2Shell Vulnerability Affecting Millions of Websites

AI models GPT-5.6 Sol and Gemini 4 Argon have discovered "PHP2Shell," a critical class of vulnerabilities in the core PHP engine, enabling unauthenticated remote code execution and memory disclosure (CVE-2026-109618, CVE-2026-109619, CVSS 9.2). These flaws affect every PHP version released in the last decade, impacting approximately 70% of all websites, with patches released on October 21, 2026, in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. For broader context, explore our Top 100 AI Tools.

The Discovery of PHP2Shell

The discovery of PHP2Shell highlights the increasing role of artificial intelligence in cybersecurity research. OpenAI's GPT-5.6 Sol identified the vulnerability as part of its "Patch-the-Planet" initiative. Concurrently, Wiz Research independently uncovered the same issues, demonstrating the potential for multiple advanced AI systems to pinpoint complex security flaws. These bugs had been present in PHP's memory management and error handling mechanisms for over a decade, remaining undetected by traditional methods.

Wiz Research successfully demonstrated pre-authentication remote code execution (RCE) on popular content management systems like WordPress, Drupal, and Joomla within hours of identifying the vulnerabilities. This rapid exploitation capability underscores the severity and immediate threat posed by PHP2Shell.

Impact and Scope of the Vulnerability

The PHP2Shell vulnerabilities are particularly concerning due to PHP's widespread use. With approximately 70% of all websites relying on PHP, the potential attack surface is vast. The fact that every PHP version released in the last ten years, starting from 5.4, is affected means that a significant portion of the internet was vulnerable until the recent patches.

The vulnerabilities allow attackers to execute arbitrary code on affected servers without needing any authentication. This level of access can lead to complete system compromise, data theft, and further network infiltration, making it a critical threat to web infrastructure globally.

Coordinated Disclosure and Patch Release

The disclosure of PHP2Shell involved a coordinated effort over two months. This collaboration included PHP developers, Wiz Research, Cloudflare, and various US agencies, ensuring that patches could be developed and distributed before public disclosure. The PHP Foundation released the necessary fixes on October 21, 2026, in the following versions:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Website administrators are strongly advised to update their PHP installations to these patched versions immediately to mitigate the risk. For more information on platform security and updates, users can consult official PHP documentation.

Challenges and Future Implications

The PHP Foundation acknowledged a "structural failure" within its security team, admitting that the fix for these critical vulnerabilities had been stalled for several months. This admission highlights potential systemic issues in maintaining the security of widely used open-source projects.

OpenAI anticipates a sharp increase in security findings of this magnitude in the coming months, attributing this trend to the advanced capabilities of AI models like GPT-5.6 Sol. This suggests a future where AI plays an even more prominent role in identifying and potentially exploiting complex software vulnerabilities, necessitating a proactive and adaptive approach to cybersecurity.

Conclusion

The discovery of PHP2Shell by AI models GPT-5.6 Sol and Gemini 4 Argon marks a significant event in cybersecurity. It underscores both the critical vulnerabilities that can lie dormant in widely used software for years and the emerging power of artificial intelligence in uncovering them. With patches now available, it is imperative for all organizations running PHP to update their systems to the latest secure versions. The incident also serves as a stark reminder of the ongoing need for robust security practices and the evolving landscape of threat detection, increasingly influenced by advanced AI capabilities.

Sources

• frontman/apps/frontman_server/config/providers.exs at main
• Arena Leaderboard - a Hugging Face Space by lmarena-ai
• Update pstack models for Gemini 4 Argon · GitHub
• ‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire | WIRED