AI Found a Hidden Flaw in the Engine Behind Most Websites (PHP2Shell)

On October 21st, 2026, PHP shipped an emergency fix for two critical flaws (CVSS 9.2): with the right request, on the most exposed setups, a stranger with no password could take over a web server before the website's own code even ran. PHP runs about 69% of the websites whose server language can be measured, and WordPress alone runs 39.6% of all websites. Versions going back to PHP 5.4 (2012) were affected. The people who found it were working with AI: Calif with OpenAI's GPT-5.6 Sol, OpenAI's Codex Security team, and Wiz Research with Google's Gemini 4 Argon and GPT-5.6 Sol. This film explains the two bugs in plain words, how the AI was actually used (and what the humans did), the 71 days from first report to patch day, the leak, and what it means for the next ten years of security. What to do: if you run a website, update PHP itself to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (not only WordPress or your plugins). If a host runs PHP for you, ask them today. PHP's own words: there are no complete mitigations, updating is the only safe choice. Key facts and timeline CVE-2026-109618, "RCE via OOM corruption", and CVE-2026-109619, "RCE via stale global state": CVSS v4.0 9.2 (PHP), 9.8 CVSS v3.1 (NVD). Riskiest setup: Apache with mod_php. Takeovers shown on WordPress, Drupal and Joomla; Calif lists Magento, MediaWiki, Nextcloud, phpMyAdmin, Roundcube, Laravel, Symfony. Second risk: reading server memory (passwords, login tokens, API keys, certificates). 2024: first signs seen during a Quarkslab audit. Jul 30, 2026: Calif starts its audit (Patch the Planet). Aug 11: Calif and OpenAI report the same root cause. Aug 19: Wiz finds its own bug. Sep 18: more attack paths. Oct 20: CVE numbers leak with a wrong 10.0 score. Oct 21, 03:02 UTC: Cloudflare WAF rules on. 07:41 UTC: Chainguard breaks the embargo. 14:00 UTC: patch public. As of Oct 22: no public evidence of a breach, neither CVE in CISA's Known Exploited Vulnerabilities catalog. Context: Heartbleed (2014), Shellshock (2014), Log4Shell (2021), Google Big Sleep in SQLite (2024), DARPA AIxCC (2025), Gemini 4 Argon via Fairwind, Claude Mythos 5.1, OpenAI Daybreak ($1 billion for frontline defenders). We do not show how to build the attack. Every number on screen comes with its source, listed below. Lines marked OUR TAKE are our opinion. Chapters 0:00 October 21st: two critical PHP flaws 1:06 Part 1: The engine under the web 2:23 Part 2: Two bugs, explained 5:36 Part 3: How the AI found it 8:41 Part 4: 71 days to patch day 11:33 Part 5: The new normal 14:31 Close Sources (all read on October 22nd, 2026) https://www.php.net/archive/2026.php https://github.com/php/php-src/security/ad... https://php2shell.com/ https://w3techs.com/technologies/details/p... https://w3techs.com/technologies/details/c... https://www.php.net/releases/5_4_0.php https://aws.amazon.com/security/security-b... https://www.php.net/manual/en/history.php.php https://www.mediawiki.org/wiki/MediaWiki https://www.php.net/supported-versions.php https://www.cve.org/About/Overview https://www.first.org/cvss/ https://nvd.nist.gov/vuln/detail/CVE-2026-... https://nvd.nist.gov/vuln/detail/CVE-2026-... https://github.com/php/php-src/security/ad... https://www.php.net/manual/en/session.uplo... https://calif.io/php2shell https://thephp.foundation/blog/2026/10/21/... https://openai.com/index/coordinated-discl... https://github.com/php/php-src https://www.wiz.io/blog/php2shell-php-rce https://patchtheplanet.org/ https://wordpress.com/blog/2026/10/21/php2... https://blog.cloudflare.com/php-vulnerabil... https://www.cisa.gov/known-exploited-vulne... https://nvd.nist.gov/vuln/detail/CVE-2014-... https://nvd.nist.gov/vuln/detail/CVE-2014-... https://en.wikipedia.org/wiki/Shellshock_(... https://nvd.nist.gov/vuln/detail/CVE-2021-... https://googleprojectzero.blogspot.com/202... https://openai.com/index/introducing-aardv... https://www.darpa.mil/news/2025/aixcc-results https://blog.google/innovation-and-ai/mode... https://www.anthropic.com/claude-fable-and... https://openai.com/index/patch-the-planet/ https://openai.com/index/daybreak-for-fron... https://daniel.haxx.se/blog/2026/10/22/ign... About AI First: AI moves fast. We get there first. One story, checked at the source, explained for everyone. Narration is AI-generated (ElevenLabs). Visuals: our own 3D renders and real screenshots of the source pages. Music recorded for this film. PHP logo by Colin Viebrock, CC BY-SA 4.0 (php.net/download-logos.php). #PHP2Shell #PHPvulnerability #CVE2026109618 #CVE2026109619 #AIsecurity