PHP2Shell：GPT-5.6 Sol 發現 PHP 漏洞，披露外洩引發安全事件

For two decades the security industry has joked that the internet runs on PHP and duct tape. This week the joke turned into a fire drill. OpenAI's GPT-5.6 Sol, working under the company's "Patch the Planet" vulnerability research program, discovered two unauthenticated remote-code-execution flaws in PHP — tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed "PHP2Shell" — with a CVSS v4.0 score of 9.2, affecting every PHP branch from 5.4 through 8.5. Roughly 70 percent of the world's websites sit on that foundation. Then the story took a turn nobody in the patch-cycle playbook had planned for: the vulnerability leaked publicly a full day before the coordinated disclosure. By the time the PHP Foundation shipped fixes on October 21, Cloudflare was already counting millions of exploitation attempts, Amazon reported attackers had been exploiting the bugs four days before public disclosure, and more than 30 UK government services were still offline. It was the largest live-fire stress test the industry has ever run on the thesis that AI can find bugs faster than humans can fix them — and the early returns are equal parts thrilling and sobering.

What actually happened
The discovery itself is almost anticlimactic in its elegance. GPT-5.6 Sol flagged two flaws in PHP's memory management and error handling that allow unauthenticated remote code execution — the worst class of web vulnerability, because it needs no login, no user interaction, and no special position. The security firm Wiz independently found the same issues, which is the closest thing to a peer review the disclosure process allows. The PHP Foundation released four security updates on October 21, with 8.5.12 as the headline build — but only for PHP 8.2 and newer, leaving a long tail of legacy installs exposed.

The leak is what turned a routine CVE into a global incident. Disclosure was supposed to be coordinated; instead the details reached the public a day early, and CISA, the NSA and national CERTs issued emergency warnings while defenders were still mid-patch. Cloudflare reported millions of exploit attempts within the first day. Wikimedia — the infrastructure behind Wikipedia — and several Japanese online games, including Uma Musume, temporarily took services down as a precaution. The UK confirmed more than 30 government services remained offline, and telecom operator Orange suspended access to some sites and apps. Amazon's threat intelligence team said hackers were exploiting the flaws four days before the public disclosure, meaning the "secret" window may never have existed at all.

OpenAI's own framing is striking. The company called PHP2Shell "one of the most significant vulnerabilities" its models have found and predicted that "similar discoveries will increase sharply." That is not marketing spin — it is a capacity statement. Discovery now scales with compute; patching still scales with headcount, change-control meetings, and whoever still remembers which box in the basement runs PHP 7.

Why this is fun — in a slightly terrifying way
There is genuine delight in watching a language model play the role of the world's most persistent bug-bounty hunter. Humans have audited PHP's C codebase for thirty years; an AI system found two critical, reachable-by-anyone flaws in a single research program and helped push fixes into a platform that underwrites most of the web. The same week delivered more evidence for the offense-defense flip: Microsoft revealed that officially sanctioned hackers used its AI penetration-testing tool ARTEX to breach IT services provider ConnectWise's cloud backup environment, and Anthropic reported that Claude flagged 493 security issues across more than 5 million lines of code in 25 open-source projects — including one vulnerability that had gone unnoticed for 21 years. The AI safety debate usually orbits hypothetical future risks; this week the present-tense version showed up with a CVSS score.

Why this is frustrating
The frustrating part is not the discovery — it is the plumbing. Two flaws with a 9.2 score in software running 70 percent of the web means the patch window is measured in hours, while the real world measures it in quarters. Legacy PHP installs on unsupported branches will not get fixes at all. The leak-before-disclosure pattern — now seen in this case and in earlier AI-assisted bug disclosures — converts every future coordinated disclosure into a gamble: once is an accident, twice is a strategy, and attackers are already reading the same model outputs defenders are. The dull half of the workflow nobody builds until a week like this — knowing what faces the internet, and being able to ship an update without three approvals — is suddenly the most valuable security product on the market. Meanwhile Moonshot AI, on the very same day it released its 3-trillion-parameter model, disclosed that it had to identify and strip cyber-offense data out of its own training pipeline because cyber capabilities emerged naturally with scale, and published a deliberate openness policy on cyber weights. When every lab is simultaneously discovering, weaponizing and de-fanging the same capability, "we found it first" is not a governance model.

Sources: BYOBot AI Daily Newsstand (October 23 2026), Tencent Research Institute AI Express, Wall Street Journal morning briefing, PHP Foundation security release, Cloudflare threat report, threerouter