AI 協助發現 PHP 嚴重漏洞，修補前已出現攻擊

Originally published on Medium.

At 9:55 p.m. on Wednesday, October 21, 2026, in Tokyo, Japan, the prime minister Sanae Takaichi urged website owners to check whether they ran PHP and apply a security fix as soon as it became available.

If they couldn’t patch, she advised temporarily disabling parts of their sites.

About an hour later, PHP released fixes for two critical vulnerabilities.

The US National Security Agency issued an even drastic warning: if you couldn’t patch, take your systems OFFLINE.

The story so far

To see why, you need to understand the whole incident, and it starts long before AI.

In 2004, security researcher Stefan Esser found the first remote flaw in how PHP handles its memory limit.

In 2020, someone filed PHP bug #78876, noting that long form variables could make PHP run out of memory.

It was treated as harmless.

In 2024, an audit by OSTIF and Quarkslab rediscovered the same out-of-memory problem.

No one could prove it was exploitable, so it stayed unfixed (Calif).

What the bugs actually are.

PHP stops a request when it runs out of memory.

If that happens halfway through building an internal data structure, PHP skips its cleanup.

The memory is freed, but pointers to it survive.

The next request handled by the same worker then trusts that freed memory, which an attacker has filled with their own data.

Calif showed that one crafted upload, under PHP’s default 8 MiB upload limit, can exhaust its default 128 MiB memory limit.

No login is needed, and no bug in the website’s own code.

PHP filed the flaws as two CVEs: CVE-2026–109618 (out-of-memory corruption) and CVE-2026–109619 (stale state that survives into the next request).

Both are rated 9.2 out of 10 (php.net).

The discovery.

On 30 July 2026, OpenAI invited the security firm Calif into Patch the Planet, its program to help open-source maintainers.

Calif’s Ryan Austin picked PHP.

On 1 August, working with OpenAI’s GPT-5.6 Sol, he had a working remote code execution against WordPress.

Calif reported the first bug to PHP on 11 August and sent a working exploit on 14 August.

On 19 August, Wiz Research independently found the same family of bugs using Gemini 4 Argon, GPT-5.6 Sol and its own Wiz Atlas tool, and reported its variants on 24 August (Wiz).

The quiet window.

For about 11 weeks, PHP’s maintainers built the fix while OpenAI coordinated a coalition.

Linux distributions received patches early.

Cloudflare, AWS, Google, Microsoft, Fastly, Akamai and others prepared firewall rules.

OpenAI briefed the White House’s Super Intelligence Force, the Office of the National Cyber Director and CISA (OpenAI).

The break.

The plan was to disclose on 22 October.

On 20 October, an anonymous Hacker News post claimed the bugs were real.

It was deleted, but screenshots spread to X and Mastodon, along with images and a short video of Calif’s private exploit tool, named PHP2Shell (Alexandre Daubois).

PHP brought the release forward to 21 October at 14:00 UTC.

watchTowr also confirmed the flaws were genuine.

Cloudflare saw the first attacks at 07:43 UTC, more than six hours before any patch existed (Sansec).

The patch.

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 shipped on schedule.

The NSA, the FBI, CISA, the UK’s National Cyber Security Centre and CERT-EU all issued alerts.

In the Netherlands, DigiD, MijnOverheid, the House of Representatives’ site and the Dutch National Cyber Security Centre’s own site went offline (Patchstack, citing NOS).

Cloudflare’s shares rose about 5% that day (Investing.com).

Finding the bug is no longer the hard part

Calif’s account is the clearest.

Austin started from a theory, that ‘siblings’ of Esser’s 2004 bug still lurked in the code.

He asked his model to look for ways to trigger a controllable out-of-memory error, then for code that could be interrupted mid-task.

The model spotted that PHP counts a new table entry as live before it finishes building it.

Austin then had it turn that one finding into a reusable search pattern, which led straight to more variants (Calif).

Calif says it used no special harness and no models unavailable to the public.

Its lesson is that knowing your target still matters. The expert supplied the direction. The model supplied the speed.

Wiz tells the same story from the exploitation side.

Building working attacks meant chaining several bugs and adapting to each target’s memory layout.

With frontier models it adapted exploits across applications in hours, and a single researcher did in a week what Wiz says would once have taken a world-class team months (Wiz).

AI can find vulnerabilities faster than maintainers can fix them.

If finding was the whole problem, PHP2Shell would have been fixed in 2020 or 2024.

It wasn’t, and the PHP Foundation has said why.

After the release, the Foundation explained that a possible exploit had been theorized as early as 2024.

No concrete attack path was found, and other issues with clearer impact took priority.

The experts who could fix it had many other responsibilities, so work on a fix stalled and restarted repeatedly over months (ABC News).

OpenAI says these bugs are among several significant ones it has already found, and it expects such findings to “increase sharply” in the coming months.

A fix in PHP’s source code protects nobody until it runs on a server.

That last step belongs to the people who operate websites, and PHP2Shell showed how unevenly it happens.

After disclosure, Cloudflare says exploit attempts jumped from thousands to millions (Yahoo Finance).

On 20 October, the security company Mallory counted about 884,000 internet-facing hosts reporting PHP 8.1 or older (The Hacker News).

PHP no longer releases fixes for those versions.

That is why the NSA’s advice included taking unpatchable systems offline, and why Japan’s Prime Minister suggested switching site features off (NSA).

The Dutch government sites that went dark show that even well-resourced organizations reached for it.

The next PHP2Shell

A Prime Minister asking a country to patch a programming language overnight sounds like a one-off but it probably isn’t.

OpenAI expects findings like this to keep coming, and attackers already run AI campaigns for a few thousand dollars.