AI uncovers a PHP vulnerability hidden for 14 years, but the fix gets stuck in process

Phoenix Tech, after synthesizing information from multiple sources, found that an anonymous post online was the first to release the CVE number of the vulnerability, which was subsequently confirmed by the PHP official team; afterward, the security firm Calif mistakenly released an attack demonstration video, which was deleted but copies spread across the internet; finally, the software supply chain security company Chainguard released a build image containing the fix ahead of time, effectively handing the vulnerability's location to attackers in advance.

Before the patch had even officially landed, the first wave of attacks was already underway. And OpenAI even warned: what has been exposed this time is just an appetizer.

A vulnerability hidden in PHP for 14 years, dug out by GPT

"PHP has exposed the 'php2shell' remote code execution vulnerability (CVE-2026-109618, CVE-2026-109619). If your business uses PHP, please self-check and upgrade to a secure version as soon as possible to avoid server attacks."

Today, many colleagues responsible for operations, security, and development received the above security risk notice, reminding PHP users to upgrade to a secure version as soon as possible.

English text is being prepared.

For more than two decades, countless developers and security researchers have repeatedly studied its code, conducting audits and applying patches over and over. How could software under such scrutiny still hide a 14-year-old landmine right under everyone's nose?

Moreover, both vulnerabilities are rated 9.2, belonging to the "critical" level. Under specific conditions, an attacker needs no login and only needs to send a single request to directly obtain server execution privileges before the business code runs. It is as if the building's access control had not yet taken effect, but the back door was already open.

It sounds like science fiction, but this is the real situation of this incident.

And the one that helped dig out this vulnerability was GPT-5.6 Sol and other artificial intelligence systems. OpenAI confirmed in its announcement that the security firm Calif used GPT-5.6 Sol to discover the critical PHP vulnerability; Wiz Research also independently discovered and reported the related issue, and used Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol in its research.

Specifically, under the guidance of researchers, GPT-5.6 Sol and other AIs reviewed PHP's underlying code and found an abnormal path in PHP where "only half the data is written, but it is treated as complete data." Then, this clue was organized into reusable audit rules, and the investigation continued, leading to the discovery of a second issue.

The significance of this goes beyond "AI found a bug." PHP has been running for more than a decade, and much of the code was sufficient back then; it is just that, viewed again by today's security standards, some of it is outdated. AI accelerated the exposure of this dormant risk and also gave defenders a time window ahead of attackers.

What is more troublesome is that the details of this vulnerability leaked before the patch was released, and attackers even got ahead of the patch. And among the several fixed versions officially released by PHP, PHP 8.1 and earlier versions cannot receive official updates and can only rely on source code patches or distribution backports.

In other words, the dilemma for many websites is not "to fix or not to fix?" but "can it be fixed? To what extent can it be fixed? Will fixing it crash the business?"

The discovery of the vulnerability is only the first hurdle. The real difficulty comes afterward: asset inventory, version compatibility, testing and verification, canary upgrades, restarting processes, and confirming whether old processes are still running. AI has maxed out the speed of discovering vulnerabilities, but fixing them is still stuck in organizations, processes, and legacy systems.

In fact, these two vulnerabilities were not discovered only today.

The PHP Foundation stated that the clue for CVE-2026-109618 first appeared in an external security audit of the PHP project in 2024. At that time, a core developer had already noticed the related hidden risk while fixing issues found in the audit... "The delay in fixing it was a structural failure."

The PHP Foundation's statement reveals a dilemma: for programmers, finding a vulnerability is often easier than fixing it.

As the PHP Foundation itself said, multiple fix options each have costs: some may break backward compatibility, some may introduce new denial-of-service risks, and others require coordinating a large number of third-party extensions.

The repair work therefore stopped and started, started and stopped, and the issue was shelved. Until this time, it was discovered by GPT-5.6 Sol.

In fact, the bigger contradiction is that many global commercial giants and startups are freely enjoying the foundation laid by open-source software such as PHP, yet the maintenance of that foundation has long been pressed onto a small group of volunteers and tight funding.

The PHP Foundation has publicly called out many times: have those companies that have made a fortune from open source put in investment commensurate with their degree of dependence?

Last September, the Java, Python, PHP, Rust, Eclipse, and other foundations, together with OpenSSF, also issued a statement directly telling large enterprises: "Open-source infrastructure is not free," long-term free use is unsustainable, and commercial users should pay for infrastructure.

To put it plainly, the problem is not that no one saw the vulnerability, but that after seeing it, who pays, who bears the compatibility risk, and who provides a safety net for those systems that have long been unmaintained?

The emergence of AI has made this problem even more obvious. It makes "discovering vulnerabilities" faster than ever, but it cannot automatically solve the most labor-intensive task of "fixing vulnerabilities." Should the patch be applied? Will applying it cause problems? Who reviews it? Should enterprises update immediately? Should old systems be migrated? ... Every step requires organizations and people to make decisions.