OpenAI and PHP maintainers fix critical PHP2Shell vulnerability

Once exploited, attackers don't even need to enter an account or password—they can simply make the server obediently execute malicious code.

Even the Dutch national cybersecurity agency, which normally spends its days teaching others how to defend against hackers, reacted to the tip-off by immediately shutting down its own website!

To plug the hole, OpenAI and the PHP maintainers secretly worked around the clock for two months, going so far as to tear everything down and start over—even changing the PHP engine's memory management mechanism.

Yet after two months of secrecy, everything collapsed in the final 48 hours—

The vulnerability news leaked first, forcing the patch to go live a day early; then an attack demonstration video accidentally surfaced, and the fixed images were made public ahead of schedule.

Before webmasters around the world could even react and apply the patch, the first wave of real attacks was already underway.

Even more chilling, OpenAI also buried an easter egg: these two are just appetizers—several other major vulnerabilities are still queued up for emergency fixes...

Here are three key points to understand the PHP blowup:

Two high-severity vulnerabilities: PHP is a backend language commonly used for websites. In affected deployments, attackers may be able to make the server execute malicious code without logging in.

GPT helped find the holes: Calif used GPT to discover the vulnerabilities, and Wiz independently found them as well; PHP maintainers led the fix, with OpenAI coordinating all parties.

Patches have been released: website operators need to upgrade PHP; temporary mitigations are no substitute for the patch.

PHP suddenly blows up, and cybersecurity agencies shut down their sites first

This secret emergency repair effort ended with even the agency responsible for defending against hackers having to shut down its site first to avoid risk. Before the patch could arrive, the official website went offline first.

On October 21, the Netherlands' National Cyber Security Centre (NCSC) chose to shut down its site first and wait for the fix.

It wasn't the only one. The Dutch judicial system's recruitment website and the judicial training institute's website also suspended service, and even the file inbox used to transmit court hearing information to journalists was temporarily closed.

Japan's Ministry of Finance likewise shut down parts of its official website's content and services, urgently inspecting servers and installing fixes.

The two PHP engine vulnerabilities that triggered these shutdowns are collectively called PHP2Shell, and both have a CVSS severity score of 9.2 out of 10.

The most dangerous consequence is called remote code execution, or RCE. A website is supposed to only process requests sent by visitors, but it may instead start executing code specified by an attacker.

Wiz set up a test environment using the latest WordPress, Drupal, and Joomla images at the time, reproduced an unauthenticated remote attack, and also verified an attack path for reading passwords, tokens, and API keys from memory.

Even more, in some Apache with mod_php deployments, the attack can occur before the website's own program even starts. Even if a page contains only a single line saying "Hello World," it could still be hit.

The trouble is that far too many websites use PHP. Among websites where W3Techs can identify the server-side language, 69.3% use PHP. When the underlying engine has a problem, a large number of websites have to be checked and upgraded.

GPT does the heavy lifting

From one vulnerability to an entire class

Rewind to July 30, when Calif researcher Ryan Austin began auditing PHP. He was participating in OpenAI's Patch the Planet program, which uses AI to help open-source projects find and fix vulnerabilities.

By August 1, multiple remote attack paths had been found.

As early as 2004, PHP's memory limit mechanism was found to have a remote attack vulnerability. Ryan had GPT-5.6 Sol use this as an entry point to check whether similar problems were still hidden in the existing code.

When a program processes a request, it must temporarily place data in memory. PHP sets a quota for each request, and processing must be interrupted once it is used up. This situation is called memory exhaustion, or OOM.

In one attack path disclosed by Calif, less than 8MiB of request data was enough to exhaust PHP's default 128MiB memory quota during processing.

After a tiny request enters PHP, it is split into a large number of records, each of which takes up additional memory. Attackers exploit this amplification layer to make the program exhaust its quota at a specific step.

According to PHP's rules, at this point the operation should be interrupted and control should switch to error reporting and cleanup.

But it is precisely at this moment that the data may be only half filled in.

Inside the hash table where PHP stores data internally, the model found a dangerous ordering: when adding a new record, it first increments the record count, and only then allocates memory and fills in the content.

If the memory quota happens to be exhausted during allocation, the program will jump away. The new record has not yet been filled in, but the count has already been incremented.

The cleanup routine checks against the count and therefore treats the not-yet-prepared memory as a valid record. It is as if a row in a spreadsheet has not been fully filled in but is already being used as a complete record.

Turning this kind of error into a remote attack also requires arranging the relevant memory contents and meeting specific runtime conditions. Researchers have already made the program execute attacker-specified code in affected deployments.

The researchers did not stop at this one hole. They had the model write the error pattern it had just discovered into SKILL.md, a reusable audit guide, and then followed the same thread further.

Following that thread, the agent found another problem in the code responsible for tracking file upload progress.

When a request ends abnormally, memory is freed, but the program handling the request still retains the old address. When it receives the next request, it may again use that address to read memory that is no longer valid.

This is a use-after-free, also called UAF. It is as if a record has already been invalidated, yet the program still looks up data at the old address, and that memory may have already been reallocated.

On the other side, Wiz also independently found two vulnerabilities. Once the PHP version changes and the runtime environment changes, the original attack may stop working, and the model has to keep analyzing crashes and adjusting its verification.

Wiz researcher Sagi Tzadik wrote on X: "AI did most of the work here."

Operating on the PHP engine

Two months of secret emergency repairs

It took only a few days to find the attack path, but the repair preparations that followed kept them busy for two months.

This time OpenAI led the coordination, with PHP maintainers leading the fix. But the two vulnerabilities involve the engine's memory management and error handling; blocking the immediate attack path does not rule out similar problems emerging elsewhere, and a major overhaul of the underlying layer would also have to ensure that old programs and extensions still run.

The PHP Foundation said the team coordinated around the clock, even on weekends. Patches had to be tested across multiple versions, and distributors had to package them while security vendors prepared protections.

In the end, PHP even changed when it aborts work.

The patched PHP sets two memory limits. When the soft limit is reached, it waits until the program reaches a safe point before handling it, avoiding leaving half-finished data; when the higher hard limit is reached, it exits the process, preventing the dangerous state from continuing to be used.

Leaks in the final 48 hours, and the attack came first

The parties had originally agreed to release simultaneously at 10 p.m. on October 22.

But around 11 p.m. on the 20th, the numbers of the two vulnerabilities suddenly circulated online, mixed with an incorrect release time and a maximum score of 10. At that point, less than 48 hours remained until the scheduled release.

At 3:30 a.m. on the 21st, the PHP team issued an advance notice, moving the official release forward by a full 24 hours.

But sending a notice does not mean the update can be installed. Distributors were still packaging; moving it even earlier would mean users would learn they were at risk before they could get an easily installable update.

About half an hour after the notice was sent, an attack demonstration video also leaked.

The PHP Foundation's postmortem said Calif mistakenly released the attack demonstration. The video was quickly deleted, but copies had already spread.

By the afternoon of the 21st, even build images containing the fix had been made public early. After Chainguard published these images, outsiders could already compare the old and new code and infer where the vulnerabilities were.

At 3:43 p.m. that same day, Cloudflare Chief Technology Officer Dane Knecht posted on X: early attacks had already been seen.

When he posted, the patch was not scheduled for simultaneous release until 10 p.m. that night. The attacks had already begun, and there were still more than six hours to hold out.

Cloudflare later also disclosed that attackers were already modifying requests to try to bypass protection rules.

Cloudflare deployed protection for free and paid customers using its Web Application Firewall, but Dane stressed that this was only a temporary measure and that the patch had to be installed once available.

On the evening of the 21st, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were finally released. The PHP team also prepared minimal source patches for 7.4, 8.0 and 8.1, for distributors and long-term support services to produce update packages.

OpenAI's advance notice

More major vulnerabilities are still to come

At 12:35 a.m. on the 22nd, OpenAI released another Codex inspection skill to help website operators check their PHP version and determine whether they might be affected.

It checks the PHP version and cannot upgrade a website on its behalf; if the version cannot even be determined, that cannot be taken as a sign of safety.

And OpenAI has already given notice: PHP is only one of several major vulnerabilities the team has discovered and is fixing.

Such discoveries are expected to increase significantly in the coming months!