PHP Exposed Two 14-Year-Old Vulnerabilities, GPT-5.6 Sol Participated in Discovery

Global operations teams are swamped: AI has dug up a landmine that has been buried in the internet for 14 years. Phoenix Tech Download the app for exclusive early access. October 22, 2026, 20:06:40 From Beijing. Updated October 22, 2026, 20:16:33

Over the past two days, PHP, the foundation underpinning 70% of the world's web pages, was reported to contain two extremely serious vulnerabilities. The team then secretly organized a fix together with OpenAI. What sends a chill down one's spine, however, is this: this emergency repair, which was supposed to stay confidential for two months, collapsed in the final 48 hours.

Compiling information from multiple sources, Phoenix Tech found that an anonymous post online was the first to release the CVE numbers of the vulnerabilities, which were then confirmed by PHP officials; afterward, the security firm Calif mistakenly released an attack demonstration video, which was subsequently deleted but copies spread across the internet; finally, the software supply chain security company Chainguard released a build image containing the fix ahead of schedule, effectively handing the vulnerability's location to attackers in advance.

Before the patch had even officially landed, the first wave of attacks was already underway. And OpenAI even gave advance notice: what has been exposed this time is only an appetizer.

A vulnerability hidden in PHP for 14 years, dug out by GPT

"PHP has been reported to have a 'php2shell' remote code execution vulnerability (CVE-2026-109618, CVE-2026-109619). If your business uses PHP, please check and upgrade to a secure version as soon as possible to avoid your servers being attacked."

Today, many colleagues responsible for operations, security, and development received the above security risk notice, reminding PHP users to upgrade to a secure version as soon as possible.

English text is being prepared.

For more than two decades, countless developers and security researchers have repeatedly studied its code, conducting audits and applying patches over and over. How could a piece of software under such scrutiny still hide a 14-year-old landmine right under everyone's nose?

Moreover, both vulnerabilities are rated 9.2, placing them at the "critical" level. Under specific conditions, an attacker needs no login and only has to send a single request to directly obtain server execution privileges before the business code runs. It is as if the building's access control had not yet taken effect, but the back door was already open.

It sounds like science fiction, but this is the real situation of this incident.

And the one that helped dig out this vulnerability was artificial intelligence such as GPT-5.6 Sol. OpenAI confirmed in its announcement that the security firm Calif used GPT-5.6 Sol to discover critical vulnerabilities in PHP; Wiz Research also independently discovered and reported related issues, and used Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol in its research.

Specifically, under the guidance of researchers, GPT-5.6 Sol and other AIs reviewed PHP's underlying code and discovered an abnormal path in PHP where "data is only half written but treated as complete data." Then, this clue was organized into reusable audit rules, and the investigation continued, leading to the discovery of a second problem.

The significance of this goes beyond "AI found a bug." PHP has been running for more than a decade, and much of its code was sufficient back in the day; it is just that, viewed again by today's security standards, some of it is outdated. AI accelerated the exposure of this dormant risk and also gave defenders a time window to get ahead of attackers.

What is even more troublesome is that the details of this vulnerability leaked before the patch was released, and attackers even got ahead of the patch. And among the several fixed versions officially released by PHP, PHP 8.1 and earlier versions cannot receive official updates and can only rely on source code patches or distribution backports.

In other words, the dilemma for many websites is not "should we fix it?" but "can we fix it? To what extent can we fix it? Will fixing it crash the business?"

Discovering the vulnerability is only the first hurdle. What is truly difficult comes afterward: asset inventory, version compatibility, testing and verification, canary upgrades, restarting processes, and confirming whether old processes are still running. AI has maxed out the speed of discovering vulnerabilities, but fixing them is still stuck in organizations, processes, and legacy systems.

In fact, these two vulnerabilities were not discovered only today.

The PHP Foundation stated that the clue for CVE-2026-109618 first appeared in an external security audit of the PHP project in 2024. At the time, a core developer had already noticed the related hidden danger while fixing issues found in the audit... "The delay in fixing it was a structural failure."

The PHP Foundation's statement reveals a dilemma: for programmers, finding a vulnerability is often simpler than fixing it.

As the PHP Foundation itself said, multiple fix options each have their costs: some may break backward compatibility, some may introduce new denial-of-service risks, and others require coordinating a large number of third-party extensions.

The repair work therefore stopped and started, started and stopped, and the problem was shelved. Until this time, when it was discovered by GPT-5.6 Sol.

In fact, the bigger contradiction is that many global commercial giants and startups are all enjoying for free the foundation laid by open-source software such as PHP, yet the maintenance of that foundation has long been pressed onto a small group of volunteers and tight funding.

The PHP Foundation has publicly called out many times: have those companies that have made a fortune from open source put in investment commensurate with their degree of dependence?

Last September, the Java, Python, PHP, Rust, Eclipse, and other foundations, together with OpenSSF, issued a statement directly addressing large enterprises: "Open-source infrastructure is not free," long-term free use is unsustainable, and commercial users should pay for infrastructure.

To put it plainly, the problem is not that no one saw the vulnerabilities, but that after seeing them, who pays, who bears the compatibility risk, and who provides a safety net for those systems that have long been unmaintained?

The emergence of AI has made this problem even more obvious. It makes "discovering vulnerabilities" faster than ever before, yet it cannot automatically solve the most labor-intensive task of "fixing vulnerabilities." Should the patch be applied? Will applying it cause problems? Who reviews it? Should enterprises update immediately? Should legacy systems be migrated? ... Every step requires organizations and people to make decisions.