The embargo was supposed to hold until Thursday. Instead, the identifiers for two critical PHP vulnerabilities leaked on October 20, the PHP Foundation pulled its release forward a day, and administrators from Finland to Japan spent Wednesday night trying to patch before attackers caught up.

The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, sit in the core of PHP, the language that runs roughly 70% of websites. Both carry a severity score of 9.2 on the CVSS scale. They are already being called PHP2Shell.

What the flaws actually are

According to Wiz Research’s disclosure, the bugs are memory-safety errors in how PHP handles fatal failures, particularly when it runs out of memory. Because the problem lives in the language runtime rather than in any plugin or framework, even a bare “Hello World” script on an affected version can be exposed.

Wiz says it turned the bugs into unauthenticated remote code execution against WordPress, Drupal and Joomla. In plain terms, an attacker with no login could take control of a server, steal its data or deface the site it hosts.

The fixes shipped October 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The 8.5.12 release page on GitHub confirms the update. The release notes say upgrading is the only safe option, since no complete workaround exists. Branches that have reached end of life get no official release. The PHP security team instead published minimal source backports covering versions 7.4 through 8.1.

An AI-assisted discovery, with a disputed origin story

What makes this disclosure unusual is how the bugs were found. Fortune reports that the AI red-teaming firm Calif identified the first issue on August 1 using OpenAI’s GPT-5.6 Sol, after which OpenAI uncovered further elements. Wiz tells a different story. Its own timeline starts August 19, with its researchers working through Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol. The two accounts have not been reconciled, and a community note on OpenAI’s post on X disputes the idea that Wiz was first.

By Wiz’s account, remote code execution was confirmed on Drupal on August 20 and WordPress on August 21. The team reported its findings to PHP on August 24. PHP acknowledged them on September 21, and the patch and public disclosure came on October 21. OpenAI says it spent two months leading a coalition that prepared fixes before anything went public.

The companies are keen to frame the moment as a turning point. Wiz wrote that the episode “marks an AI inflection point,” and OpenAI has said it signals a new phase in which AI can find bugs with internet-scale reach. Both are company claims rather than independent findings, and both firms have commercial stakes in AI-security narratives. Wiz, it is worth noting, is owned by Google.

The raw facts are striking enough on their own. Greg Brockman said the underlying bug had sat in PHP for 14 years, and that a limited version of it surfaced in 2024 without being judged significant. Wiz also says some of the vulnerable code has existed for more than a decade. Its researchers argue that AI did not invent these weaknesses, but made them practical to exploit, with one researcher finishing in a week what a top team might have needed months to do.

The leak, and the race that followed

Disclosure was originally set for October 22. After the CVE identifiers leaked, the PHP Foundation moved up the release, so the sequence reads best this way: leaked October 20, patched and disclosed October 21.

Attackers appear to have moved even earlier. Amazon Threat Intelligence reported an exploitation attempt in its honeypot telemetry dated October 17, four days before the public announcement, with more attempts from about 02:00 UTC on October 21. Its AWS Security Blog post carries a warning that “defenders should not assume the public disclosure date is the earliest date of exploitation.” Amazon does not know whether those early attempts would have succeeded, and neither the source of the October 17 probe nor the origin of the leak has been explained.

Once the identifiers were out, the traffic grew fast. Fortune quotes Cloudflare chief executive Matthew Prince as saying the company saw tens of thousands of exploit attempts within 45 minutes of the leak, hundreds of thousands within two hours, and millions by the evening of October 21. AP and PBS also report attempts numbering in the millions.

Governments move, with uneven results

The response was unusually public. AP reports that governments and companies worked through the night. The FBI’s cyber division warned of remote code execution risk, and the EU’s cybersecurity agency ENISA urged organizations to act immediately. Britain said some government services might go offline. Finland’s government website was disrupted, and Japan’s prime minister, Sanae Takaichi, urged site administrators to patch, calling the temporary suspension of websites “an effective way to reduce risk.”

Guidance on going offline was far from uniform. One report says CISA did not advise it, while another says the agency recommended pulling unpatchable systems offline. CERT-EU advised isolation, but the EU itself did not shut sites down. Reports of outages in other countries, including Denmark, France and the Netherlands, vary in how well they are sourced. Only Finland and the Netherlands are backed by Reuters-derived reporting.

What the numbers do and do not say

The headline figure needs care. “70% of the internet” describes the share of websites that use PHP, not the share that is vulnerable. Fixes exist for PHP 8.2 through 8.5, while older versions get backports or nothing at all. Palo Alto Networks counted 22.6 million potentially vulnerable instances, a figure reported through Fortune and not independently confirmed here.

Exploitation status is also murkier than the volume of attempts suggests. AWS and watchTowr have reported attempts, but CISA said it had not observed exploitation as of October 21, and Huntress said it had not confirmed successful attacks in the wild. Scoring differs too. CVSS 9.2 under version 4.0 is the figure most widely cited, and one secondary source claims a 9.8 under an older scale that has not been verified.

What to watch next

The central question is patch uptake. Fortune notes that nobody yet knows whether enough of the internet will update before attackers turn probes into working compromises. Operators of end-of-life installations face the hardest choice, since they must apply the backports or migrate. Security vendors reported that neither CVE had appeared in CISA’s Known Exploited Vulnerabilities catalog as of October 21 and 22, a status that could change quickly.

Beyond the patching sprint, the episode poses a harder test for the industry. The same AI capabilities that let defenders find these flaws can help attackers build exploits, and this time the coordinated-disclosure process that was meant to keep that gap closed was breached before the fixes were ready. How the industry rewrites those rules, and whether it can do so before the next AI-found bug of this size, may matter longer than any single patch.