OpenAI Helped Find PHP Flaw; 758K Servers Lack Official Fix

Google, OpenAI and Amazon have all been involved in the response to two critical flaws in PHP, the open-source language that CNBC says is used by just under 70% of websites with a known server-side language, CNBC reported on 22 October 2026. CNBC wrote that the discovery prompted urgent warnings from governments worldwide, and that OpenAI said researchers working with its AI models had helped uncover the vulnerabilities.

A count published by VirusTotal on 21 October puts a number on what the fix cannot reach. Among roughly 1.1 million internet-facing servers that announce a PHP version, about 758,000 run an end-of-life branch, between PHP 5.4 and 8.1, that no longer receives security fixes from the PHP project, against about 272,000 on the supported 8.2 to 8.5 branches. VirusTotal says its figures describe the PHP footprint, not confirmed vulnerable hosts.

Business Engineer · THE AI AUDIT PROBLEM

A short Business Engineer video on why checking work can cost more than making it. It makes no claim about PHP, the vendors or the researchers in this piece.

What Was Reported

The two vulnerabilities, collectively known as “PHP2Shell,” could allow hackers to remotely execute malicious code on affected servers, potentially exposing sensitive data, according to cybersecurity researchers cited by CNBC. Both were rated 9.2 in severity, CNBC and VirusTotal reported.

The U.S. National Security Agency urged organizations using PHP to prepare security updates and recommended taking affected systems offline if immediate updates are not possible, CNBC reported. The FBI and cybersecurity authorities in Singapore, the United Kingdom, Australia, Canada and the European Union issued similar alerts, according to CNBC.

Amazon said its threat intelligence team detected attempts to exploit the vulnerabilities before they were publicly disclosed, using its MadPot system, and that it remains unclear how the attackers obtained information about the flaws ahead of disclosure, CNBC reported. In a second article, CNBC wrote that Amazon Threat Intelligence identified a PHP2Shell exploit attempt on Saturday on its MadPot telemetry network.

On discovery, CNBC reported that researchers at AI firm Calif and Google’s Wiz identified the vulnerabilities in mid-August. Calif’s researchers used OpenAI’s GPT‑5.6 Sol, while the Wiz team used its Wiz Atlas security AI agent, Google’s Gemini 4 Argon, and GPT-5.6 Sol, according to CNBC. OpenAI said it had spent the past two months leading a coalition of software maintainers, cybersecurity researchers and security providers to coordinate fixes, CNBC reported.

What Was Posted on X

Reuters posted this on 22 October. It says a critical flaw in PHP forced government websites across Europe offline, quotes the line “AI has really compressed the timelines here,” and says @razhael says hackers can now exploit vulnerabilities in minutes, not months. As we read it, this is the same shortening of the attack timeline that Tolmo and Ox Security described to CNBC above.

Posting on 22 October, @choblin29 summarised what defenders reported after disclosure: Amazon logged a PHP2Shell attempt on a honeypot on 17 October, four days before the flaws were made public, and says it does not know how the actor learned of them; the post relays Cloudflare’s counts rising from thousands of attempts before disclosure to millions afterwards, and Censys finding about 1.5 million of 2.6 million identified PHP hosts on versions with no patch available. These figures are the poster’s summary of the Amazon, Cloudflare and Censys reports; the piece’s Update cites Amazon’s own write-up.

Jake Mintz wrote on X that he has heard several OpenAI people say there are unfixable bugs in hardware that AI models could exploit by speaking machine code directly, and that defense needs to move faster than offense, if that is even possible; the account is the poster’s own and second-hand.

The Numbers: What the Fix Reaches

VirusTotal fingerprints roughly 5.1 million IP addresses running PHP, about 3.8 million of them with at least one port open today, it wrote. Only around 1.1 million of those announce a version in an HTTP header, so roughly four out of five PHP servers hide their version, according to VirusTotal.

Among the servers that do disclose their version, about 758,000 run an end-of-life branch between 5.4 and 8.1, VirusTotal reported. It says these branches have session.upload_progress, the feature the leaked details point to, enabled by default and no longer receive security fixes. PHP 7.4 alone accounts for about 187,000 IPs and PHP 5.4 for about 119,000, by VirusTotal’s count. On our arithmetic, the end-of-life group is about 7 in 10 of the servers that show a version (758,000 of roughly 1.1 million).

VirusTotal also noted that being up to date “doesn’t buy much time either”: it counted about 85,000 IPs on the exact releases published on 24 September, the latest available before this fix. The PHP project released the fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October, according to the PHP Foundation.

On the application side, VirusTotal counted WordPress on about 538,000 PHP hosts, Laravel on about 141,000 and Nextcloud on about 107,000. The United States accounts for about 920,000 PHP hosts with at least one open port, and a handful of cloud and hosting providers concentrate a large share, it wrote, which it calls good news for remediation.

How the Fix Stalled

The PHP Foundation wrote on 21 October that the root problem was first spotted in 2024. During PHP’s first external security audit in years, carried out by Quarkslab and funded by the Sovereign Tech Agency through OSTIF, a PHP core developer contracted by the Foundation “found the first signs of the OOM problem” behind CVE-2026-109618, the post says.

The security team developed several competing approaches to a fix, each with trade-offs, and work on a fix stalled and restarted repeatedly over months, according to the Foundation. “We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources,” it wrote.

On 11 August, researcher Ryan A at Calif reported an unconditional remote code execution with the same root cause, and OpenAI independently reported the same root cause on the same day, the Foundation wrote. Further attack vectors followed from Wiz on 24 August and from OpenAI on 18 September, it says. Since 1 July the team has published 15 CVEs and worked through more than 100 reports that turned out to be invalid, duplicates, or not reproducible, according to the post.

The Foundation wrote that coordinated disclosure worked well until two days ahead of the targeted release date. The two CVE IDs began circulating online on 20 October with a wrong CVSS score of 10.0, the release was moved forward a day to 21 October at 14:00 UTC, and Calif mistakenly published a video of its proof of concept, the Foundation wrote. It also says Chainguard “unilaterally broke the embargo” by publishing built images containing the fix more than six hours before the coordinated release.

How Fast the Exploits Came

Matt Suiche, a researcher at cybersecurity startup Tolmo, told CNBC his team was able to code a working exploit in less than a day. “With AI, it was relatively quick to have a local reproduction,” he said, adding that before today’s AI models it would have taken his team “multiple weeks” to produce it, according to CNBC.

Elizabeth Barron, executive director of The PHP Foundation, told CNBC on Wednesday afternoon that there was no “evidence of any working exploits, only incomplete, misguided, and non-working generated ones.” Neatsun Ziv, CEO of Ox Security, told CNBC that the time for attackers to find a new exploit and run it across the internet “used to be weeks,” then days, and “starting in the Mythos age, from April 2026, it went down to hours.”

Reuters, in a post on X on 22 October, said the flaw forced government websites across Europe offline and that @razhael says hackers can now exploit vulnerabilities in minutes rather than months.

What Defenders Are Told

VirusTotal’s first advice is to upgrade to the fixed release of each supported branch. For servers on PHP 8.1 and older, it says to upgrade the branch or check whether a distribution or vendor ships a backport. As a stopgap until patching, it describes setting session.upload_progress.enabled to Off in php.ini, while noting community analysis suggests this may not cover every vector.

It also recommends filtering multipart uploads at the edge where an application does not need them, making sure origin servers cannot be reached around a web application firewall, and not relying on hiding the version number. Cloudflare shipped emergency rules to its Managed and Free rulesets on 21 October, VirusTotal wrote, while Cloudflare’s CTO stressed that only updating PHP fully protects a site.

The Structural Read

As we read it, finding has become the cheap step. The PHP Foundation says its security team has published 15 CVEs since 1 July and worked through more than 100 reports that turned out to be invalid, duplicates, or not reproducible, and that AI helps it validate reports but “a person makes every call and works on every patch.”

As we read it, the bottleneck the Foundation names is people. “What tools cannot do is decide on the right fix for a long-standing design decision in the engine, weigh the compatibility trade-offs, and review the patch,” it wrote.

As we read it, the exposure sits in old installations: VirusTotal’s end-of-life group is larger than the supported group, and Tolmo’s Matt Suiche told CNBC that city governments and other agencies often use PHP and “haven’t updated their website in 10 years.”

Three Implications

FOR COMPANIES RUNNING PHP VirusTotal advises upgrading to the fixed release of a supported branch and, for PHP 8.1 and older, upgrading the branch or checking whether a distribution or vendor ships a backport.

FOR HOSTING AND CLOUD PROVIDERS VirusTotal wrote that a few providers that push a configuration change or a WAF rule can cover a lot of ground, because a handful of providers concentrate a large share of PHP hosts.

FOR OPEN-SOURCE MAINTAINERS The PHP Foundation asked companies, hosting providers, cloud platforms, distributions and governments that depend on PHP to fund its security work, and said the Sovereign Tech Agency’s funding of the 2024 audit shows what public investment can achieve.

The Business Engineer Lens

This story maps onto the Business Engineer framework The Open vs Closed Meta-Framework.

The framework opens: “Every technology stack has layers. Some are scarce, some are abundant.”

As we read it, PHP2Shell shows two such layers in security work: AI models made finding flaws abundant, with more than 100 reports since July that were invalid, duplicates or not reproducible, while the engineers who can decide and review a fix in PHP’s engine are scarce; the Foundation wrote that “today there are too few of them.” The framework was published in March 2026 and does not discuss PHP or this vulnerability.

What Is Not Established

VirusTotal’s counts are of internet-facing servers, not confirmed vulnerable hosts, and they cover only the servers that disclose a version. The documents we read do not say how many end-of-life servers are covered by distribution or vendor backports. Amazon said it is unclear how attackers obtained information about the flaws before disclosure. The PHP Foundation said it saw no working exploits at release, while Tolmo told CNBC it built one in under a day; we have not tested either claim. Experts quoted by CNBC said organizations may never know whether data was taken.

Connecting the Coverage

We have followed PHP2Shell since the day of the release. On 21 October we covered how Gemini and GPT models helped find the flaws in our piece on the AI models behind the PHP find. On 22 October we reported the Japanese prime minister’s request in our piece on Japan’s patch-or-go-offline request. What’s new here, as we read it, is a count of the servers that run branches the fix does not cover, and the Foundation’s own account of why the fix stalled.

The Bottom Line

As we read it, AI models helped find these flaws quickly, while the fix depended on a small team and reaches only supported branches. VirusTotal counts about 758,000 internet-facing servers on PHP versions that no longer receive official security fixes, and the PHP Foundation calls the delay “a structural failure.”