OpenAI releases Codex skill to check sites for PHP2Shell vulnerabilities
OpenAI released a Codex skill that helps website operators check whether their PHP deployments may be affected by the critical flaws CVE-2026-109618 and CVE-2026-109619, both scored 9.2 under CVSS v4.0. The PHP Foundation issued fixes on October 21, while Amazon later reported that the vulnerabilities were being broadly exploited in the wild. OpenAI credits its models with assisting researchers, although Calif researcher Ryan Austin disputed the claim that a model was the first discoverer of the initial exploit path.
The episode demonstrates AI-assisted security research at internet scale, but OpenAI’s first-discovery claim remains contested and Amazon reported active exploitation before affected organizations could fully deploy the patches.
If you are wondering whether your website is affected, we have packaged a Codex skill to help check. Point your Codex at this repo to guide you through it: https://github.com/openai/php2shell-checker
OpenAI: OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. Over the past two months, we led a coalition of maintainers, researchers,
#OpenAI#PHP#PHP Foundation#Codex#GPT-5.6 Sol#Calif#Wiz#Wiz Atlas#Gemini 4 Argon#Amazon#Cloudflare