PHP2Shell post-mortem says maintainers knew of flaw for two years
Tom’s Hardware reports that OpenAI’s GPT 5.6-Sol discovered the critical PHP vulnerabilities during the week of October 19, 2026, while a PHP Foundation post-mortem says a small team of maintainers had known about the issue for two years. The flaw can enable remote code execution when an attacker knows the target’s exact PHP version and build, and exploitation is being observed through the PHP2Shell exploit. Patches and backports are available, but Tom’s Hardware cites Censys estimates showing that roughly 29 million installations remained apparently unpatched, while version-reporting changes make the total uncertain.
The post-mortem adds material detail to an AI-discovered flaw affecting a widely deployed web language, while the large unpatched population and observed exploitation make the disclosure operationally significant.
The phrase "when it rains, it pours" applies both to weather and computer security, as proven the week of October 19, 2026, when OpenAI's GPT 5.6-Sol discovered critical vulnerabilities in the open-source programming language PHP. As published in a post-mortem, a small team of maintainers knew of the issue two years ago. Security experts had warned for decades about mounting technical debt, as agentic AI exponentially sped up vulnerability scanning, to the point that the usual 90-day disclosure window for security exploits became pointless. PHP, one of the internet's ubiquitous software packages, was unlucky enough to in the crosshairs of bug-hunting AI agents.
PHP hosts around 70% of websites on the internet, and the vulnerability allows for remote code execution with enough attacker knowledge. That combination is enough to sound alarms, but the situation got worse once the collective internet realized that, at the time, 73% of PHP installations online were running end-of-life versions with no active support — eliciting face-palms from many techies, and an exasperated sigh from anyone familiar with the ecosystem, myself included. So ultimately the problem wasn't really the vulnerability, but the general complacency.
#OpenAI#GPT 5.6-Sol#PHP#PHP Foundation#PHP2Shell#Censys#BitSight#Cloudflare#Fastly#CrowdStrike