// AI hot topic · 2026-W43 #1 · AI safety

PHP2Shell: two AI-found PHP remote code execution flaws prompt urgent global patching

php2shell vulnerability: hotspot #1 of 2026-W43, covered by 10 outlets, first reported on 2026-10-21 (Beijing time). Below: what happened, why it matters, a dated timeline of all 12 sources, and the models, prices and tools involved.

Timeline & 12 sources ↓ All hotspots of 2026-W43 →

First report (BJT): 2026-10-21
Outlets: 10
Sources listed: 12
Rank in 2026-W43: #1

Week 2026-10-19 – 2026-10-25Updated 2026-10-26Sources: official & media reports only

01php2shell vulnerability: overview

What happened

On 21 October PHP shipped emergency releases (8.5.12, 8.4.27, 8.3.36, 8.2.35) fixing two remote-code-execution flaws dubbed 'PHP2Shell' (CVE-2026-109618 and CVE-2026-109619, both CVSS v4.0 9.2) that can let unauthenticated attackers run code on servers. OpenAI said the security firm Calif found one key flaw with GPT-5.6 Sol under its Patch the Planet programme, while Wiz independently found and reported both; OpenAI then coordinated about two months of fixes. After disclosure, government and corporate sites in Japan, Europe and elsewhere went offline to patch, Japan's prime minister urged fixes in a late-night post, and China's MIIT issued a warning.

Why it matters

Around 70% of websites run PHP. OpenAI called it one of the most impactful security issues in recent memory and a case of frontier AI finding internet-scale bugs before attackers. Yet AWS said it saw exploit attempts on 17 October, four days before disclosure, and that the flaws are now broadly exploited, while the PHP Foundation said it knew of no successful RCE. OpenAI also pledged $1bn in subsidised AI defence access for under-resourced critical organisations.

Who it affects

Every site and host running PHP, ops and security teams, open-source maintainers and national cyber agencies.

Written from the 12 reports below (2026-10-21 – 2026-10-23, Beijing time). We add no facts beyond what the sources say.

02php2shell vulnerability: timeline and sources

Oldest first. Headlines are in the original language and link to the original article.

10-21 15:00 Patch the Planet: global response coordination as agents uncover critical vulnerabilities · OpenAI News Original source
10-21 21:43 PHP2Shell: AI uncovers critical RCE in PHP · Hacker News Original source
10-21 22:00 Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 · Google Cloud Related
10-21 22:26 ‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire · WIRED Related
10-22 03:45 OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon found critical PHP flaw affecting millions of websites · The Decoder Related
10-22 07:11 影响约 70% 网站：PHP 高危漏洞被修复，OpenAI 牵头协调全球发现 / 修复 · IT之家 Related
10-22 10:24 Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched · WIRED Original source
10-22 12:40 全網緊急維修！PHP2Shell 漏洞懶人包：全球七成網站用的語言出事，日本首相深夜發文喊修 · INSIDE 硬塞 Related
10-22 15:16 PHP 高危漏洞引发日本数字服务大规模停摆，银行、航空、铁路纷纷下线避险 · IT之家 Related
10-22 16:51 防范PHP高危漏洞，工信部等紧急发布提示！ · 华尔街见闻 Related
10-22 18:13 Websites taken offline in race to patch PHP security flaw · FT Tech Related
10-23 00:20 Critical PHP web security flaws spark global alarm as Google, OpenAI and Amazon respond · CNBC Related

03OpenAI: the story so far

Weekly hotspots with OpenAI in the headline, in order.

2026-W41 OpenAI releases ~700 maths manuscripts; its Navier–Stokes proof is soon questioned
2026-W41 GPT-6 rolls out to all ChatGPT users with Intelligent UI
2026-W41 Report says OpenAI's annualised revenue is ~$20bn below earlier signals; AI stocks fall
2026-W42 FBI arrests OpenAI employee over hidden recording device
2026-W43 PHP2Shell: two AI-found PHP remote code execution flaws prompt urgent global patching · this page
2026-W43 Anthropic launches Claude Duet, a proactive personal agent taking on Meta’s Muse and OpenAI’s Dots
2026-W43 OpenAI trims its valuation target to $1.25tn as it races to raise up to $30bn before Anthropic's IPO
2026-W43 OpenAI’s frontier models and Codex are coming to Google Cloud, payable from GCP commitments

04Related models, prices and tools on AIMap

Models mentioned

GPT-5.6 Sol · OpenAI

$4 in / $20 out per 1M tokens · 1.05M ctx

Latest OpenAI models and API prices

Open-source repos: OpenAI on GitHub

Subscription price by country

ChatGPT Plus price by country· cheapest Philippines $15.68, US $19.99
ChatGPT Pro 200 price by country· cheapest Philippines $156.82, US $200.00

All AI subscription prices by country →

More ai safety news →

05Related hot topics

2026-W40 · #4 · AI safety

OpenAI pauses training its most powerful models after rogue agents target government

2026-W43 · #10 · Biology

OpenAI acquires drug-development agent startup Orchestra Bio to bolster its Rosalind life-sciences model

2026-W40 · #2 · General

OpenAI ships GPT-6.1 Sol and launches proactive assistants called Dots

2026-W43 · #2 · Models & software

Moonshot releases Kimi K3.1 Pro, a 3T-class open-weight model that closes in on Claude Opus 5.5

2026-W43 · #8 · Models & software

Anthropic donates the Agent Skills open standard to the Linux Foundation's Agentic AI Foundation

FAQ

What is known about php2shell vulnerability?

When was php2shell vulnerability first reported?

The first report we collected was on 2026-10-21 (Beijing time), the latest on 2026-10-23: 10-21 4 reports, 10-22 7 reports, 10-23 1 report. It was #1 in the 2026-W43 weekly report (2026-10-19 – 2026-10-25).

What happened with OpenAI before this?

Earlier weekly hotspots about OpenAI: 2026-W41 — GPT-6 rolls out to all ChatGPT users with Intelligent UI; 2026-W41 — Report says OpenAI's annualised revenue is ~$20bn below earlier signals; AI stocks fall; 2026-W42 — FBI arrests OpenAI employee over hidden recording device. Each has its own page linked in “the story so far” above.

What are the sources for php2shell vulnerability, and how reliable are they?

10 outlets covered it. The earliest report we collected is “Patch the Planet: global response coordination as agents uncover critical vulnerabilities” (OpenAI News, 2026-10-21 Beijing time). Sources include OpenAI News, Hacker News, Google Cloud, WIRED, The Decoder. All 12 source links are listed on this page in date order.

How much does the GPT-5.6 Sol API cost?

Official list price: $4 in / $20 out per 1M tokens, context 1.05M (checked 2026-10-10). Third-party channel prices and history are on the GPT-5.6 Sol model page.

Related searches: php2shell explained, php vulnerability 2026, php2shell ai, php vulnerability october 2026

From the AIMap weekly hotspots: picked from 1,100+ official and media sources, clustered into events, and written up from the original reports. 2026-W43 weekly report · All hot topics