PHP repaired two flaws that AI helped find, after two months

On Wednesday, researchers made public two critical flaws in the core engine of PHP. Wiz Research says PHP runs about 70% of websites. The flaws, named PHP2Shell, score 9.2 on the CVSS severity scale, which rates how bad a flaw is. Researchers at Calif.io found one and Wiz found both, with frontier AI models, the top models. One flaw or more is in each PHP release of the last ten years. The PHP team released patches the same day.

How it works

When a request has no more memory or crashes, PHP can keep references to memory that is free. The next request in the same worker process can use them. Attackers can use this to read data or run code on three web platforms, with no login. Wiz says one researcher with AI did in about a week the work of a team.

The numbers

The PHP team acknowledged the report on 21 September, and patches came on Wednesday. OpenAI led the work and offers $1 billion of subsidized access for defenders. It proposes a plan in five steps: repair, test with AI models, tell affected groups, tell government, then update.

What is not known

Cloudflare says customers must patch PHP, and that its firewall rules only add protection. OpenAI says its help possibly does not go to each project. Maintainers also must examine more code that AI writes.

Insight: The AI maker that finds the flaws also writes the rules

GPT-5.6 Sol helped the two teams that found the flaws. OpenAI then led the repair work, proposed the five step plan and offered $1 billion of access. This reads as a race to set the rules, because the AI maker possibly also selects who gets the data first. Notice goes first to the groups that can use it, and thus small teams possibly hear last.