On the third week of October, the internet performed surgery on itself. At 14:00 UTC on October 21, the PHP project released four emergency versions patching two remote code execution vulnerabilities hidden for fourteen years. That same afternoon, the Finnish government took all of its public websites offline in bulk, the Netherlands and Austria followed, and the BBC voluntarily removed some pages. Nobody had been breached. The shutdowns were preventive.
The two vulnerabilities are jointly called PHP2Shell, with a CVSS score of 9.2, affecting every unpatched PHP from 5.4 through 8.5. Roughly seventy percent of the world's web servers run this language server-side. The CVE identifiers are CVE-2026-109618 and CVE-2026-109619, and both are old friends from the memory-safety world: use-after-free.
The 14-Year-Old Crack
The story begins with how PHP handles requests. A process should clear out everything a visitor left behind before serving the next one. But in two places inside the PHP engine, the cleanup can be interrupted — most commonly when a request hits the memory limit and the process handles a fatal error before finishing the sweep. The freed memory is then treated as live data by the next visitor: use-after-free.
The first flaw (109618) hides in the deserializer of the session upload progress mechanism, resulting in remote memory disclosure: an attacker can read whatever the previous request left in memory — passwords, session tokens, API keys, even TLS private keys — through the PHPSESSID response header, even if the application never calls session_start. The second (109619) is a use-after-free in fatal error backtraces which, chained with OPcache type confusion, allows direct code execution. The source code for both traces back to PHP 5.4.0, released in 2012.
The attack requests are all multipart/form-data — the file-upload type of form — parsed by the engine before application code runs. This means WAFs cannot stop it: the attack happens below the layer that application logic and firewall rules can reach. Sansec, the San Francisco security firm, put it plainly: updating PHP is the only real fix.
August to October: A Taut Timeline
The vulnerabilities were not discovered last week. Coordinated disclosure took two and a half months, disrupted midway by a leak:
- August 1: Calif finds multiple RCE paths
- August 11: Calif reports the first vulnerability; coordinated disclosure begins
- August 24: Wiz's research team independently discovers and reports the same flaws
- October 20: Technical details leak early
- October 21, 07:43: Cloudflare observes early attack attempts
- October 21, 14:00: Four fixed versions released in a joint five-party disclosure
The mass shutdown of government websites happened inside this window. Finland's state IT provider Valtori waited until patches were released and services restored — a few hours in total. Read in reverse, it is an answer sheet: defenders, before patches were in hand, chose physical disconnection — the crudest and most reliable option.
AI Stood in Front of the Attacker
Now for what is genuinely new here. The first crack was found by a security researcher called Calif (Ryan Austin of calif.io), using OpenAI's GPT-5.6 Sol; days later, Wiz's research team independently hit the same pair of vulnerabilities. OpenAI's October 22 announcement gave this process a name: Patch the Planet — researchers, maintainers, and incident responders collaborating in one window, with AI doing the finding and humans deciding who learns first and how to fix.
One line from the announcement is worth quoting: to their knowledge, frontier AI found these vulnerabilities before attackers did. The window has a name — the Defender's Window — the period during which defenders see first and act first. This window lasted two and a half months. In disclosure processes a decade ago, that time typically belonged to whichever party happened to stumble on the bug first, and who that was came down to luck. The new wager: AI accelerates the stumbling — the question is for whom. OpenAI also shipped the triage tooling as a Codex skill so operators can self-check exposure, and announced a billion dollars in Daybreak access credits for frontline defenders. They warned that such discoveries will increase sharply — this is just the tip of the iceberg.
Two buckets of cold water:
1. This window survived two and a half months thanks to the discoverers' restraint and mature coordination, not procedural inevitability — the leak was one person's slip away from collapsing it. 2. AI finding vulnerabilities does not mean AI can fix the ecosystem: many machines worldwide still run end-of-life PHP 7.4, 8.0, and 8.1, relying on manual backports by distro communities; official Docker images simply ship no fixes for 8.1 and older. The window is open to everyone, but the ability to walk through it is not.
The incident produced no casualties and wrapped up decently. What deserves to be remembered is the structural change: once AI drives down the cost of vulnerability discovery, the entire disclosure pipeline — who learns first, who patches first, how long the window stays open — is being forced into redesign. The next window may not last two and a half months.
Sources and Caveats
Vulnerability mechanics, fixed versions, timeline, and mitigations come from Sansec's technical analysis (2026-10-21); government site shutdowns and BBC page removals from BBC and Reuters reporting (10-21); the AI discovery process, Defender's Window, Codex skill, and credit commitment from OpenAI's official announcement Patch the Planet (10-22); CVSS 9.2 and version coverage from watchTowr and Huntress summaries; the leak from the当事 HN post (~10-20); the seventy-percent share is a recitation of W3Techs historical figures. The PHP official mailing list原文 and detailed CVE entries were not verified by this article.