OpenAI's Patch the Planet and Wiz discover PHP2Shell vulnerabilities affecting 70% of web

Two parties, Ryan Austin from Calif (as part of OpenAI's "Patch the Planet" project using GPT-5.6 Sol) and Wiz (using Gemini 4 Argon and GPT-5.6 Sol), independently discovered two PHP-engine memory-corruption vulnerabilities, PHP2Shell (CVE-2026-109618 and CVE-2026-109619), almost two months ago. These defects are in PHP's internal handling of out-of-memory conditions and fatal errors, not in CMS plugins, and demonstrations showed pre-authentication RCE against WordPress, Drupal, and Joomla, potentially affecting 70% of the web through a coordinated ecosystem response.