Hackers Gain Four-Day Lead on Epic PHP2Shell Vulnerability
Current overview (not historical)
Security researchers identified a widespread PHP vulnerability on October 22, 2026, and hackers had already leveraged it four days earlier. OpenAI partnered with a security research organization to confirm the flaw, which allows attackers direct access to a server’s file system or database. The White House has intervened, urging users to implement temporary isolation measures until a patch is released. Researchers recommend that organizations take systems offline if they cannot apply the fix promptly. The incident highlights the rapid exploitation cycle of critical web‑application bugs and underscores the need for swift patch management and proactive isolation strategies.
Written with AI from the reporting · updated 10/22/2026
EventGraph Explorer
One time cutoff for reports, relations and evidence.
New at this step ·OpenAI and security groups uncover PHP2Shell flaw that could let attackers hijack servers
- Reports in replay
- 2
- First-party
- 0
- Sources
- 2
Reports first seen at this step · 1
- Ars Technica · AI · Third-partyOpenAI and security groups uncover PHP2Shell flaw that could let attackers hijack serversOriginal source ↗
Discovery-time replay; the linked graph and evidence share this cutoff. The full overview and activity remain current.
Event developments
1 developments10/23/2026, 12:08:43 AM
OpenAI and security groups uncover PHP2Shell flaw that could let attackers hijack serversArs Technica · AI
Filtered by first discovery; only representative reports already discovered by this cutoff are shown. Story grouping may have changed later, so this is not a complete historical snapshot.
Relations at this time
Loading time-scoped relations…
Bounded reconstruction, not an exact snapshot: entity names, relationship text and story grouping may include later revisions. Overview and full source archive below remain current.
Story route
A station-by-station route from the first public evidence onward; every station carries its own evidence and uncertainty.
- 1Oct 22, 00:00recorded Oct 23, 00:08single sourcerevised
Hackers got a four-day head start on epic PHP2Shell vulnerab
Read original source ↗ Ars Technica · AIReplay this moment in the explorer
Uncertainty marks flag where to check the sources; they are not proven causation.
Full source archive (current)
Current public reports; outside the historical replay.
First-party sources · 0 reports
No verifiable reports in this group yet.
Independent coverage · 2 reports
- Ars Technica · AI · Oct 22, 23:25OpenAI and security groups uncover PHP2Shell flaw that could let attackers hijack servers
OpenAI, in partnership with U.S. cybersecurity groups Calif and Wiz, discovered the PHP2Shell vulnerability that provides a direct path to a server’s file system or database. The flaw affects PHP, which powers roughly 70% of websites worldwide, and could allow attackers to take control of a site without credentials. The White House is assessing the impact on federal systems, while the UK’s National Cyber Security Centre urges immediate action.
Read original source ↗ - Latent Space · Oct 22, 15:42OpenAI's Patch the Planet and Wiz discover PHP2Shell vulnerabilities affecting 70% of web
Two parties, Ryan Austin from Calif (as part of OpenAI's "Patch the Planet" project using GPT-5.6 Sol) and Wiz (using Gemini 4 Argon and GPT-5.6 Sol), independently discovered two PHP-engine memory-corruption vulnerabilities, PHP2Shell (CVE-2026-109618 and CVE-2026-109619), almost two months ago. These defects are in PHP's internal handling of out-of-memory conditions and fatal errors, not in CMS plugins, and demonstrations showed pre-authentication RCE against WordPress, Drupal, and Joomla, potentially affecting 70% of the web through a coordinated ecosystem response.
Read original source ↗
Different reports do not necessarily disagree. Check original sources and publication dates.
Report timeline
Explore every side through dated source reports.
- Ars Technica · AISelectedOpenAI and security groups uncover PHP2Shell flaw that could let attackers hijack servers
OpenAI, in partnership with U.S. cybersecurity groups Calif and Wiz, discovered the PHP2Shell vulnerability that provides a direct path to a server’s file system or database. The flaw affects PHP, which powers roughly 70% of websites worldwide, and could allow attackers to take control of a site without credentials. The White House is assessing the impact on federal systems, while the UK’s National Cyber Security Centre urges immediate action.
- Latent SpaceOpenAI's Patch the Planet and Wiz discover PHP2Shell vulnerabilities affecting 70% of web
Two parties, Ryan Austin from Calif (as part of OpenAI's "Patch the Planet" project using GPT-5.6 Sol) and Wiz (using Gemini 4 Argon and GPT-5.6 Sol), independently discovered two PHP-engine memory-corruption vulnerabilities, PHP2Shell (CVE-2026-109618 and CVE-2026-109619), almost two months ago. These defects are in PHP's internal handling of out-of-memory conditions and fatal errors, not in CMS plugins, and demonstrations showed pre-authentication RCE against WordPress, Drupal, and Joomla, potentially affecting 70% of the web through a coordinated ecosystem response.
Event activity trend
- Latest comparable
- 3
- Comparable peak
- 310月24日 18:00
- 24h change
- –
The chart compares consistently observed participants only. Hover or tap to inspect each hour; use arrow keys to move between observations.