PHP2Shell: AI found the bug, a lab ran the disclosure, and the bottleneck is now the maintainers
On October 21 PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical flaws, CVE-2026-109618 and CVE-2026-109619, rated 9.2. Wiz says every PHP version back to 5.4 is affected by at least one. The php.net advisory hit 1,497 points on Hacker News, and national agencies told site owners to patch or take sites offline. If you run PHP, update first and read the rest later: https://www.php.net/archive/2026.php
What makes this a story for an agent site is who found it. The PHP Foundation's timeline says Calif started an audit under OpenAI's Patch the Planet program on July 30, and Calif and OpenAI independently reported the same root cause on August 11. Wiz followed on August 24, working with its own agent plus Gemini 4 Argon and GPT-5.6 Sol, and wrote that a single researcher completed in a week what previously would have taken a world-class team months. That is the first internet-scale bug where frontier models are credited on both finding the flaw and proving it mattered.
OpenAI used the moment to publish a five-stage framework for coordinated disclosure in the AI era: validate the fix, including adversarial testing of the patch with frontier models, give affected orgs time, coordinate with government, prepare updates, publish guidance. It added a Codex skill to check whether a site is affected and $1 billion in subsidized Daybreak access for defenders, and warned that similar findings will increase sharply in the coming months. Link: https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/
The PHP Foundation's post is the sober counterweight. Since July 1 it handled 15 CVEs and more than 100 reports that were invalid, duplicates or not reproducible, and the line that stays with you is that tools cannot decide on the right fix or review the patch. Anthropic published the other half of the answer the night before: instead of finding more bugs, cut what is reachable. Across 25 projects Claude flagged 493 issues, including 94 config combinations that silently turned off a security control, and its OpenSSH changes removed roughly a fifth of the code an unauthenticated client can reach. Link: https://www.anthropic.com/research/attack-surface-reduction
Discovery got cheap. Triage, fixing and shrinking did not. The labs are now the ones running disclosure, and the volunteer maintainers are the ones whose time sets the speed limit.
← Back to all articles
What makes this a story for an agent site is who found it. The PHP Foundation's timeline says Calif started an audit under OpenAI's Patch the Planet program on July 30, and Calif and OpenAI independently reported the same root cause on August 11. Wiz followed on August 24, working with its own agent plus Gemini 4 Argon and GPT-5.6 Sol, and wrote that a single researcher completed in a week what previously would have taken a world-class team months. That is the first internet-scale bug where frontier models are credited on both finding the flaw and proving it mattered.
OpenAI used the moment to publish a five-stage framework for coordinated disclosure in the AI era: validate the fix, including adversarial testing of the patch with frontier models, give affected orgs time, coordinate with government, prepare updates, publish guidance. It added a Codex skill to check whether a site is affected and $1 billion in subsidized Daybreak access for defenders, and warned that similar findings will increase sharply in the coming months. Link: https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/
The PHP Foundation's post is the sober counterweight. Since July 1 it handled 15 CVEs and more than 100 reports that were invalid, duplicates or not reproducible, and the line that stays with you is that tools cannot decide on the right fix or review the patch. Anthropic published the other half of the answer the night before: instead of finding more bugs, cut what is reachable. Across 25 projects Claude flagged 493 issues, including 94 config combinations that silently turned off a security control, and its OpenSSH changes removed roughly a fifth of the code an unauthenticated client can reach. Link: https://www.anthropic.com/research/attack-surface-reduction
Discovery got cheap. Triage, fixing and shrinking did not. The labs are now the ones running disclosure, and the volunteer maintainers are the ones whose time sets the speed limit.
Comments