"Update PHP tonight": AI finds a 14-year-old hole, and Japan's prime minister and the NSA weigh in

"On the bright side, if your favorite website is down this morning, it's probably because its site admin is not asleep at the wheel." That comment, under Eric Parker's YouTube video on PHP's critical flaw (196,000 views), drew 1,800 likes. "In the Netherlands, our government identification service (DigiD) is down due to this," read another.

According to OpenAI's blog on Oct 21, security firm Calif found a critical flaw in PHP using OpenAI's GPT-5.6 Sol, and cloud security company Wiz independently found and reported the same bugs. Dubbed php2shell (CVE-2026-109618 and -109619), the two flaws affect every PHP version since 5.4 and let an attacker run code on a server without logging in. Cloudflare says PHP runs almost 70% of websites.

OpenAI president Greg Brockman wrote on X that the bug "has been present in PHP for 14 years," and that a limited version found in 2024 "wasn't considered significant at the time." Disclosure was set for Oct 22, but details leaked early and PHP's maintainers moved the release up. Cloudflare said it saw attack traffic after the leak.

Governments moved fast. The NSA's cybersecurity account posted an urgent notice that passed 52,000 likes and 7 million views. Japanese Prime Minister Sanae Takaichi asked people on X to act "tonight," and the Dutch National Cyber Security Centre advised keeping vulnerable systems offline until patched. In Korea, KISA told PHP 8.2 to 8.5 users to update, and Theori CEO Park Se-jun warned that PHP may be hiding in "sites you built and forgot, outsourced shopping malls and device admin pages."

There was pushback, too. "How many bogus findings did it throw before that one?" drew 67 likes on X, and OpenAI's post carries a community note saying an independent researcher found the bug before Wiz. OpenAI warned that "the same capabilities can also help attackers," and expects similar findings to rise sharply in the coming months. It published a Codex skill on GitHub that checks whether a site is affected.