AI-Found PHP Exploits: What Was Disclosed

AI-found PHP exploits are critical memory-safety vulnerabilities in PHP, the open-source scripting language behind WordPress, Drupal, and much of the web, disclosed publicly in October 2026 alongside patched releases. Wiz and OpenAI both published accounts of how the bugs were found and coordinated.

AI-found PHP exploits: what was disclosed and when

AI-found PHP exploits are critical remote code execution vulnerabilities in PHP, the open-source scripting language that runs WordPress, Drupal, and a large share of the web, publicly disclosed in October 2026 together with patched PHP releases. Wiz, a cloud security vendor, and OpenAI each published accounts of the discovery and the coordination that followed. Both describe flaws that had existed in the code for years and became practical to exploit with model assistance.

The most concrete technical statement comes from Wiz, which wrote that the vulnerable code had been present for more than a decade and that turning the flaws into working exploits required chaining multiple bugs and accounting for how PHP allocates and reuses memory across requests. That is the signature of a memory-safety defect, the class that includes use-after-free errors familiar from C programming.

Wiz also reported that differences in PHP versions, configurations, and application behavior can break the assumptions an exploit depends on. An attack that works against one deployment may need substantial adjustment against another, each round requiring more analysis, testing, and debugging.

OpenAI's account of its role is narrower than some headlines implied. In its write-up on Patch the Planet, OpenAI states that its partner identified a critical flaw using GPT-5.6 and that Wiz independently discovered and reported both vulnerabilities. PHP's maintainers led the fixes and the release, with OpenAI, Wiz, Cloudflare, and others contributing research and coordination.

The timeline from discovery to public patch

The public record runs from late August 2026 to the October disclosure, and the length of the middle stretch is the part that drew the most criticism. Dates below come from the accounts published by Wiz and OpenAI plus the timeline discussed in the video commentary by Dr. Samuel Allen Alexander, a mathematician and philosopher who reads and annotates security announcements.

• Discovery and reporting. Wiz researchers identified the vulnerabilities in August 2026, and OpenAI reports that its partner found a critical flaw using GPT-5.6 during the same period. Both were reported to PHP's security team the week of August 24, 2026.

• Proof that the flaws were reachable. Unauthenticated remote code execution was confirmed against Drupal and then WordPress in the following days, which established that the underlying PHP defect could be triggered through widely deployed applications, not only through direct PHP code.

• Acknowledgment and fix development. The commentary describes PHP acknowledging the reports and beginning coordinated fix development around September 21, 2026, roughly a month after the initial report. Treat that gap as reported rather than documented until PHP publishes its own incident record.

• Patched releases and disclosure. Patched PHP releases became available on October 21, 2026, the same day as public disclosure. Multiple organizations had to prepare before that date, which is why the coordination window was long.

The two options were both bad. Disclosing early gives attackers a working roadmap while most site owners are not paying attention. Disclosing late means the window between report and fix stays dark for defenders who could have been hardening. The commentary describes the vendor side of that tradeoff plainly: telling the world too early leaves more time for exploitation before patches get applied.

Why AI changed the exploitation economics

AI changed the economics of these flaws because exploitation had been blocked by tedious per-target adaptation, not by any missing insight into the bug. Wiz describes that shift directly: pre-AI, adapting an exploit to each deployment was difficult to implement and harder to scale.

A memory-corruption exploit is a fragile thing. The offsets, the heap layout, the free list reuse pattern, and the PHP build configuration all have to line up. A human researcher can work out one reliable exploit for one version in a lab and then face weeks of work for each variation that appears in the wild. That labor cost is what kept a decade-old flaw from becoming a mass incident.

Models do not get bored. They can run a failing test, read the crash, adjust a heap-shaping value, and try again, thousands of times, on each variant. Wiz reports that with testing and debugging tools, models can analyze failures and iterate on adjustments, reducing the specialist effort each target requires. That is a much narrower claim than 'AI can hack anything,' and it is what the write-up actually supports.

The same capability also runs in the other direction. OpenAI reports that its response included adversarial testing with frontier models to look for ways around the patch and for related variants of the vulnerability. That is worth holding onto: the defenders who move fastest are using the same tooling to check whether the fix holds.

What site owners running PHP should actually do

Site owners running PHP should update to a patched PHP release, then update the applications layered on top, and they should confirm the fix after a reboot rather than assuming a restart is enough. The order matters because the web server can be reachable before your update command finishes.

1. Identify every PHP version in use. Hosting panels often run several side by side, and a stale version kept for an old plugin is still a live attack surface.

2. Apply patched PHP packages from your distribution or hosting provider, then update WordPress, Drupal, and any PHP plugins or themes to their current fixed versions.

3. Prevent the web server from starting automatically on the next boot, so the machine does not come back online with vulnerable PHP serving requests while you patch. The commentary describes removing the systemd multi-user target symlink for Apache, then recreating it after patching; the exact path depends on your service name.

4. Re-enable and restart the service, then verify the running PHP version rather than trusting the package manager alone.

5. Where a fast update is not possible, put web application firewall rules or a reverse proxy in front of the application. OpenAI reports that it coordinated with infrastructure providers on protections for affected systems, and that it published a PHP version checker alongside its guidance.

The groups that had warning are not the groups that run most of the affected sites. Maintainers, hosting providers, and security vendors were briefed ahead of disclosure; a small business running an idle WordPress install for its storefront received nothing beyond the public announcement. That asymmetry is the practical risk, not the date of the patch.

Drupal, WordPress, and the blast radius

Drupal and WordPress were confirmed exploitable because both are written in PHP and both expose the affected runtime to unauthenticated requests, which turned a language-level memory bug into a website-level intrusion risk. The commentary describes these confirmations arriving within days of the initial report.

Scale is where estimates get slippery. Nobody has published a count of affected sites, and the transcript's framing that hundreds of thousands could be hit is an assessment, not a measurement. What is measurable is that WordPress and Drupal together run a very large share of the web, so any unauthenticated remote code execution path through them reaches far beyond the hosting industry.

Layer	What was affected	Fix owner
PHP runtime	Memory safety flaws enabling remote code execution	PHP maintainers, then your OS or hosting provider
Drupal	Unauthenticated remote code execution confirmed	Drupal security releases
WordPress	Unauthenticated remote code execution confirmed	WordPress core and plugin maintainers
Server config	Auto-restart exposed a fixed machine to re-exploitation	Whoever runs the server

The last row is easy to overlook. A server that reboots with vulnerable PHP before your update runs can be compromised in the gap. That is why the remediation steps above start with controlling when the service comes back, not with the update itself.

What the response says about how AI security findings get handled

The disclosure also published a governance proposal, and OpenAI states that its Patch the Planet framework asks the security community to improve a process for handling vulnerabilities that affect many products at once. The stated goal is to decide who needs warning before disclosure and to run the fix as a coordinated operation rather than a single maintainer's task.

The named partners matter for anyone judging how these disclosures will work in future. OpenAI reports contributing security expertise and model access, working with Wiz and Cloudflare on research and coordination, engaging government cyber agencies so guidance reaches critical organizations, and committing one billion dollars in subsidized access for frontline defenders at organizations with limited security resources.

OpenAI also states that these bugs are among several significant vulnerabilities it has already found and is working to fix, and that it expects similar findings to increase sharply. That expectation is a prediction from an interested party, not a verified trend. It does carry weight as a signal about how much of this work is already queued.

There is a fair criticism buried in all of this. A company announcing its own discovery tool while announcing the vulnerability is doing marketing and public service at the same time, and readers should weigh the technical claims in the Wiz report separately from the initiative framing in the OpenAI post.

Where this fits in the wider developer stack

The PHP incident lands in the same period as a lot of work on making type systems and language tooling catch classes of bug earlier, and developers who build on typed JavaScript should watch that space alongside their server patching. One example is the Crazystack TypeScript stack, a TypeScript-focused project from the Brazilian developer community; communities like Dev Doido publish Portuguese-language material on it.

Static types and memory-safe languages reduce whole categories of defect, but they do not remove the need to patch the runtime underneath. PHP's flaws are in the language implementation itself, so an application written carefully on top of an unpatched runtime is still exposed. Treat language safety and patch discipline as separate controls.

For teams writing up what happened here, comparing incidents across stacks helps. A memory-safety bug in a C-based runtime, a type confusion in a JavaScript engine, and a dependency compromise in a package registry each need a different response, and lumping them together produces guidance nobody can act on.

FAQ

• What are the AI-found PHP exploits? They are critical remote code execution vulnerabilities in PHP, disclosed in October 2026 with patched releases. Wiz reports that exploiting them required chaining multiple memory-related bugs and adapting to each deployment's version and configuration.

• Did AI create these vulnerabilities? No. Wiz states that the vulnerable code had been present for more than a decade. Models helped find the flaws and helped adapt exploits across configurations, but the defects themselves predate the AI work.

• Were WordPress and Drupal actually exploitable? Yes. Unauthenticated remote code execution was confirmed against both in the days after the initial report, according to the timeline described in the commentary. Sites running unpatched PHP underneath either application were exposed.

• Why did the fix take roughly two months? Coordination had to cover PHP maintainers, application vendors, hosting providers, and security vendors preparing firewall rules. The commentary describes disclosure being held until patched releases were ready on October 21, 2026.

• Is restarting the server after patching enough? Not if the web server starts before the patch is applied. Prevent the service from starting on boot, patch, then re-enable it, and confirm the running PHP version afterward.

• Does this mean AI will find more vulnerabilities like this? OpenAI states that it expects similar findings to increase sharply, which is a vendor prediction rather than an independent measurement. Treat it as a planning signal and keep patch cycles short.

• Should I shut down my server while patching? The safest sequence is to stop serving requests, apply patches, and bring the service back only when the patched PHP is confirmed running. Leaving the machine up and reachable during the update is the risky option.

• What does this mean for developers using other stacks? Memory-safety defects in a runtime are a language-level problem, so typed application code does not protect you. Patch the runtime, then the framework, then dependencies, in that order.

• Where can I read the primary accounts? The technical detail is in the Wiz write-up on its site, and the coordination and process framing are in OpenAI's Patch the Planet post. This article relies on those two plus the commentary, not on secondhand summaries.

• Was OpenAI the only finder? No. OpenAI states that Wiz independently discovered and reported both vulnerabilities, and that PHP maintainers led the fixes and the release with several partners contributing.

AI-generated drafts of a fast-moving security story age quickly. If you have a video recording of the incident from your own team, turning it into a written account is the fastest way to preserve what you actually observed. Skala Blog is built for that: paste a YouTube URL, get a transcription, and produce a structured article you can review before publishing.

Turn the recording into a record

Disclosure timelines are exactly the kind of thing companies reconstruct badly months later, when the dates blur and only the announcement survives. A recorded incident review, a developer walkthrough, or a recording of your own team triaging a vulnerability holds the details a written post-mortem needs: what you checked first, which version bit you, where the fix held.

If that knowledge is sitting in a YouTube video, Skalablog can turn it into an article. Paste the video URL, let it transcribe the audio, and generate a draft you edit before it goes anywhere. The details you recorded in the moment are usually better than the summary anyone writes from memory.

Source video