AI Models Found Two Critical Bugs in the PHP Behind WordPress, and the Patch Took Two Months

Quick verdict

Researchers disclosed PHP2Shell, two memory-corruption bugs in core PHP's internal error handling. They sit in the language itself, not in a WordPress plugin or an app's own code, and the discoverers report pre-authentication remote code execution against WordPress, Drupal and Joomla, plus remote memory disclosure for PHP apps more broadly. Wiz rates them CVSS 9.2. The part that makes this more than another CVE is how they were found: both OpenAI and Wiz say AI models did a lot of the work, from spotting the flaw to writing the exploit and validating the fix. If you run a PHP site, patch now. If you are watching where AI capability is actually landing, this is the clearest real-world example yet of models finding critical bugs in software the whole internet depends on.

What actually shipped

PHP2Shell is two flaws in how core PHP handles errors internally. Because they live in the engine, they reach across the three biggest PHP content systems at once:

• Pre-authentication RCE against WordPress, Drupal and Joomla, which means an attacker does not need an account or a login to run code
• Remote memory disclosure affecting PHP applications in general, so even apps outside those three can leak memory contents
• Wiz scores both at CVSS 9.2, near the top of the severity scale

One caution the disclosure itself makes: the scary-sounding "most of the web runs PHP" framing describes PHP's prevalence, not a verified count of exploitable installations. Whether a given site is actually hittable still depends on its version and configuration. The flaw is real and serious. The "the entire internet is on fire" reaction ran ahead of the evidence.

The AI discovery claim, read carefully

There are two parallel accounts here, and it is worth keeping them straight. OpenAI says its models helped researchers find the flaws through a program it calls Patch the Planet. Wiz reports an independent discovery, with Gemini 4 Argon assisting across vulnerability discovery, exploit development, detector creation and patch validation. These are two groups describing their own work, not proof that any single model found the bug on its own.

Even read conservatively, that is a milestone. For years the pitch for AI in security was autocomplete for exploit code and triage help for analysts. PHP2Shell is a case where models are credited with the full loop on a genuinely hard target: finding a memory-corruption bug in a mature, heavily audited C codebase, building a working exploit, and helping confirm the patch actually closes it. The honest framing is that AI accelerated human researchers who still drove the process, not that the model worked alone. That is still a different capability than the industry was demonstrating a year ago.

Why the fix took two months

The more quietly impressive part is not the discovery, it is the cleanup. OpenAI describes roughly two months of work with PHP maintainers, researchers and security providers, because the proper fix required a major change to the PHP engine itself. You cannot ship that overnight and you cannot let it leak early, or you hand attackers a map before anyone is patched.

So the real story is coordination at internet scale, not just automated bug-finding:

• The NSA advised organizations to prepare updates and, where immediate mitigation was not possible, to take affected systems offline until they could patch
• Cloudflare pushed WAF rules for known exploit vectors to every customer, free accounts included, and reported early attacks already probing for it
• OpenAI shipped a Codex skill that lets operators check whether their own sites are exposed

Cloudflare's own message was the level-headed one, and worth repeating: those WAF rules are a stopgap for the window before you patch, not a replacement for patching. A firewall rule blocks the exploit paths someone already knows about. The engine fix removes the bug.

Why it matters

Two things change here. First, the economics of finding critical vulnerabilities just shifted. If models can meaningfully speed up discovery of pre-auth RCE in core PHP, the same capability runs in both directions. Defenders get faster audits and faster patch validation. Attackers get the same tooling pointed at everything that has not updated yet. The gap between "a bug exists" and "a bug is being exploited at scale" gets shorter, which makes fast patching matter more than it already did.

Second, notice who was in the room. OpenAI's models and Google's Gemini 4 Argon both show up in the same security event, from different labs, on the same class of problem. This is the quiet version of the frontier race that does not make launch-day headlines. If you want the bigger picture on how these labs are lining up against each other, we track it in our running comparison of OpenAI, Anthropic and Google.

And PHP2Shell was not alone on the day. A GitLab CVSS-10 flaw could allow unauthenticated RCE on self-managed servers, reaching back to releases from 2014, with patches already out. Aikido reported a patched Node.js bug involving attacker-controlled Brotli decompression. Neither of those was tied to AI discovery, which is a useful reminder that plenty of critical bugs still get found the old way. PHP2Shell stands out because of how it was found, not because the rest of the stack went quiet.

Video: PHP2Shell and AI-assisted vulnerability discovery

Context on the two core-PHP flaws, the pre-auth RCE against WordPress, Drupal and Joomla, and the discovery process both labs describe.

FAQ

What is PHP2Shell?

It is the name for two memory-corruption vulnerabilities in core PHP's internal error handling, rated CVSS 9.2 by Wiz. Because they are in the language engine rather than in any one application, they allow pre-authentication remote code execution against WordPress, Drupal and Joomla, and remote memory disclosure for PHP apps more generally.

Did an AI actually find the bug by itself?

Not quite. OpenAI and Wiz each describe their own discovery, and both credit AI models with major parts of the work, including finding the flaw, developing an exploit and validating the patch. The accurate reading is that models sped up human researchers who still ran the process, which is a real step up from where AI security tooling was a year ago.

What should I do if I run a PHP site?

Patch to the fixed PHP version as soon as you can, and treat any WAF rule, including Cloudflare's, as temporary cover until you do. OpenAI also released a Codex skill to help you check whether your sites are exposed. Taking an unpatchable system offline, as the NSA advised, is a valid last resort.

Does this affect me if I only use AI chat tools, not PHP?

Not directly, but it is a signal worth reading. The same models that found these flaws are the ones you reach through everyday products, and the capability is advancing fast on both the offense and defense sides. If you want to compare how the leading labs stack up, see our OpenAI vs Anthropic vs Google breakdown.

Sources

• @sagitz_ - PHP2Shell disclosure: two memory-corruption flaws in core PHP
• OpenAI - coordinated PHP2Shell discovery and two-month remediation
• Wiz - independent discovery with Gemini 4 Argon assisting, CVSS 9.2
• NSA - prepare PHP updates, take systems offline if mitigation is impossible
• Cloudflare CTO - free WAF mitigations are a stopgap, patch PHP
• OpenAI - Codex skill to check whether a site is affected

Further reading

• Gemini 4 Argon: Google's frontier model that helped find these flaws
• OpenAI vs Anthropic vs Google: how the labs line up
• The best AI coding agents for reading and fixing real code