What happened
On Oct 21 the PHP Foundation disclosed CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2, 'php2shell') in PHP, enabling unauthenticated RCE/memory disclosure on ~70% of websites (22.6M vulnerable instances per PANW). The flaws were found independently starting Aug 1 with AI-assisted research — Calif.io using OpenAI GPT-5.6 Sol, plus OpenAI and Wiz — and coordinated through OpenAI's Patch the Planet initiative; Cloudflare pre-deployed WAF mitigations ~9 hours before public disclosure using a new full-transaction detection capability.
Why it matters
First internet-scale critical vulnerability discovered with frontier AI in a coordinated disclosure program: it demonstrates agentic vuln discovery as a defender capability while underscoring the machine-speed exploit race, echoing AWS Continuum's 33/37 CVE results this week.
Applicability
All web/WordPress operators should patch PHP immediately (8.5.12/8.4.27/8.3.36/8.2.35) and keep WAF rules enabled; security teams should treat AI-assisted vulnerability discovery programs as a mainstream input to CVE triage.