Two critical PHP remote code execution vulnerabilities (CVSS 9.2), found with AI assistance, disclosed and patched; mass exploitation forces sites offline

On 21 October at 10AM ET, PHP developers published an advisory and security patches for two critical remote code execution flaws, each rated 9.2 out of 10, affecting about 20 years of PHP versions from PHP 5 onward, many of them no longer supported. Per The Verge, the bugs were found with AI models; OpenAI says a researcher at Calif used GPT-5.6 Sol. Cloudflare reports exploitation ("PHP2Shell") went from thousands of attempts before disclosure to hundreds of thousands within two hours and millions by the next day. Sites including 4chan, DeviantArt, Wikipedia, the Internet Archive and some Dutch and Finnish government sites went offline at least temporarily, and two old Japanese mobile games are closing permanently because they cannot be patched.

Anyone running PHP, including WordPress hosts and agencies with old client sites, needs to patch now or take exposed systems offline, which is what the NSA and UK NCSC advise. The hardest hit are unmaintained sites on unsupported PHP versions, where no patch may exist and the realistic options are retirement or isolation. It also shows AI can shorten the gap between a hard-to-exploit bug and mass attack, which compresses the time defenders have to patch. How much of this is AI specifically, rather than a bad bug plus fast copycats, is not yet clear.

Wiz's "most severe in software history" and "most severe AI vulnerability ever found" are superlatives from a security vendor with a stake in the story, and cannot be checked. The "up to 70% of websites use PHP" figure says nothing about how many are actually vulnerable, since many are patched, behind other defences or on unaffected configurations. The AI discovery claim rests mainly on OpenAI's own account, and the article links no primary advisory or technical write-up.

1. 01The official PHP advisory and CVE entries: confirm the affected versions, whether unsupported branches get any fix, and whether the 9.2 rating holds up.
2. 02Independent telemetry beyond Cloudflare, such as CISA or NCSC updates, and whether successful compromises (not just attempts) are reported, plus whether the outages are resolved within days.
3. 03Independent technical analysis or the Calif and OpenAI write-up showing how much AI contributed to finding and exploiting the bugs, and whether further AI-found PHP or similar flaws follow.