PHP2Shell Flaws Found By Calif And Wiz, Fixed In Emergency PHP Update
Two AI-driven security teams found the same critical PHP flaws within weeks of each other, and the coordinated patch effort involving OpenAI, Google and major cloud and CDN providers shows how much of the web depends on PHP being fixed quickly.
Reporting from 1 source: GIGAZINE.
Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were discovered independently in August 2026 by security firm Calif and Wiz, the Google-owned AI platform. Calif found the first flaw on August 1 and reported it to PHP on August 11, then found the second on August 21. Wiz found the flaws on August 19 and reported them on the 24th. PHP released emergency updates 8.5.12, 8.4.27, 8.3.36 and 8.2.35 late on October 21, 2026 Japan time.
Calif's work fell under Patch the Planet, the security initiative OpenAI announced in June 2026. Calif and Wiz then worked with OpenAI's Codex Security team, PHP's security team and the Google Gemini team to coordinate discovery and verify the patches. Google Cloud, Cloudflare, AWS, Microsoft, Automattic, Fastly, Akamai, Imperva and Vercel helped prepare guidance and temporary mitigations for organizations that could not update immediately. Calif also released a video of an exploit run against Nginx.
Synthesized by Yomimono from the 1 cited source below, including Japanese-language reporting where cited, then editorially reviewed before publishing.