Critical PHP2Shell Flaws Exposed Using OpenAI Model, Fixes Released

24 Oct 2026, 4:49 pm · 7h ago · 1 min read · Inc42

Cybersecurity researchers have uncovered two critical vulnerabilities in PHP, dubbed PHP2Shell, that allow attackers to execute malicious code remotely on unauthenticated servers. Discovered through independent research and OpenAI's GPT-5.6 Sol model via security firm Calif, alongside reports from cybersecurity firm Wiz and researcher LCFR, the flaws exist within PHP itself rather than individual website code. With PHP powering roughly 70% of websites globally, businesses must update to patched versions released on October 21, 2026. The incident underscores both the power of AI tools in finding security bugs and the growing urgency for rapid patch management.