Researchers from the security firm Calif discovered severe vulnerabilities in the PHP language, which powers approximately 70% of websites globally. The flaws, collectively named PHP2Shell, were identified in August 2026 using the GPT-5.6 Sol model from OpenAI.
The identified bugs enable remote code execution and unauthorized control over server memory, potentially exposing sensitive user data. Ryan Austin of Calif is credited with the discovery, which was reported to PHP maintainer Volker Dusch on August 11, 2026.
Following a partial information leak, the release of a security patch was expedited to October 22, 2026. The response effort involved multiple stakeholders, including PHP maintainers, security providers, and US government agencies such as CISA and ONCD.
OpenAI launched the Patch the Planet initiative on October 21, 2026, to support defenders addressing these vulnerabilities. The company has pledged $1 billion in subsidized model access to provide AI tools to security teams working on critical infrastructure.
