AI Found a Critical Flaw in the PHP Code Behind Seven in Ten Websites
Two CVEs in the PHP engine
On August 1, 2026, a few days into an audit of PHP, Calif researcher Ryan Austin had his first lead. His agent had flagged a function in the Zend hash table code, zendhash_str_add_or_update_i, that increments an element count before it allocates the key for the new entry. If the allocation hits PHP's memory_limit and the request dies, the table still reports a live bucket that was never initialized. Request shutdown then walks the table and treats stale memory as real data. Calif's write-up describes how that state becomes remote code execution on Apache with mod_php.
The audit produced two CVEs, CVE-2026-109618 and CVE-2026-109619, patched in the PHP October 2026 security release. Tenable lists both at CVSS v4.0 9.2. Calif says the earliest affected code path dates to PHP 5.4.0 and that exploitation works under default configurations. The team confirmed pre-authentication code execution on WordPress 7.1.2, Drupal 11.4.3, Joomla 6.1.4, Magento 2.4.9, phpMyAdmin 5.2.3, Nextcloud 35.0.1 and Laravel 13.11, among other applications. Heise reported that a successful attack can take several thousand requests, and that Calif's demonstration ran system commands on a Laravel server after 38 seconds.
Exposure varies by setup. Calif found that the mod_php path works against arbitrary PHP scripts. For PHP-FPM, the exploit needs an application that decodes data after request startup, through calls such as session_start() or unserialize(), which includes WordPress's maybe_unserialize() wrapper. Cloudflare says PHP runs on almost 70% of websites and that the flaws affect every server on PHP 5.4 or later. Its WAF protections went live by default at 3:02 am UTC on October 21, about nine hours before disclosure. Recorded Future reports exploitation attempts following a leak of technical details ahead of the release.
What the models did
Austin started by asking a language model for ways to exceed memory_limit. The first useful answer was a way around the post_max_size ceiling, using chunked HTTP/1.1 or lengthless HTTP/2 multipart requests whose declared length is never enforced. The second was an upload part with an empty filename and a deeply nested field name, which makes PHP build six hash tables per record. Hundreds of such records can fill the default 128 MiB heap while the request body stays under the default 8 MiB limit.
With out-of-memory failures available on demand, Austin asked the agent to review Zend memory manager behavior and request shutdown. It found the count-before-allocation ordering. The team then had the model turn that pattern into a SKILL.md describing code that publishes state, performs fallible work, and commits afterward. Running the skill turned up a second flaw in the session upload-progress feature, and a path involving PHP's generic unserializer that reaches PHP-FPM.
Austin writes that no special harness or unreleased model was used. He credits his knowledge of PHP's history for the direction of the search. In 2004, Stefan Esser published the first PHP memory-limit remote vulnerability. A 2020 bug report, #78876, described long variables causing out-of-memory conditions. A 2024 audit by OSTIF and Quarkslab rediscovered the same issue but could not prove exploitation, so it stayed open. Austin observed that models tend to start from recent, prominent bugs and work toward nearby older code, and rarely begin with twenty-year-old exploitation techniques unless the prompt points there.
Wiz reached the same code independently. Its write-up says it found its first PHP vulnerability on August 19 using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, and that it could also read passwords, tokens and API keys from PHP worker memory without achieving code execution. Calif's work took place under OpenAI's Patch the Planet program, announced June 22 with Trail of Bits. OpenAI said at launch that the program had identified hundreds of security issues and merged dozens of patches.
The rest of the 2026 record
Anthropic announced Claude Mythos Preview and Project Glasswing on April 7. Its published examples included a 27-year-old denial-of-service bug in OpenBSD's TCP stack, a 16-year-old flaw in FFmpeg's H.264 codec and a 17-year-old remote code execution bug in FreeBSD's NFS server, CVE-2026-4747. Anthropic's reported costs were under $20,000 for the roughly 1,000-run OpenBSD campaign, under $50 for the single run that found the bug, and under $2,000 to turn a known Linux kernel flaw into a working privilege escalation exploit.
Glasswing's first report, on May 22, said the model had scanned more than 1,000 open-source projects and flagged 23,019 vulnerabilities. Of 6,202 initially rated high or critical, 90.6% were confirmed on review, according to Forklog's account of the report. Anthropic said the slow steps are verification and patch release. A Picus Security analysis cited by BuildFastWithAI put the share patched at under 1% at the time.
Mozilla said Mythos Preview helped it fix 271 vulnerabilities in Firefox 150, with almost no false positives. The Register reported that Mozilla fixed 423 security bugs in April, against 76 in March and a 21.5 monthly average in 2025. Critics have noted that the Firefox 150 advisory credits Claude on only three individual CVEs, because Mozilla grouped the findings into roll-up entries, and that Mozilla published no comparison of Mythos against other models on the same code.
Other results come from smaller teams. AISLE reported that its AI system found all 12 zero-days in OpenSSL's January 27 release. The Hacktron research agent found CVE-2026-1731, an unauthenticated command injection in BeyondTrust remote access products. On May 11, Google's Threat Intelligence Group published evidence that a cybercrime group used an AI model to find a two-factor authentication bypass in an open-source admin tool and write an exploit for it, and that Google alerted the vendor before a planned mass exploitation campaign began.
Where the numbers point
Google's October 1 report covers disclosure and exploitation data from January 2025 through August 2026. Monthly CVE disclosures rose from 5,045 in January to 10,740 in August. Google counted 141 exploited vulnerabilities in the first eight months of 2026, against 127 in all of 2025. Half of the vulnerabilities it judged likely AI-discovered led to remote code execution, compared with 26% of those found by other means. After the BeyondTrust flaw was disclosed, one threat cluster exploited it within four days and five more within seven. Google notes that public data undercounts AI-found bugs, since CVE records carry no AI attribution tag, and says it expects discovery and exploitation to keep rising.
Bug bounty platforms show the same volume. Intel 471 reports that Wordfence saw AI-assisted submissions to its WordPress program rose from 16% to about 66% between late November 2025 and April 2026, while total submissions grew 453%.
The cost figures above come from vendors working on defined targets with custom tooling and expert triage, and no source I found measures cost per bug on publicly available models at scale. Austin's PHP audit offers one data point. It used models anyone can access, a researcher with deep knowledge of the target, and ten days between the first finding on August 1 and the first report to PHP on August 11.
Next steps for operators
Calif's guidance is to upgrade PHP to a fixed release. For teams that cannot patch immediately, Calif lists partial mitigations. On PHP-FPM, set session.upload_progress.enabled=0 and memory_limit=-1. On mod_php, set memory_limit=-1. Calif warns that removing the memory cap increases the risk of memory exhaustion and that neither change replaces the patch. Google recommends that organizations move from blanket patching to triage driven by threat intelligence, paired with automated remediation. The fixed versions are listed in the PHP release notes linked above.
