How PHP2Shell was found: AI-assisted research, a leak and a rushed release

The part of the PHP2Shell story that got the most attention was the AI angle: a language model helped find a flaw in PHP, the engine under a huge share of the web. This is part 3 of the series. It sets out who found the bugs, what the AI actually did (and what nobody has said it did), how the disclosure went, and what the leak tells us. If the bugs themselves are new to you, start with part 1.

Who found it

Several parties are credited, and the sources describe them slightly differently:

• Calif. OpenAI's post says Calif identified a critical flaw using GPT-5.6 Sol. Sansec dates Calif's first report to PHP as 11 August 2026.
• Wiz. OpenAI says Wiz also independently discovered and reported both vulnerabilities. Wiz says it used its own tool, Wiz Atlas, along with Google's Gemini 4 Argon and GPT-5.6 Sol, as reported by The Next Web.
• OpenAI and Quarkslab are also credited. Cloudflare's post names Calif.io, Wiz, OpenAI and Quarkslab as the parties that disclosed the flaws. OpenAI's own post leaves out Quarkslab.
• PHP's maintainers wrote and shipped the fixes. The advisories list four remediation developers.

What the AI did, and what we do not know

OpenAI's framing is that frontier AI can uncover security flaws with internet-scale impact, and that it found these before attackers did, giving defenders a head start it calls the Defender's Window. It also says the same capability can help attackers develop offensive tools rapidly.

Calif, per The Next Web, gave a more measured account. It said it used only generally available models and no special tooling, and that knowing PHP's history mattered more than the model. It also said no model can find all bugs with simple prompts. The coverage does not quantify how much human work was involved.

What nobody has published (as far as we could find): which of the two bugs Calif's model found, the prompts or workflow used, how much of the exploit work was done by a person, or whether the AI wrote any of the fix. The CISA alert and the Qualys write-up do not mention AI in the discovery at all, and the PHP security team member we cite in part 2 does not describe an AI role either. So the accurate summary is AI-assisted research by human experts, not "an AI found it by itself."

The bug was not entirely new to people

The PHP Foundation said a core developer saw signs of the out-of-memory flaw during a 2024 external audit, but no working route to code execution was found at the time (The Hacker News). That fits how bugs like this hide. A human reviewer looks at what a function does when everything goes right. This bug lives in what happens when a failure strikes at an unlucky moment, and then in what other code does with the leftovers. Finding it takes patience across thousands of lines. That is our reading of why it stayed hidden, not a statement from the researchers, but it matches why tireless code reading is a place where AI helps.

How OpenAI says the response was run

OpenAI says it led a coalition of maintainers, researchers and security providers for about two months before disclosure, and describes a five-stage approach:

1. Validate and fix upstream. The maintainer and researchers confirm the finding and build a fix, including adversarial testing with frontier models to look for ways around the patch.
2. Give affected organizations time. Distributors, hosting providers and security vendors get advance information to prepare backports, mitigations and firewall rules.
3. Coordinate with governments so guidance reaches critical systems. For PHP, OpenAI says it engaged the Office of the National Cyber Director and CISA, among others.
4. Prepare updates across products.
5. Publish guidance and support deployment once a patch exists.

OpenAI also released a PHP version checker as a Codex skill, and said it committed $1 billion in subsidized access to its Daybreak security program for under-resourced defenders. We have not verified those commitments beyond OpenAI's own statement.

The timeline

Not every source agrees. The PHP advisory page for the fix was opened on 27 August according to Alexandre Daubois, PHP security team, while Sansec dates Calif's first report to 11 August. Both can be true: one is when the report arrived, the other is when the public advisory record was created. CISA and Qualys describe the releases as shipping on 21 October, while the php.net changelog lists two of them under 22 October.

The leak

On 20 October, a Hacker News post said the CVEs would be disclosed on 22 October. The Hacker News reports that around 20:00 UTC, Calif posted a video of its proof of concept by mistake. The PHP security team member we cite describes a screenshot credited to Calif and a short exploitation video spreading on social media, and says watchTowr publicly confirmed the bugs and both CVE numbers despite the embargo. PHP announced an advance notice that evening and moved the release a day earlier, to 21 October.

The practical effect: defenders lost a day, and attackers gained attention on the bug. Cloudflare said attack traffic appeared on its network and that attackers were changing their payloads to get past its rules.

A tension worth noting

OpenAI says "to our knowledge" the AI found the bugs before attackers did. Meanwhile, Amazon Threat Intelligence reported that its honeypots recorded an attempt on 17 October, four days before disclosure and three days before the leak. Amazon said it was unclear how the attacker got exploit information, and unclear whether the payload would have worked (per the Tenable FAQ). These facts do not necessarily conflict. They do show how little a "head start" can be taken for granted.

What this episode shows

Our reading, which is opinion based on the facts above:

1. The window between "a bug exists" and "an exploit exists" is shrinking. If models help defenders read code tirelessly, they help attackers too, and OpenAI says as much.
2. Leaks are part of the threat model. A disclosure plan that depends on nobody talking is fragile. Plan to patch on short notice.
3. The unglamorous work wins. Knowing where PHP runs (including inside containers and bundled software) and being able to roll a patch in hours mattered more than any detail of the discovery.
4. Do not over-read one case. This is one disclosure, with vendor-reported details. It shows what is possible. It does not measure how often AI finds bugs of this size.
5. For teams building AI products, the runtime under your app is part of your attack surface, and AI keys live in that memory. Part 4 covers what to do about it.

Sources: OpenAI, Patch the Planet, The Next Web, The Hacker News, Alexandre Daubois, PHP security team, Sansec, Cloudflare, Tenable FAQ, CISA alert, Qualys write-up. Read 23 October 2026. The OpenAI statements are paraphrased from OpenAI's own post, read directly on 23 October