{"rewrite":{"id":"r_9ff3c63fa6e535810b9fe6de","clusterId":"c_258cd85272a7cecc6eab52cb","slug":"php2shell-flaws-found-by-calif-and-wiz-fixed-in-emergency-php-update","model":"deepseek-v4-1-flash","headline":"PHP2Shell Flaws Found By Calif And Wiz, Fixed In Emergency PHP Update","summary":"Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were discovered independently in August 2026 by security firm Calif and Wiz, the Google-owned AI platform. Calif found the first flaw on August 1 and reported it to PHP on August 11, then found the second on August 21. Wiz found the flaws on August 19 and reported them on the 24th. PHP released emergency updates 8.5.12, 8.4.27, 8.3.36 and 8.2.35 late on October 21, 2026 Japan time.","whyItMatters":"Two AI-driven security teams found the same critical PHP flaws within weeks of each other, and the coordinated patch effort involving OpenAI, Google and major cloud and CDN providers shows how much of the web depends on PHP being fixed quickly.","webCardHtml":"\u003cp\u003eCalif\u0026#39;s work fell under Patch the Planet, the security initiative OpenAI announced in June 2026. Calif and Wiz then worked with OpenAI\u0026#39;s Codex Security team, PHP\u0026#39;s security team and the Google Gemini team to coordinate discovery and verify the patches. Google Cloud, Cloudflare, AWS, Microsoft, Automattic, Fastly, Akamai, Imperva and Vercel helped prepare guidance and temporary mitigations for organizations that could not update immediately. Calif also released a video of an exploit run against Nginx.\u003c/p\u003e","blueskyPost":"Calif reported the first PHP flaw on August 11; the fix shipped October 21. Wiz found the same flaws on August 19 and reported them five days later, so two firms ran parallel discovery on the same code.","twitterPost":"Calif reported PHP's first flaw on August 11. The emergency fixes landed October 21, with Wiz reporting the same bugs separately on the 24th.","threadsPost":"Calif reported the first PHP flaw to the project on August 11. Wiz found the same flaws on August 19 and reported them on the 24th. The emergency updates 8.5.12 and 8.4.27 landed late on October 21, so the gap between report and patch is where the exposure sat.","newsletterBlurb":"Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, were found independently by Calif and Wiz in August 2026. PHP released emergency updates 8.5.12, 8.4.27, 8.3.36 and 8.2.35 late on October 21. Calif and Wiz worked with OpenAI's Codex Security team, PHP's security team and the Google Gemini team, while Google Cloud, Cloudflare, AWS, Microsoft and others prepared guidance and mitigations.","attributionJson":"[{\"source\":\"GIGAZINE\",\"url\":\"https://gigazine.net/news/20261022-php2shell-wiz-openai-calif/\",\"title\":\"Critical PHP vulnerability \\\"PHP2Shell\\\" was discovered using AI by security firms Calif and Wiz, and countered through OpenAI's framework\"}]","lintFlagsJson":null,"lintHits":0,"costUsd":0,"inputTokens":4710,"outputTokens":715,"status":"published","repairAttempts":0,"nextRepairAt":null,"factsAttemptedAt":1792599739,"createdAt":"2026-10-21T16:17:34.000Z","publishedAt":"2026-10-21T16:21:10.000Z","updatedAt":"2026-10-21T16:21:10.000Z"},"cluster":{"id":"c_258cd85272a7cecc6eab52cb","canonicalTitle":"PHPの重大脆弱性「PHP2Shell」はセキュリティ企業のCalifとWizがAIを用いて発見しOpenAIの枠組みを使って対策したことが判明","representativeArticleId":"a_6328fc5c755a85f5ea2e6a12","sourceCount":1,"writtenSourceCount":1,"writeAttempts":0,"isSolo":true,"entitiesJson":"{\"anime_titles\":[],\"manga_titles\":[],\"work_titles\":[],\"studios\":[],\"people\":[],\"type\":\"news\",\"domain\":\"other\",\"is_roundup\":false}","contentType":"news","status":"published","firstSeenAt":"2026-10-21T15:06:00.000Z","lastSeenAt":"2026-10-21T15:06:00.000Z","updatedAt":"2026-10-21T16:21:06.000Z"},"attribution":[{"source":"GIGAZINE","url":"https://gigazine.net/news/20261022-php2shell-wiz-openai-calif/","title":"PHPの重大脆弱性「PHP2Shell」はセキュリティ企業のCalifとWizがAIを用いて発見しOpenAIの枠組みを使って対策したことが判明"}],"entities":{"anime_titles":[],"manga_titles":[],"work_titles":[],"studios":[],"people":[],"type":"news","domain":"other","is_roundup":false},"keyFacts":null}