OpenAI disclosed PHP2Shell on Oct 21, two critical PHP flaws found with its Patch the Planet work using GPT-5.6 Sol, tracked as CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2 (OpenAI post). They allow unauthenticated remote code execution and memory disclosure, worst on mod_php where it can trigger before app code runs, affecting versions back to PHP 5.4 and about 70% of websites including WordPress (detail post). Fixes are out as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and OpenAI says every PHP site can now upgrade plus use vendor mitigations (OpenAI post, fix list). The patch was pushed a day early on Oct 21 after details leaked, versus a planned Oct 22 release (Investing.com, gdb article). OpenAI also posted a Codex checker at github.com/openai/php2shell-checker (post). OpenAI calls it one of the most impactful bugs in recent memory and a Defender's Window case where AI found it ahead of attackers, though Cloudflare and Patchstack reported early attack attempts.