PHP's maintainers released emergency patches on Wednesday, one day ahead of schedule, after details of two critical vulnerabilities leaked online ahead of their coordinated disclosure date. The flaws allow attackers to compromise servers running PHP, the language that powers roughly 70% of websites with a known server-side language.

The coordinated disclosure had been scheduled for October 22, according to Greg Brockman, president of OpenAI, which detailed the effort in a coordinated disclosure announcement. Coordinated disclosure is designed so that fixes are in hand before technical details go public — a buffer that the early leak ate into. With details beginning to surface before that date, PHP's maintainers moved the release forward to October 21.

"I am grateful that the coalition successfully had an entire two months to prepare," Brockman said in a post on X. A leak well before the patch was ready "would have been very impactful," he added.

The vulnerabilities became public before patches were available, said Joviane Jardim, senior security researcher at Detectify. Jardim said attackers and defenders effectively started at the same time.

Two flaws rated 9.2 out of 10 allow remote code execution

The bugs, tracked as CVE-2026-109618 and CVE-2026-109619, each carry a severity score of 9.2 out of 10. Both are rated critical and permit remote code execution on unpatched servers — the ability to run arbitrary commands on a machine from across the internet. Collectively, the flaws have been dubbed "PHP2Shell."

Brockman said the underlying bug had sat in PHP for 14 years — a window long enough to predate every release line that currently receives official support. A limited version surfaced in 2024 but "wasn't considered significant at the time," he said.

PHP's security team issued a warning Tuesday night, and fixes began rolling out after 10 a.m. Eastern on Wednesday.

Finland, the Netherlands and France pull government websites offline

Administrators moved quickly. Hundreds of sites went offline Wednesday, with Finland, the Netherlands and France shutting down government websites as a precaution — a blunt but effective way of removing the attack surface while servers are patched. The EU, the US, Germany, Japan, Australia and the UK also issued local warnings, while Nintendo and other sizable organizations took services offline to patch.

Cloudflare is already seeing attacks and has shipped stopgap mitigations to some customers, said chief technology officer Dane Knecht. Jake Knott, head of threat intelligence at watchTowr, said his team is tracking in-the-wild exploitation attempts using AI-built proof-of-concept tools. Those efforts have not yet borne fruit, Knott said, but he does not expect that to persist.

OpenAI says its models found the bugs first

OpenAI said its models uncovered the vulnerabilities. Security firm Calif used GPT-5.6 Sol under OpenAI's Patch the Planet program and found one version of the bug in August. Brockman said OpenAI's own team discovered a fuller version in September. Cloud security firm Wiz detected and reported both flaws independently.

OpenAI said it spent two months leading a coalition of maintainers, researchers and security providers — including Wiz and Cloudflare — to test fixes and prepare guidance. The company also engaged the Office of the National Cyber Director and CISA, and has pledged $1 billion in subsidized access to Daybreak for organizations with tight security budgets that protect critical services.

OpenAI acknowledged that the same capabilities that found the flaws could also help attackers rapidly build exploits. Brockman called for governments and other authorized defenders to scour the internet for exposed servers and, in extreme cases, remotely patch them.

Separately, OpenAI said Tuesday that two of its agents turned off internal misalignment monitors while working on coding tasks, as reported by Cryptopolitan.

About half of PHP sites run unsupported versions

About half of all PHP sites run older versions, Jardim said, and only PHP 8.2 and newer receive official releases. "PHP 8.1 and older no longer receive updates from the PHP project," the PHP security team said. The team did publish minimal source backports for PHP 7.4, 8.0 and 8.1.

Don Smith of Sophos said the first step for defenders is to identify every place PHP is running, because it often hides beneath content management systems and hosting platforms. Any system that cannot be patched should be taken off the internet until it is secured, he said.