The two vulnerabilities are not complicated. One request pushes PHP memory to its limit at exactly the wrong moment; a fatal error interrupts processing at exactly the wrong moment. What is actually worth watching is the chain of events that unfolded around them: the people responsible for defence personally broke their own time window.
The bugs themselves: two debts left open for two years
On October 21 the PHP project shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing two critical issues tracked as CVE-2026-109618 and CVE-2026-109619. Under the right conditions, an unauthenticated attacker can execute arbitrary code on the server. The Cloudflare technical writeup puts it plainly: both flaws sit in how PHP cleans up after an HTTP request goes wrong. Either memory runs out and PHP leaves behind internal data that was never fully initialised, and a later request treats it as valid (109618); or a fatal error leaves the process still holding references to memory that has already been released, so the same worker trips into reclaimed space when it handles the next request (109619). According to the statistics Cloudflare cites, PHP runs on close to 70 percent of websites, and because the bugs live inside the runtime itself, changing site code or plugins does not help. The only fix is to upgrade the interpreter.
The awkward part is that this is not a new debt. In 2024 PHP underwent its first external security audit in years, funded by the PHP Foundation through OSTIF and carried out by Quarkslab. It was during that audit that a core developer contracted by the Foundation first spotted signs of the OOM problem; the team theorised about exploitation at the time but found no concrete attack vector. The Foundation now calls the resulting delay a structural failure: several mutually conflicting approaches were tried for the fix, each carrying the cost of backward-compatibility breakage, a new denial-of-service surface, or changes reaching many third-party extensions, and the repair stalled and restarted repeatedly over months.
AI found it, then humans broke the process
What genuinely changed the pace came after July. In May the Foundation created the Ecosystem Security Team, added engineers in July and September responsible for triage and hardening, and brought in Anthropic Claude Mythos for scanning along with OpenAI Daybreak Red for validating reports and exploits. On July 30 the security firm Calif began auditing PHP. On August 11 researcher Ryan A reported an unconditional remote code execution with the same root cause as the OOM issue found back in 2024. OpenAI independently reported the same root cause the same day, Wiz supplied another attack path on August 24, and OpenAI added further vectors on September 18.
OpenAI states that, to its knowledge, frontier models found these vulnerabilities before attackers did, which means a defenders window existed in which maintainers and suppliers could prepare. It calls this one of the most impactful security issues in recent memory and committed 1 billion dollars in subsidised Daybreak access through Daybreak for Frontline Defenders, aimed at organisations with limited security resources protecting essential services (OpenAI official announcement: https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/).
Then the window shattered. According to the Foundations account: at around 15:00 UTC on Tuesday October 20, the two CVE identifiers began circulating on forums and social media, carrying an incorrect release time and an incorrect CVSS score of 10.0 (the real score is 9.2), though no technical details leaked. The project moved its pre-announcement up and published at 19:30 UTC, pulling the release forward from 22 October 14:00 UTC to 21 October 14:00 UTC. At roughly 20:00 UTC Calif, one of the firms that reported the issues, mistakenly published a video demonstrating its proof of concept, and copies spread quickly. Around 23:00 UTC that evening, mitigation advice the Foundation had sent to critical infrastructure providers appears to have leaked as well, though at release time the team had identified no working exploit.
The final blow landed at 07:41 UTC on the 21st, when Chainguard unilaterally broke the embargo and published built images containing the fix more than six hours early. While other PHP users were still waiting for the release, attackers could already study the patch in binary form.
Cloudflare speed is worth noting: its WAF protections were deployed from early October, roughly nine hours ahead of public disclosure, and from 03:02 UTC on the 21st both free and paid customers were protected by default. Cloudflare says it observed attack traffic targeting its customers, with attackers mutating payloads to slip past the rules. To deliver this it built full transaction detection, a new WAF capability that evaluates request and response signals inside the same HTTP transaction, and php2shell is among its first managed detections.
The framework is the more important story
What OpenAI actually wants to push is not any single vulnerability but a response framework built for the AI era: validate and fix upstream, including adversarial testing with frontier models to hunt for bypasses and variants; give affected organisations time to prepare; coordinate with government partners; get downstream products ready; publish guidance once the patch is available. For PHP, OpenAI says its teams engaged multiple parts of the US government, including the White House Super Intelligence Force, the Office of the National Cyber Director and CISA. Alongside the framework it offers Codex for OSS subscriptions for maintainers and platinum sponsorship of the Rust Foundation.
Three things worth remembering
The Foundation says that since July 1 the security team has published 15 CVEs while working through more than 100 reports judged invalid or irreproducible. AI helps validate reports and group entries sharing a root cause, but every judgement and every patch is still made by people.
The second point is more practical. If your site runs on a managed service, Cloudflare advises asking the provider to apply the patch rather than trying to solve it in the application layer. WAF protection is one layer of defence in depth and does not replace upgrading. Solidot relayed a judgement from security firm Sansec that mass exploitation could appear within 15 minutes of the patch, putting roughly 1.3 million networked hosts at risk. These are third-party forecasts rather than established facts, but they are useful as a timeline reference.
Third, every failure in this process pointed in the same direction. The CVE identifiers leaked nearly 24 hours before formal disclosure, the demonstration video went out inside the embargo window, and a distribution broke embargo to let its own users update first. Most of these motives were not malicious; a distributor is simply afraid its own users will be left waiting. But as soon as one element runs early, the speed advantage no longer buys back the time.