PHP Ships Patches for Two Unauthenticated RCEs as OpenAI Coordinates Multi-Vendor Disclosure
An unauthenticated request can execute code in the PHP engine before any application logic runs, making default PHP-FPM and mod_php installations the attack surface. The patches are out, the exploit chain is public, and real probing started before release; treat this as an immediate upgrade, not a routine backport.
Two engine-level use-after-free bugs let an unauthenticated request run code before any application code executes. php.net names every PHP SAPI serving web requests: PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, and LiteSpeed. mod_php is the worst case, with an official demonstration of a pre-application trigger. Tests on eleven PHP apps including WordPress, Drupal, Laravel, and Symfony confirmed pre-auth RCE, and the earliest vulnerable path reaches back to PHP 5.4.0's default configuration from 2012.
The patch race was tight. Exploit details leaked a day before release, Cloudflare observed real attacks six hours before release, and watchTowr confirmed RCE from the leaked material. The coordinated disclosure run by OpenAI's Patch the Planet effort brought in Wiz Research, Cloudflare, PHP maintainers, and government contacts; the Netherlands preemptively took several high-profile sites offline. For operators, the steps are: check FPM and mod_php versions separately, upgrade the relevant packages, restart the service, and if a distro package has not arrived, block multipart requests or disable upload-progress as a stopgap.
The 69.3% market-share figure describes PHP's reach as a server-side language, not the share of sites hit; conflating those two numbers is what made the damage sound universal.
The window between observed attacks and patch release was six hours; with details leaking a full day earlier, defenders who wait for distro packages instead of applying stopgaps are betting against the next timeline.
The AI-disclosure debate splits cleanly: human expertise selected targets and built the chain, and the model's real contribution was enumerating request-shape combinations that bypass two resource limits. Those are different claims about what AI can do.
An OOM issue that auditors flagged in 2024 was left unfixed because it was not proven exploitable. Proving it took a researcher with two decades of PHP memory-safety context, which makes 'not proven exploitable' a dangerous triage verdict.