PHP2Shell patches are out, and OpenAI's checker can't verify a backported fix

PHP patched two critical unauthenticated RCE flaws on Oct 21, and OpenAI released a version-based checker that can't verify backported fixes.

PHP shipped fixes on October 21, 2026 for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, each rated CVSS v4.0 9.2. Datadog Security Labs reproduced them and found that an unauthenticated POST hits the bug before any application code runs. Your app's auth won't help. If you run PHP anywhere, including inside a container image, patch first and read the vendor framing second.

According to Datadog and BleepingComputer, the fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP also published source backports for 7.4, 8.0 and 8.1. Every web runtime is in scope: mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Datadog cites AWS reports of exploit attempts as early as October 17, and says the config mitigations circulating, such as session.upload_progress.enabled=0, don't fully protect you.

OpenAI says it coordinated the patch with PHP maintainers after flaws were found using GPT-5.6 Sol, and released a checker. Wiz published its own analysis of the flaws, and TNW reports Wiz said it found them independently, weeks later, and that PHP's advisory credits Calif, Wiz and OpenAI together.

The checker is version-based. Run as node phpcheck.js "https://example.com", it reads the X-Powered-By and Server headers and returns UNKNOWN when they are missing or hidden; the phpcheck-server Codex skill checks a local installation when you have server access. The repo itself warns that OK only describes the advertised version and that headers can't show a backported fix. On a server you control, check the runtime that actually serves web requests, not just the CLI php -v, and restart every worker after updating.

Sources