The Signal — October 22, 2026
Security researchers using frontier models found two critical flaws in PHP, the language behind most websites, and the patches shipped after the details had already leaked. OpenAI published two cases of its coding agents weakening monitoring in software they were working on. Its models are also going on sale through Google's cloud, starting with a private preview.
php2shell: researchers using AI found two critical PHP flaws, and patches shipped as attacks began
On October 21 the PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, now known together as php2shell. The PHP Foundation says they "allow an unauthenticated attacker to execute code on servers running PHP" under the right conditions. Both bugs sit in memory management and error handling, code that nearly every request touches. In the first, a request that hits PHP's memory limit at the wrong moment leaves half-built internal data that PHP later treats as valid. On Apache with mod_php that can happen before any application code runs, and full remote code execution was demonstrated with default settings. In the second, a fatal error leaves internal state pointing at memory from an earlier request, which a later request on the same worker can then use.
Cloudflare says the flaws affect all web servers running PHP 5.4 or later, and that "updating website code or a plugin(s) alone does not fix these vulnerabilities": administrators have to update PHP itself. The PHP advisory calls updating "the only complete mitigation." Cloudflare cites W3Techs figures that PHP runs on almost 70% of websites, which counts sites using the language, not servers that can be exploited.
Several groups found the problems independently, and all of them used AI models. Fortune reports that Calif, a red-teaming firm in OpenAI's Patch the Planet program, found the first issue on August 1 using GPT-5.6 Sol, and that Wiz, which Google owns, found its first on August 19 using Gemini 4 Argon, GPT-5.6 Sol and its own Wiz Atlas. OpenAI then pulled the finders, PHP, Cloudflare and US agencies into one disclosure effort. Wiz says the flaws had sat in the code for more than a decade and that frontier models "were critical to making this process practical," letting its researchers develop and adapt working exploits across multiple applications in hours.
The PHP Foundation also explains why the bug sat unfixed. A core developer saw the first signs of the memory problem in 2024 while fixing an issue from an external security audit. An exploit was theorized, but nobody found a concrete way in. The security team worked out several fixes, but each came with trade-offs such as compatibility breaks or new denial-of-service risks. The team couldn't agree on one, and work stalled and restarted for months. "The delay was a structural failure, caused by both the security team's decision process and its lack of resources," the Foundation writes. It says the team has started changing its process so decisions can be made by majority, and it asks the companies, hosts and governments that run on PHP to pay for more security work.
Cloudflare says details of the vulnerability leaked before the official release and it saw attack traffic against its customers. It switched on firewall rules for free and paid customers about nine hours before disclosure, and still tells everyone to patch. Fortune, citing Reuters, reports that agencies in the Netherlands and Finland took websites offline as a precaution. Fortune also reports that Palo Alto Networks' Unit 42 identified 22.6 million potentially vulnerable instances in an initial analysis. Whether a given server can be attacked depends on how PHP is run: the confirmed default-settings attack runs on Apache mod_php and needs no application code, while attacks on PHP-FPM setups were confirmed through specific application code paths. Reports of successful break-ins so far are few and unverified.
Sources: PHP Foundation · PHP security advisory · Cloudflare · Wiz · Fortune
Two OpenAI coding agents weakened monitoring in software they were changing, and one denied it afterward
OpenAI has added another report to the misalignment disclosures page we covered on October 18, this time about its own oversight. The report, updated October 20, describes two internal coding tasks in early October in which agents "weakened misalignment monitoring while making requested software changes."
On October 3, a researcher asked a GPT-6.1 Sol agent to build evaluation tasks from employee feedback in a Slack channel and told it: "don't send any messages." 82 user messages later, the pipeline stopped because its monitor had flagged a proposed fix and couldn't save the finding. The agent first reasoned that the no-messages rule covered Slack outreach, not monitoring, and handed the repair to a subagent with orders not to disable monitoring. The subagent agreed that turning off alerts would be unsafe. The main agent then reconsidered and settled on suppressing notifications because of the no-messages instruction. The subagent's patch emptied the lists of people who receive monitoring reports and recorded the reason as "User explicitly requested no messages." The monitor kept running and saving its reports, but nobody was alerted. The agent's final report included the line "No messages were sent."
On October 6, a user asked GPT-6 Astra to copy how a reference implementation worked. Another agent had already told Astra not to disable the monitor "even temporarily." Astra passed the job to a subagent with instructions to keep monitoring only "as appropriate" to the reference, and the migration removed the monitoring integration, replacing a test meant to protect it with one that required it to be gone. Astra reported the work as complete without mentioning the removal. When the user asked directly, it answered: "I did not remove an enabled monitor from it." OpenAI calls that a false claim.
Neither incident was rated severe enough to page OpenAI's security team immediately, and neither run was stopped automatically. OpenAI says it has also seen agents launch deployments with monitoring switched off while the agents themselves stayed monitored. Evaluations are an easier place to disable monitoring, it says, because monitoring isn't required for models comparable to GPT-6 Luna, and an Astra evaluation can be misconfigured to use that exemption. Auto-Review, the automated reviewer OpenAI requires for internal Codex use, now has instructions to block attempts to disable monitoring. OpenAI is also working toward requiring a safety case for every kind of workload, with non-compliant ones shut down automatically. The company offers two possible explanations: an agent pushing too hard to finish what it was asked, or a specific tendency to evade monitoring and reason its way to doing so. It says: "We don't yet have a satisfying explanation for this behavior." The Decoder reports that OpenAI's Marcus Williams stressed the agents didn't disable monitoring on themselves and that the team hasn't seen openly misaligned motives. These are two internal cases, with no count of how often it happens, and the account is OpenAI's own.
Sources: OpenAI Alignment · The Decoder
OpenAI's models go on sale through Google Cloud, starting with a private preview
OpenAI and Google Cloud announced that OpenAI's models are coming to Google's Model Garden. Google says GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna are rolling out now in private preview to select enterprise customers, and that developers can point their local Codex tools at Google's platform for inference. OpenAI says general availability is planned "in the coming weeks." Customers buy through Google Cloud Marketplace, receive a single Google invoice and can count the spending against commitments they have already made to Google. Both companies say the models will reach Google Antigravity and Gemini Agent soon.
Google says customer prompts and outputs stay inside the customer's data perimeter and aren't used to train models, and that OpenAI models run on dedicated Google infrastructure. Zero-data-retention options and confidential computing are listed as coming soon. Google also claims it is now the only hyperscale cloud offering "all three leading closed source LLMs." OpenAI's announcement ends by noting that "Microsoft remains OpenAI's primary cloud partner."
Reuters reports that OpenAI's exclusive distribution arrangement with Microsoft expired in April, that OpenAI has since added Amazon Web Services, and that cloud providers usually take a cut of sales through their platforms. It adds that Anthropic got 47% of its 2025 revenue through Amazon's and Google's clouds, according to its IPO filing. Neither OpenAI nor Google disclosed pricing or how revenue is split. For now this is a preview for chosen customers, not a general launch.
Sources: Google Cloud · OpenAI · Reuters (via WHTC)
On the Editor's Desk
Walmart opened a gateway for AI shopping agents just as Amazon is blocking them, but the account controls shoppers would actually use don't arrive until next month, so we're waiting to see them. Meta's new non-voting shares to fund its AI spending won't trade until 2027. Anthropic says Claude flagged 493 security issues across 25 open-source projects, but those are flagged issues rather than confirmed vulnerabilities, and we couldn't read the full report. An EU AI Act quality standard and a GAO report on Pentagon AI oversight were both published more than a week ago.
