Artificial intelligence has uncovered two critical vulnerabilities in PHP, the programming language powering about 70 percent of websites worldwide, prompting emergency patches and urgent government warnings.
The flaws, dubbed PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, both score 9.2 out of 10 on the CVSS severity scale. They allow remote code execution without authentication, enabling attackers to steal passwords, tokens and API keys from server memory.
Administrators of the PHP programming language released emergency patches on October 21. The patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, El Fondo reported. Sites running PHP 8.1 or older, which are no longer supported, are urged to upgrade immediately.
The vulnerabilities are memory-safety bugs in PHP’s core engine, not in specific applications like WordPress, Drupal or Joomla, but researchers demonstrated successful attacks against all three platforms. Affected versions date back to PHP 5.4, meaning the flaws remained hidden for more than a decade.
Both vulnerabilities were discovered using AI. Researcher Ryan Austin of cybersecurity firm Calif identified the first vulnerability in August during a code audit funded by OpenAI under its Patch the Planet initiative, using OpenAI’s frontier model GPT-5.6 Sol, The Wall Street Journal reported.
Weeks later, Google-owned security team Wiz independently found the same flaw and a second one using its Wiz Atlas agent, Gemini 4 Argon and GPT-5.6 Sol. Wiz said that while finding and weaponizing such exploit chains previously required months from an elite team, a single researcher using advanced AI models achieved it in one week.
The discovery has triggered an unprecedented response. The U.S. National Security Agency advised organisations unable to patch immediately to disconnect from the internet, while the government of Finland and the Dutch House of Representatives temporarily took their websites down.
The NSA has warned that any site unable to update immediately should be taken offline until it can be secured. Cybersecurity agencies across the United States, United Kingdom, Canada, Australia and the European Union issued urgent warnings to patch systems immediately.
Wiz estimates PHP powers roughly 70 percent of websites worldwide. Livemint cited an estimate that over 1.3 million websites were left exposed, and Cloudflare confirmed it had already detected early exploitation attempts.
OpenAI stated that identifying the flaws early gave defenders time to prepare protections before malicious actors could find them. The company noted that these findings will not be an isolated event, stating that the discovery adds to several significant vulnerabilities it is working to resolve as AI-assisted code analysis expands.
Wiz cautioned that AI has removed the barrier that once made these flaws hard to exploit, as large language models can adapt attacks to different PHP versions and configurations, setting up a race to patch millions of sites.
