Science & Tech · Cybersecurity · 1 hr ago
AI-assisted research uncovers critical flaws in PHP, prompting website shutdowns
Researchers used AI to uncover two critical flaws in PHP, a programming language used by many websites.
The flaws could let attackers take control of web servers, disrupt services or access sensitive data.
Wiz estimates PHP runs about 70% of websites worldwide, so the weaknesses could affect a wide range of services.
The PHP Foundation released a patch, and the US National Security Agency urged organizations to update or disconnect vulnerable systems.
Some government and company websites went offline as organizations took precautions, including sites in France and the Netherlands.
The flaws were found in August and kept confidential while developers prepared a fix, but details appeared online before the patch was due.
AI helped researchers find and demonstrate the flaws faster, and website operators are being urged to install the patch.
Researchers used artificial intelligence tools to identify and verify two critical vulnerabilities in PHP, a programming language used widely across the web.
The flaws, known as PHP2Shell, could let attackers execute code on vulnerable servers and access sensitive information.
PHP maintainers released fixes on October 21 and urged operators to update their systems.
Several government websites in Australia and Europe went offline as organisations worked to reduce risks.
OpenAI and cybersecurity researchers said AI helped speed up the discovery and testing of the flaws.
- Who
- Researchers at OpenAI, Wiz and Calif identified the flaws, and PHP maintainers released fixes.
- What
- Two PHP vulnerabilities could allow attackers to run code on servers and access sensitive information.
- When
- The flaws were publicly disclosed and fixes released on October 21, 2026.
- Where
- The vulnerabilities affect PHP systems worldwide; government websites in Australia and Europe were among those taken offline.
- Why
- Organisations took websites offline as a precaution while they addressed the vulnerabilities.
This story does not have two clearly opposing sides.
A security audit identified a PHP flaw, but a fix was not agreed.
Calif reported a vulnerability to the PHP Foundation after researchers used OpenAI’s GPT-5.6 Sol to analyse PHP code.
OpenAI’s team independently found a more complete version of the flaw.
PHP maintainers released security updates, and the vulnerabilities were publicly disclosed.
Government websites in Australia and Europe went offline as organisations responded to the vulnerabilities.
- Vulnerabilities
- Two critical flaws, identified as CVE-2026-109618 and CVE-2026-109619
- Name
- PHP2Shell
- AI model
- GPT-5.6 Sol
- Australian sites
- Australian Cyber Security Centre and Australian Bureau of Statistics websites
- PHP versions
- Versions from PHP 5 onwards may be affected, according to Australia’s cyber security agency
12 sources
Critical web security flaws spark global alarm as Google, OpenAI and Amazon respond
[AI돋보기] 2년 묵은 PHP 보안 구멍…AI는 어떻게 뚫어냈나
Sitios web fuera de servicio en todo el mundo tras fallas de seguridad detectadas por IA
Major Australian government websites go offline after critical security flaws are uncovered using AI
OpenAI says GPT-5.6-Sol helped find the PHP flaws now shaking the internet
Kritik güvenlik açıklarının ardından gözler PHP güncellemesinde
AI helped find a critical security flaw affecting 70% of the internet
La IA detecta un fallo que pone en riesgo hasta al 70% de las páginas web del mundo
Lücke in PHP-Code: Vorsorgliche Sperre von Webseiten trifft Internetnutzer
Waarom de problemen bij PHP het halve internet lamleggen: ‘Dit is heel groot’
PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't
What people are saying
With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work,
The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,
If you run PHP, it is imperative that you update now.
Organisations and individuals should monitor PHP applications and prepare to update and apply patches,
Posts on X
🚨 Organizations should immediately patch critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. These vulnerabilities enable unauthenticated #RCE and affect PHP installations serving web requests. Learn more: 🔗 https://t.co/8vu6SvNzfB
Over the past two months, we have been leading a coalition to mitigate one of the most severe bugs in open source software found in recent memory, php2shell, found as part of our Patch the Planet initiative.
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or