Critical AI-Discovered PHP Flaws Trigger Global Security Scramble

Image: Collected

Governments, cybersecurity agencies and website operators worldwide rushed this week to patch two critical vulnerabilities in PHP, the widely used programming language that powers a large share of the internet, including WordPress sites. The flaws, collectively called “PHP2Shell,” could allow attackers to run malicious code on vulnerable servers without logging in.

The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Both are remote code execution flaws rated 9.2 out of 10 on the CVSS v4.0 severity scale, and security firms have already observed attempted exploitation online.

Emergency patches released

The PHP Foundation released emergency fixes on Wednesday, October 21, after details of the vulnerabilities leaked before the planned disclosure date. The patches affect PHP versions 8.2 through 8.5, and officials urged administrators to update immediately.

The US Cybersecurity and Infrastructure Security Agency, the FBI and the National Security Agency warned organizations to apply the updates without delay. The NSA said the flaws can give attackers “a direct path to the server’s file system or database,” and advised taking systems offline if patching was not immediately possible.

Exploit attempts surge

Amazon said its threat-intelligence systems detected exploitation attempts as early as October 17, four days before the official patch release. Cloudflare reported thousands of exploit attempts in the 10 hours before public disclosure, followed by hundreds of thousands within two hours of the announcement and millions by the following night.

Cloudflare said it deployed web application firewall protections ahead of the disclosure after the vulnerability information leaked online. The company said the attacks targeted customers across its global network.

The PHP Foundation said it was not aware of any confirmed successful remote code execution, but stressed that updating affected systems was “imperative.”

The vulnerabilities were discovered with the help of artificial intelligence. Security firm Wiz said its researchers used frontier AI models while investigating a WordPress exploit, leading them to identify a PHP flaw that had remained undetected for more than a decade.

Separately, cybersecurity company Calif, working with OpenAI, identified a related flaw using OpenAI’s cybersecurity-focused AI model. Researchers from Calif, OpenAI, Wiz and Quarkslab then coordinated with the PHP project on a fix.

Security researchers said the episode shows how AI can dramatically lower the technical barrier to finding and developing exploits. Unit 42 researchers also reported observing attackers using agentic AI platforms for post-exploitation activity.

Websites disrupted during response

The emergency response caused temporary disruptions for some public websites. Government sites in Britain, Finland and Japan experienced outages or reduced service while administrators applied patches. In New York, Broome County took its website offline as a precaution.

Security experts described the episode as one of the most significant web-security events in recent memory. Former CISA Director Chris Krebs urged smaller organizations to scan for vulnerabilities continuously and apply security patches as quickly as possible.

Most of the responsibility for patching lies with hosting providers, website administrators and software companies. However, ordinary internet users can reduce their risk by enabling automatic updates on phones, computers and home routers, using multi-factor authentication, and avoiding reused passwords.

Experts also advised users to be cautious about emails or messages claiming their accounts were compromised, since attackers often exploit major security incidents to launch phishing campaigns.

For organizations running PHP-based websites, the immediate priority is clear: update PHP, restart affected web services, and review server logs for signs of exploitation.