AI discovers critical PHP flaw

The PHP Foundation disclosed two critical vulnerabilities named CVE-2026-109618 and CVE-2026-109619, collectively called php2shell. AI tools played a key role in finding them.

Seventy percent of internet at risk

PHP powers roughly 40% of all websites through WordPress and is used by Facebook, Wikipedia, Microsoft.com, and many others. Palo Alto Networks identified 22.6 million potentially vulnerable instances.

Attackers exploit within hours

As news broke on October 20, attackers immediately tried to exploit the flaw. Cloudflare saw tens of thousands of attempts within forty five minutes, hundreds of thousands within two hours, and millions by October 21.

Amazon reports widespread exploitation

Amazon Web Services reported on October 21 that the vulnerability is now being broadly exploited in the wild. The company saw attempts by hackers in the days before the official disclosure on October 20.

Governments take websites offline

Multiple governments decided to take websites offline as a safety precaution, including agencies in the Netherlands and Finland. The FBI, NSA, Japan's prime minister, and the EU's computer emergency response team all urged updates.

How the vulnerability works

The bugs allow attackers to remotely execute code on unpatched PHP systems. This serves as an entry point into networks hosting those machines, potentially enabling significant damage.

“can expose a large number of websites to immediate attacks if not patched in time”

Bug hidden for fourteen years

The vulnerability had been present in PHP for fourteen years. A limited version was discovered in 2024 but was not considered significant at the time.

Calif discovers first element

California-based AI red-teaming firm Calif, invited by OpenAI to join its Patch the Planet initiative, investigated PHP on August 1 using GPT-5.6 Sol and found the first issue.

OpenAI finds additional elements

OpenAI looked into Calif's discovery and found additional elements of the bug, making the discovery more comprehensive and revealing the flaw was more serious than originally realized.

Wiz independently discovers same flaw

Google-owned cybersecurity company Wiz independently found the vulnerabilities in August using Gemini 4 Argon, GPT-5.6 Sol, and Wiz Atlas. They investigated PHP because it is the backbone of the internet.

AI inflection point for security

Wiz said the vulnerable code had been there for more than a decade. What AI changed was the ability to understand the weaknesses and turn them into a working exploit.

“With 70% of the internet affected, the impact of php2shell cannot be overstated”

Coalition formed to coordinate response

OpenAI brought all parties together, leading a coalition of maintainers, researchers, and security providers including Wiz, Calif, PHP, Cloudflare, Quarkslab, and multiple U.S. government agencies.