# AI finds critical PHP flaws affecting 70% of websites

> OpenAI and Google's security teams discovered two severe vulnerabilities in PHP using AI models, forcing an emergency update and taking sites offline.
- Title: AI finds critical PHP flaws affecting 70% of websites
- Summary: OpenAI and Google's security teams discovered two severe vulnerabilities in PHP using AI models, forcing an emergency update and taking sites offline. PHP…
- Keywords: php, security vulnerability, cve-2026-109618, cve-2026-109619, openai, wiz, google, artificial intelligence, web security, technology, startups, finds
- Source: The Next Web — https://thenextweb.com/news/php2shell-php-rce-ai-openai-wiz
- Author: Ana Maria Constantin
- Published: 2026-10-21T15:25:13+00:00
- Read time: 1 min
- Topics: php, security vulnerability, cve-2026-109618, cve-2026-109619, openai, wiz, google, artificial intelligence, web security, technology, startups
## Two critical flaws in PHP
PHP released emergency patches on Wednesday for two memory-safety bugs tracked as CVE-2026-109618 and CVE-2026-109619, each rated nine point two on the CVSS v four scale.

> the only safe choice
## AI discovered the first flaw
Security firm Calif found the first vulnerability in August with help from OpenAI's GPT-5.6 Sol model during an audit of PHP's source code that OpenAI funded through its Patch the Planet initiative.
## Google's Wiz team found them independently
Google's Wiz team discovered the flaws weeks later using Wiz Atlas, Google's Gemini 4 Argon and GPT-5.6 Sol. PHP's advisory credits researchers from Calif, Wiz and OpenAI together.
## OpenAI and Calif disagree on what it means
OpenAI called this a Defender's Window and committed one billion dollars in subsidised access to its Daybreak cyber programme.

> No model is simply capable of unearthing 'all bugs' with simple prompts. At least for now.
## Websites went dark before the patch
The EU's CERT-EU, Britain's NCSC and the US National Security Agency all advised organisations to take systems offline. Pinboard, GrapheneOS forum, OBS and Laravel halted deployments before the fix was ready.
## The patch came early after leak
PHP brought forward its release after details leaked on Hacker News. Security firm watchTowr confirmed the bugs were real before any patch existed, and a proof-of-concept exploit then circulated online.
## Affects seventy percent of websites
Wiz estimates PHP runs roughly seventy percent of all websites.The flaws reach back to PHP five point four and later, more than a decade of releases.
## Key takeaway

PHP released emergency patches for two critical flaws found by AI that affect roughly seventy percent of all websites, forcing a global patching race.