AI Helps Uncover Critical PHP Security Flaws

Two critical security vulnerabilities in PHP triggered a global cybersecurity response on Wednesday, October 21, 2026, as government agencies and other organizations temporarily took some websites offline while security updates were installed.

PHP is widely used to power websites and web applications. The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute code remotely on affected, unpatched servers without authentication.

Security researchers said the flaws had remained undetected for years. PHP maintainers released emergency fixes on Wednesday and urged users to update their systems promptly.

Artificial intelligence played a significant role in identifying the weaknesses. OpenAI said researchers at cybersecurity firm Calif discovered one flaw while working with its AI tools. Google-owned security company Wiz independently identified another vulnerability using AI-assisted tools.

AI can help researchers analyze complex code, identify unusual behavior and test whether a suspected weakness can be exploited. However, the same capabilities could also help malicious actors develop attacks, making rapid patching and coordinated security responses essential.

Several organizations temporarily disabled websites and online services as a precaution while applying fixes. A temporary shutdown does not necessarily mean a website was breached or that data was stolen.

Security experts advise website operators to identify every system running PHP, install the appropriate patched version and review older systems that no longer receive security updates. Organizations unable to secure affected systems immediately should assess the risk and consider isolating them from the internet.

The incident highlights both the defensive potential of AI in cybersecurity and the importance of keeping widely used software up to date.