Two critical security flaws in PHP, the programming language quietly powering much of the internet, were disclosed this week. Patches were released on Wednesday, but researchers warn attackers may move faster than website owners can update.
PHP runs roughly 70 percent of websites whose server-side language is known, according to web technology surveys, and it sits underneath platforms like WordPress, Drupal and Magento. One internet scanner counted about 3.8 million live sites running PHP.
How AI cracked a twenty year old secret
The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 out of 10 for severity, have been present in every PHP version since PHP 5, released in 2004. Turning such an obscure weakness into a working attack once took an exceptionally complex chain of steps, but powerful AI models have made that far easier.
The flaws were found independently by two teams using artificial intelligence. OpenAI said a security group called Calif found one flaw with a model called GPT-5.6 Sol, while Google-owned security firm Wiz reported similar AI-assisted findings. Both followed responsible disclosure, working with the PHP maintainers on patches before going public, and according to the researchers no attacks in the wild were reported before disclosure.
Patch now, or pull the plug
The advice from security agencies is unusually blunt. The US National Security Agency said organizations that cannot patch immediately should take their systems offline until they can, and the UK’s cyber security center issued similar guidance. The flaws allow unauthenticated remote code execution, meaning an attacker could read sensitive process memory, including passwords, API keys and certificates, or run their own code on the server.
Some organizations moved before the fixes landed. According to reports, multiple Finnish government sites, some French government websites and the Port of Rotterdam’s website went offline as a precaution, while a major infrastructure provider said it was seeing early attack attempts before the details were published.
Website owners should check which PHP version their server runs and update to the fixed release. Only PHP 8.2 and newer are still supported, with 8.5.12 as the current version; sites on PHP 8.1 or older have no official fix and must upgrade. Customers of managed hosts should ask their provider when the patched version will be deployed.
The episode also warns how powerful AI models have changed both sides of the security game. The same technology that found and helped fix a flaw before attackers could exploit it now lets a determined hacker adapt an attack to different PHP versions and server configurations. A compromised website can become a launchpad for further attacks, the same way researchers recently showed online ads can sneak spyware onto phones.
