Threat assessment: critical. Window to act: now.
AI tools helped uncover a serious flaw in PHP, the scripting language that runs a huge share of the world’s websites. It set off a worldwide rush to patch, The Information reports. On October 21, the PHP Foundation shipped emergency fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which researchers have nicknamed “php2shell.”
This matters for a simple reason. AI is now finding the holes faster than defenders can close them.
🎯 Situation report
- What broke: Two bugs in PHP let attackers run their own code on servers that haven’t been patched. That’s remote code execution, the worst class of web flaw, because it hands an outsider control of the machine.
- Who found it: Coverage credits AI-assisted research for the discovery. Security firm Wiz also found and reported both bugs on its own. Wiz says frontier AI models let a single researcher find the flaw and adapt working exploits across different apps in a matter of hours.
- How far back it goes: Wiz Research says affected versions reach all the way back to PHP 5.4. That’s more than a decade of code.
- How big the blast radius is: Estimates say the flaw could touch as much as 70% of the web. Exact counts of exposed servers vary from outlet to outlet, so treat any precise number with caution for now.
- Government response: Agencies including the NSA have issued warnings. Their advice is blunt: if you can’t patch, think about taking your site offline until you can.
🧠 Why this one is different
Old bugs in widely used software aren’t new. Heartbleed and Log4Shell both sent the internet into a panic. What stands out here is how the bug was found.
Finding a flaw like this used to take a skilled team weeks or months of slow manual digging. Now one researcher with a strong model can go from spotting the bug to a working exploit in an afternoon. That’s great news when the person holding the model is a defender. It’s terrible news when it isn’t.
The frontier labs have seen this coming. Anthropic, OpenAI, and Google have all put money into AI-driven vulnerability research and set up coordinated disclosure processes for bugs their models find. php2shell may be the clearest public case yet of that work paying off at internet scale. It’s also the clearest warning.
⚠️ The uncomfortable math
Defenders and attackers can use the same models. Once a patch is public, attackers can compare the patched and unpatched code to see exactly what changed and work backward to an exploit. AI makes that step faster too.
That shrinks the safe window between disclosure and mass exploitation. Before, admins might get days or weeks. Now it may be hours.
🛠️ Orders for site owners and developers
- Upgrade PHP right away. The current release is PHP 8.5.12. PHP 8.1 and older no longer get support, so they won’t receive fixes.
- Check your hosting stack. Managed hosts will patch on their own schedule. Don’t assume yours already did, so confirm the version.
- Find your forgotten servers. Old staging sites, legacy WordPress installs, and side projects are the classic way in.
- Watch your logs. Look for odd requests and unexpected processes on PHP servers.
- If you can’t patch, go offline. That’s the NSA’s advice, and it isn’t overcautious.
🔭 What comes next
Expect more of this. As AI models get better at reading code, more old bugs will surface in the software everyone assumed was battle-tested. The fight is turning into a race of patching speed, and organizations that still take weeks to update are going to get burned.
The bigger question is about who’s in charge. If AI can find a flaw affecting most of the web in hours, the industry needs faster disclosure pipelines and broader auto-updating. It also needs a serious conversation about who gets access to the most capable security models first.
You can find more details in the original report from The Information.