AI Found Two Decade-Old PHP Flaws. Here Is Why Every Site Owner Should Patch Now
Two critical PHP bugs found with AI models triggered urgent patching and site shutdowns worldwide. What happened, what is confirmed, and what to do.
This week showed what happens when AI gets good at reading old code. Two critical flaws, hidden in PHP for more than a decade, were found with AI models and disclosed on 21 October 2026. Some sites went dark as operators scrambled to patch. If you run anything on PHP, including WordPress, this is a practical alert.
What was found
The PHP advisory, as summarised by The Next Web, covers two memory-safety bugs, CVE-2026-109618 and CVE-2026-109619, each scored 9.2 on the CVSS v4 scale. They let an unauthenticated attacker run code on servers running PHP. Risk is reported to be highest on Apache with modphp.
CVSS is a standard 0-to-10 severity score for security flaws, and 9.2 is in the "critical" band. Memory-safety bug means the code reads or writes memory it should not, like a postal worker putting a letter in the wrong house, which an attacker can sometimes steer to run their own instructions.
Who found them, and how
Security firm Calif found the first bug in August using OpenAI's GPT-5.6 Sol, during an audit of PHP's source funded through OpenAI's Patch the Planet initiative. Google's Wiz said it independently found the flaws using its Wiz Atlas agent with Gemini 4 Argon and GPT-5.6 Sol. PHP's advisory credits Calif, Wiz and OpenAI. Calif said it used generally available models, and that knowing PHP's history mattered more than the model.
The timeline and the messy parts
Patches were planned for 21 October. The Next Web, citing the Wall Street Journal, says details leaked in a Hacker News post and the release was brought forward, and that a proof-of-concept circulated. TechCrunch, by contrast, describes coordinated disclosure with no reports of exploitation in the wild. These accounts differ, and we cannot say which is complete. Cloudflare says it enabled protective web-application-firewall rules for all customers about nine hours before disclosure and watched attackers adjust their payloads.
Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with backported fixes published for the unsupported 7.4, 8.0 and 8.1 branches.
How big is the exposure?
You will see "70% of websites" in headlines. According to The Next Web, that is Wiz's estimate of PHP's usage share, not a count of vulnerable sites. Another digest cites Censys counting about 1.5 million unpatched hosts out of 2.6 million, but we could not verify that figure from a primary source, so treat it as unconfirmed.
Responses were strong. The NSA, CERT-EU and the UK's NCSC advised taking systems offline if they cannot be patched immediately. Several sites took parts of their services down. WordPress says the flaw is not WordPress-specific: site owners must patch the server with their host.
What this signals
OpenAI expects similar findings to increase sharply in the coming months, according to the report. The lesson for builders is that old, rarely-audited code is now cheap to examine, for defenders and attackers alike. Wiz warned that language models can help adapt exploits to different configurations, which removes a barrier that used to protect obscure flaws.
What to do today
Update PHP to a fixed release or ask your host to. If you cannot patch immediately, follow the NSA advice and take the site offline until you can. Check that unsupported versions (8.1 and older) are replaced, not just patched. Do not rely on configuration tweaks, which PHP says are no substitute for updating.
Key takeaways
- Two critical PHP flaws (CVSS 9.2) found with AI models were disclosed on 21 October; fixed versions exist.
- "70% of websites" is PHP's usage share, not the number of vulnerable sites.
- AI is shortening the time between a bug being findable and exploitable, so patch speed matters more.
Sources
- [The Next Web: PHP rushes out emergency patches for two critical bugs AI found first](https://thenextweb.com/news/php2shell-php-rce-ai-openai-wiz)
- [TechCrunch: PHP Armageddon, OpenAI and Google's Wiz find ancient holes](https://techcrunch.com/2026/10/21/php-armageddon-openai-googles-wiz-find-ancient-holes-panicking-the-internet)
- [Le Monde: Websites worldwide go dark as AI exposes security flaws](https://www.lemonde.fr/en/pixels/article/2026/10/21/websites-worldwide-go-dark-as-ai-exposes-critical-security-flaws676100513.html)
- [Dev.to AI Daily Digest, 24 Oct 2026 (secondary summary)](https://dev.to/hiroki-ii-ai/ai-daily-digest-october-24-2026-anthropic-opens-the-books-ai-finds-phps-oldest-bugs-europe-118c)
Tags: AI Security PHP Vulnerability Cybersecurity OpenAI