AI Found a Critical Flaw in the Software Behind Much of the Web. Then the Internet Started Patching.

Two critical vulnerabilities in PHP, the language behind a huge share of the web, were uncovered with the help of frontier AI. When details leaked and emergency patches landed on October 21, governments and organisations around the world rushed to patch, and some took websites offline as a precaution. The incident may prove to be one of the clearest examples yet of how AI is changing cybersecurity, not by writing code, but by finding weaknesses humans struggled to exploit for years.

On October 21, 2026, the PHP project released emergency fixes for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, collectively nicknamed PHP2Shell.

Both affect PHP itself. Both carry a CVSS v4 score of 9.2. Based on those scores, CERT-EU says both could be exploited without authentication, and the PHP project says all installations that handle web requests are potentially at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

But the most unusual part of the story is how the flaws were found. AI helped.

The bugs had been hiding in PHP for years

PHP powers applications and content-management systems including WordPress, Drupal and MediaWiki. Wiz says a flaw in PHP's core engine affects roughly 70% of websites regardless of CMS. That figure describes PHP's overall footprint, not the number of confirmed vulnerable sites, but it explains why a bug in the runtime itself becomes a global concern.

The underlying problems are old. Wiz says the flaws had been present for decades, and that demonstrating their exploitability "required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve." According to Calif, an out-of-memory weakness in PHP was first found in 2020 and found again during a 2024 PHP audit. Because nobody had shown it could be exploited, it was not patched.

Frontier AI models changed that. They allowed researchers to analyse the weakness more deeply and eventually turn it into remote code execution.

Who found them

The discovery did not come from one company. Wiz, OpenAI and Calif each contributed, according to SecurityWeek's reporting. Calif and OpenAI independently reported the out-of-memory flaw on August 11, and OpenAI and Wiz later reported additional attack vectors.

The PHP Foundation says that from August 11 onward, fixing the problem became the top priority for its security team. The findings were kept private until patches could be developed and distributed across the ecosystem. That delay was deliberate: publishing technical details early would have handed attackers a blueprint.

The PHP Foundation also says AI has helped surface more PHP vulnerabilities than before, with 15 new CVEs published since July 1.

AI turned an obscure bug into a working exploit

The vulnerable code existed for years, and human researchers had examined parts of it. What changed was the ability to reason about extremely complex software behaviour and rapidly test whether an obscure weakness could become something exploitable.

That changes the economics of vulnerability research. Some bugs stayed effectively harmless because turning them into a reliable exploit took extraordinary expertise and time. AI can lower that barrier. A flaw that was theoretically interesting but practically difficult can suddenly become operational. That is good news when defenders find it first, and far more worrying when attackers do.

What could attackers do?

PHP2Shell is serious because of where the bugs sit. The PHP Foundation says both issues are in parts of PHP that nearly every request touches: memory management and error handling.

CVE-2026-109618 involves out-of-memory handling that can interrupt PHP while internal request data is only partly initialised, so request cleanup treats invalid data as valid. CVE-2026-109619 involves request state that survives after its memory has been freed, which a later request handled by the same worker can reuse.

Remote code execution was confirmed on Apache with mod_php. Datadog, which independently reproduced CVE-2026-109618, says a single unauthenticated request can trigger the attack before any application code runs, so application-level authentication cannot block it. The flaws can also be used to read sensitive process memory, which may contain credentials and API keys. Because the problem is in the PHP runtime rather than one CMS, the attack surface is unusually broad.

Then the internet started reacting

Cybersecurity agencies in Europe, Britain, Australia and Japan urged PHP users to update immediately or take websites offline until patches could be applied. The UK's National Cyber Security Centre told organisations to consider taking offline any system that could not be fixed straight away, and the US NSA gave similar advice. The EU institutions' own cybersecurity service, CERT-EU, published guidance.

Websites then began to go dark. Reports from CNBC and others describe precautionary shutdowns across Europe. Finland's state IT centre Valtori took public government web services offline, saying it had found no sign of exploitation. Several Dutch agencies took public sites down on guidance from the Netherlands' National Cyber Security Centre. German, Czech and other European bodies did the same.

A website being taken offline does not mean it was hacked. In most cases it was the safest option while administrators confirmed versions and installed patched releases.

The patch is out, but it is not the end of the problem

PHP released fixed versions on October 21.

PHP branch	Fixed version
PHP 8.5	8.5.12
PHP 8.4	8.4.27
PHP 8.3	8.3.36
PHP 8.2	8.2.35
PHP 8.1 and older	End of life, no normal upstream fix

That last row is a major problem. PHP no longer supports 8.1 and earlier, and Datadog says those versions are also vulnerable. The PHP security team released minimal source backports for PHP 7.4, 8.0 and 8.1 for people who build from source or lack an LTS vendor, and some distributions offer their own backported fixes. But for organisations running old, unmaintained or embedded installations, remediation may mean upgrading applications, replacing incompatible plugins or migrating servers. That is much harder than pressing an update button.

There is also no shortcut. Datadog says only patching fixes the vulnerabilities, and that mitigations circulating in the community, such as disabling session upload progress, do not protect you. Cloudflare says it deployed WAF rules for the known exploit vectors, but the PHP Foundation notes that measures like these reduce exposure to specific attack paths without making an installation safe.

The flaws are also not confined to PHP itself. Help Net Security reports that Palo Alto Networks has confirmed all versions of PAN-OS and Panorama are affected, with no fixed releases shipped yet, while Fortinet and Cisco are still checking their products.

The details leaked before the patch

The disclosure did not go to plan. The flaws were scheduled for coordinated disclosure on October 22, but information leaked online on October 20, and the PHP Foundation moved the patches forward by a day. It also says a video demonstrating a working proof of concept was mistakenly published ahead of schedule, and that a security vendor published built images containing the fix six hours before the coordinated release, letting anyone study the fix in binary form.

Exploitation followed quickly. WatchTowr, Hadrian, Patchstack, Cloudflare and others reported exploitation attempts around the time of the patch, and Hadrian said it was seeing attacks at scale. Amazon Threat Intelligence recorded an attempt on one of its honeypots on October 17, four days before public disclosure, from an anonymised address. How an attacker obtained exploit details while the flaws were under embargo is still unknown.

That is why security teams are advised to look for signs of compromise, not just patch. Updating PHP closes the hole, but it would not remove an attacker who got in beforehand. Datadog advises checking for large form submissions, memory-exhaustion errors during request initialisation and unexpected shell processes.

AI security cuts both ways

The incident may ultimately be remembered less for the bugs than for how they were found. AI gave defenders an advantage. The period between discovery in August and disclosure in October let maintainers and infrastructure providers build patches and protections before the public knew.

That is the optimistic reading. The darker one is that the same AI able to analyse millions of lines of open-source code for defenders can do the same for attackers.

Traditional vulnerability research demands deep knowledge of memory management, compilers, operating systems and network protocols. Frontier AI does not remove that need, but it can multiply it. An experienced researcher can have an AI agent inspect enormous parts of a codebase, reason about edge cases, generate tests and refine proof-of-concept exploits. One researcher begins to resemble a larger security team. That is extremely powerful, and potentially dangerous.

There may be many more bugs like this

PHP is not uniquely insecure. Modern computing sits on decades of software: operating systems, databases, web servers, compression libraries, networking tools, programming languages and open-source dependencies buried inside thousands of products. Much of it predates today's AI-assisted security tools.

That raises an uncomfortable possibility. Similar flaws may already exist across the internet's infrastructure, surviving not because they are impossible to exploit but because nobody had the time to understand them. AI weakens that constraint, and the next few years could see AI revealing accumulated weaknesses faster than maintainers are used to fixing them.

Patching timelines will have to shrink

Enterprise patching often runs on comfortable timelines: publish, assess, test, schedule, deploy. PHP2Shell shows how that can collapse. Exploitation attempts appeared before the patch even landed.

Organisations increasingly need automated asset inventories, continuous vulnerability scanning, rapid patch deployment, real-time attack detection and much tighter control over unsupported software. The gap between discovery and exploitation may soon be measured in hours.

The paradox

AI caused the alarm. AI also helped prevent something worse. An undiscovered vulnerability is not a nonexistent one, and someone else could eventually find it without telling the PHP Foundation.

In this case, researchers found the bugs, reported them privately, coordinated fixes and gave defenders a path to protect themselves, even though the disclosure itself leaked. The ideal outcome is not stopping AI from finding dangerous vulnerabilities. It is making sure defenders consistently find them first.