AI Finds Two Critical Flaws in PHP, Sending Most of the Web Scrambling to Patch

Two critical flaws in PHP, the software that runs about 70 percent of the world's websites, were made public on Wednesday, October 21, and website owners around the world rushed to install emergency fixes. PHP's developers released updated versions the same day and told every user to update immediately.

The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and researchers call them php2shell together. Both carry a severity score of 9.2 out of 10. PHP runs behind the scenes on servers for sites built on platforms such as WordPress, Drupal and Joomla.

What the flaws do

The flaws sit in how PHP handles errors when it processes web requests. If a request is too large and PHP runs out of memory, the software fails to release the memory it tried to use, Cloudflare explained in its own write-up. An attacker who manipulates the data in that memory can crash the process, read sensitive information held on the server, or run code of their own on the machine, all without logging in.

Wiz, the security firm owned by Google parent Alphabet, said it had shown working attacks against WordPress, Drupal and Joomla installations, and could read passwords and access credentials from a server's working memory. Palo Alto Networks unit Unit 42 counted more than 22.6 million internet-exposed systems that could be vulnerable. Not every PHP site can be exploited, because setups differ, but PHP's developers said all installations handling web requests are at risk.

AI found the flaws, and a leak sped up the clock

Security firm Calif found the first flaw using OpenAI's GPT-5.6 Sol model and reported it to PHP on August 11, 2026, according to Reuters. Wiz found the flaws independently and reported a second one on August 24, 2026, also using AI models. The fixes were being prepared under wraps until details leaked on the Hacker News forum on Tuesday, October 20, 2026. PHP's developers then moved the release up by a day, leaving site owners little time to get ready.

OpenAI called the flaws one of the most impactful security issues in recent memory, and said it worked with the White House Super Intelligence Force, the Office of the National Cyber Director and the Cybersecurity and Infrastructure Security Agency so that guidance reached the operators of critical services. The White House said on Wednesday that it was working to expedite the release of the fix and to protect American networks.

Governments pull sites offline rather than risk it

The NSA, the FBI and CISA urged organizations on Wednesday to patch at once, and to take systems offline if they could not be secured promptly. The NSA said flaws of this kind often give an attacker a direct path to a server's file system or database. Cyber agencies in the United Kingdom, Canada, Australia and the European Union issued similar warnings. The government of Finland and the Dutch House of Representatives disconnected sites from the internet on Wednesday while they updated.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Updating WordPress or another app does not update the PHP underneath it, so owners need the server package itself updated, or word from their hosting provider that it has been done. Cloudflare said it had put firewall rules in place to shield its customers. Threat watchers at watchTowr and Sophos said criminals were already discussing the flaws and testing for openings, though no successful attack had been confirmed by Wednesday afternoon.