AI found them first: PHP patches two critical flaws – EU says go offline if needed
Two PHP bugs let attackers run code on servers without logging in. They were discovered with AI help, and authorities are urging site owners to update immediately.
Symbolic image · Photo: Ron23545 / Wikimedia Commons, CC BY-SA 4.0 (cropped and resized)
The developers of the PHP programming language released emergency updates on Wednesday for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Both memory-safety bugs are rated 9.2 on the CVSS v4 scale and allow an unauthenticated attacker to run malicious code on almost any PHP server. They are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with backported fixes for the unsupported 7.4 to 8.1 branches. Security firm Wiz estimates PHP runs around 70% of all websites.
The first bug was found in August by the firm Calif using OpenAI's GPT-5.6 Sol, during an audit of PHP's source code funded by OpenAI's Patch the Planet programme. Wiz independently found the flaws weeks later, also with AI assistance, and compared them to Heartbleed and Log4Shell. OpenAI called it one of the most impactful security issues in recent memory and expects such findings to rise sharply in the coming months.
The EU cybersecurity team CERT-EU advised taking websites offline if they cannot be patched right away, as did Britain's NCSC; Australia's ACSC urged organisations to prepare to patch. Cloudflare switched on firewall rules for all customers hours before disclosure but called them a stopgap only. Wordfence warned that automatic WordPress updates will not apply the fix – the PHP installation on the server itself must be updated.