AI Finds Two Decade-Old Bugs in PHP, Internet Briefly Remembers How Much of It Runs on PHP
Two critical flaws, found with AI help, sent emergency patches across the web and several government sites offline. Nobody had previously needed to learn what version they were running.
There is a particular silence that falls over an IT department when someone asks, “Wait, are we on PHP?” It is the silence of a hundred people simultaneously opening a spreadsheet they hoped never to see again.
On October 21, that silence went global. PHP released emergency fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0. According to The Neuron’s write-up, either could let an attacker run code remotely without logging in. One involves cleanup code touching data that was never fully initialized after an out-of-memory condition. The other is a use-after-free bug. Both sit in the core engine, which is the part of the website that is not the website’s fault.
The scale is the story. W3Techs figures cited by The Daily Record put PHP at roughly 75 percent of the websites whose language can be identified. Censys data showed about 1.5 million of 2.6 million hosts running a PHP version with no fix available. That is a very large number of servers about to learn what the phrase “end of life” means, in the same tone a doctor uses.
The practical effects were swift. Per The Daily Record’s reporting: in the Netherlands, offline sites included the National Cyber Security Centre, the Port of Rotterdam, the government portal Overheid.nl, the KNVB soccer association, the websites of the five largest political parties, and several hospital sites. Denmark’s Kombit shut several services. Finland’s Valtori took government public network services offline as a precaution. France’s Interior Ministry put all its websites into preventive maintenance. Wikipedia’s operator took down unspecified systems until they could be patched, and the Internet Archive briefly went offline.
Note the word “precaution.” This is the cybersecurity equivalent of unplugging the toaster because someone mentioned bread. It is also, per the FBI and NSA guidance reported by La Nación, exactly what operators were advised to do if they could not update immediately: take systems offline.
Here is where the AI comes in, and where the headlines mostly want to say something dramatic. Let us be precise instead.
Two security firms reported finding the bugs independently with AI help. Calif said it found them on August 1 using a large language model. Wiz said it used its autonomous AI research tool, Wiz Atlas, along with Google’s Gemini and OpenAI’s GPT-5.6 Sol. OpenAI said it led a coalition including Wiz and Cloudflare that worked on the issue for about two months, with PHP’s maintainers leading the fixes. The flaws, reportedly, had been in the codebase for more than a decade.
Read that again: more than a decade. For ten-plus years, humans with caffeine and expertise walked past these bugs. A machine with neither found them. This is not a slight on the humans. It is a reminder that “nobody has noticed” and “nothing is wrong” have never been the same sentence.
The Neuron adds an important wrinkle that is often lost: the PHP Foundation said maintainers had considered an out-of-memory issue in 2024 but had no demonstrated attack path, and proposed repairs risked breaking compatibility. So this was not a case of nobody caring. It was a case of people with limited staffing weighing a theoretical risk against a very real “you broke my site” email. We have all been there. Most of us just did not have 75 percent of the web as the blast radius.
Then the maintainers’ side of the ledger, which is the part that should make everyone put down their coffee. The PHP Foundation noted that since July 1 it has published 15 CVEs while handling more than 100 submissions that were invalid, duplicates, or not reproducible. That is the downside of a world where anyone with a model can generate a vulnerability report: the inbox fills with claims, and a small group of volunteers must determine which of them are real. The machines are now very good at asking questions. Humans still have to answer them.
And the timeline did not cooperate. The release was moved up a day after CVE identifiers circulated publicly, and a prematurely published demo video revealed more about exploitation than anyone intended. The Neuron also notes Amazon’s reported statement, via the Financial Times, that the flaws were being broadly exploited, including an attempt detected four days before disclosure, though it is unclear whether AI was involved. That caveat matters, and we are including it, because “unclear whether AI was involved” is a sentence that deserves to be read slowly.
What should you do? Patched versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If you are on PHP 8.1 or older, check whether your operating system vendor has backported the fixes, or upgrade. Because the flaw lives in PHP itself, WordPress, Drupal, and Joomla sites can be exposed even if their own code is spotless; plugin updates will not help. Automattic said WordPress.com and Tumblr were not affected, which is the sort of sentence that will be framed on a wall.
There is an upside, if you squint. Defenders got a head start: the vulnerabilities were found, coordinated, and patched through a process that involved the maintainers, rival AI labs, and security firms who presumably do not normally share a calendar. The Neuron summarizes the lesson as faster exploit development meeting a finite supply of maintainer hours. Both curves are rising. Only one of them has a lunch break.
For now, the advice from agencies in multiple countries is the same, and it is the simplest sentence in cybersecurity: find your PHP, and update it. It turns out that you can’t patch what you can’t locate. And for roughly a day, a considerable fraction of the internet discovered it could not locate it.
Sources: