AI-assisted research helped uncover critical PHP flaws; patches released
Two critical flaws in PHP, the server-side language used by nearly 70% of websites according to Cloudflare citing W3Techs, triggered emergency patching by governments and companies after disclosure on Oct. 21. The PHP team says CVE-2026-109618 and CVE-2026-109619 are rated 9.2 (CVSS 4.0) and could allow remote code execution without authentication on affected systems. PHP itself must be updated; changing a WordPress plugin or site code alone does not fix a vulnerable PHP runtime. OpenAI says a researcher at Calif found one flaw with GPT-5.6 Sol through its Patch the Planet initiative; security firm Wiz independently found both. PHP’s maintainers led the fixes. That is OpenAI’s account of AI’s role, not evidence that an AI system acted alone. The PHP project released fixes for 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Linux vendors may provide backported patches, so administrators should check their provider’s advisory, especially for older PHP releases. Cloudflare says it saw exploit traffic targeting customers during a pre-release leak, but that does not establish successful compromises. Canada’s Cyber Centre said it had not identified active exploitation when it issued its alert. The reports describe different observations; the scale of any successful attacks remains unclear. PHP administrators should patch the runtime promptly; a web application firewall is only an additional layer, not a replacement for the fix. [AP](https://apnews.com/article/php-websites-fbi-europe-vulnerability-a0af9576808a0963efca8df14d4b5183) reports government services were temporarily limited during remediation. [The PHP team’s advisory](https://www.php.net/archive/2026.php#2026-10-21-5), [OpenAI’s disclosure](https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/) and [Canada’s Cyber Centre alert](https://www.cyber.gc.ca/en/alerts-advisories/al26-026-critical-vulnerabilities-impacting-php-cve-2026-109618-cve-2026-109619) provide the patch details and current guidance.
Update — Oct. 22: Amazon Threat Intelligence says its MadPot honeypot recorded a PHP2Shell exploitation attempt on Oct. 17, four days before public disclosure. AWS later saw attempts from multiple anonymized networks and says the flaw became broadly exploited in the wild after patches were released. AWS cautions it cannot tell whether the observed attempts would have succeeded on real systems; its report does not confirm a successful victim. The earliest reported attempt predates public disclosure, so AWS advises defenders to investigate activity from at least Oct. 17, review logs and check for unexpected processes or file changes, as well as patch the PHP runtime. [AWS Security Blog](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-php2shell-exploitation-prior-to-public-disclosure-in-madpot/).