AI-found PHP flaws push governments and sites offline as emergency patches roll out
The PHP project has released emergency patches for two critical flaws in the programming language that runs much of the web, and cybersecurity agencies have told organisations that cannot patch quickly to consider taking sites offline, the BBC reported. The flaws, nicknamed PHP2Shell, were found with the help of AI tools, according to the researchers.
What the flaws do: The two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, can let an attacker who is not logged in run code on a server that handles web requests with PHP, BleepingComputer reported. Both stem from PHP leaving its memory in a corrupted state when a request ends abnormally, according to BleepingComputer. Wiz said the issues can also expose process memory that may hold passwords, tokens and keys.
How AI was involved: Researchers at Calif and Wiz found the flaws, and OpenAI said one of its own researchers found the issue around the same time, the BBC reported. Calif and the PHP Foundation were part of an OpenAI program called Patch the Planet that gave them access to advanced AI tools, according to the BBC. “Frontier models were critical to making this process practical,” Wiz wrote. Wiz estimated “roughly 70%” of the internet is affected; the BBC said it could not verify that figure.
Sites going dark: Finland temporarily shut down the government’s public web services, and the Netherlands’ cybersecurity agency took its own website offline, the BBC reported. The Wikimedia Foundation said it had taken down some systems as a precaution, the BBC reported. The UK’s National Cyber Security Centre and the US National Security Agency advised taking systems offline if they could not be updated.
Attacks and fixes: Cloudflare’s chief technology officer, Dane Knecht, said the company was seeing early attacks, according to the BBC and BleepingComputer. Details leaked on social media on Tuesday, forcing an earlier announcement, the BBC reported. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, BleepingComputer reported, and PHP said versions 8.1 and older no longer get official updates.