Internet on Alert as AI Uncovers Critical Flaws in PHP Used by 70% of Websites

retained text

October is revealing cybersecurity chaos, for real. In 24 hours, three major security incidents emerged: eMudhra’s compromised certificate private keys, the State Bank of India’s customer data breach, and AI-assisted discovery of two critical vulnerabilities in PHP, the programming language used by roughly 70% of websites.
Calif, a security research firm working with OpenAI, first reported the PHP vulnerability to the language’s maintainers in August.
The researchers used OpenAI’s GPT-5.6 Sol model to identify the flaw. Later that month, Cybersecurity firm Wiz independently discovered additional vulnerabilities using AI models from Google and OpenAI.
“Wiz Research uncovered multiple critical vulnerabilities in core PHP, a popular general-purpose scripting language that powers 70% of all websites in the world,” Wiz said in a blog post. “Successful exploitation could allow attackers to take control of affected servers, steal sensitive data, and deface the websites running on them.”
The vulnerabilities have been assigned a severity score of 9.2 out of 10, placing them in the critical category.
According to Wiz, the vulnerabilities affect PHP releases dating back to version 5.4.
The PHP project’s advisory confirms that multiple PHP configurations are at risk, including PHP-FPM, Apache’s mod_php, php-cgi, FrankenPHP and LiteSpeed.
The incident raised concerns about the security of software that runs much of the internet and how AI tools can find and exploit security flaws that researchers have struggled to uncover.
The PHP development team released fixes on October 21 and urged users to update immediately.
According to Don Smith, VP of Threat Intelligence at Sophos Counter Threat Unit, the primary challenge is identifying and managing every instance of PHP across public websites, content management systems, hosting platforms, and third-party tools, where it may operate undetected, rather than merely applying a patch.
Cloudflare CEO Matthew Prince said the company detected thousands of attempts to exploit the PHP2Shell vulnerabilities in the 10 hours before their public disclosure. “That jumped to tens of thousands in the 45 minutes post-announcement, hundreds of thousands within 2 hours, and millions now,” he wrote on X.
The US National Security Agency and cybersecurity agencies in other countries urged operators to patch affected systems or take vulnerable websites offline until they could be secured.
“It is essential for all to prioritise incorporating vendor patches that may be explicitly tied to the PHP2Shell issues,” the NSA said in a statement, calling for heightened awareness of internet-facing devices and services that rely on PHP.
“All users should immediately conduct an inventory, where feasible, of hardware/software services reliant on now-vulnerable PHP versions,” it added.
Sriram Krishnan, former Senior Policy Advisor for Artificial Intelligence at the White House, said the PHP disclosure could signal what is to come, with AI models helping uncover long-hidden software vulnerabilities.
“The entire software supply chain will need the muscles to rapidly build and deploy fixes,” he wrote on X.
Why does PHP matter to the internet?
PHP is a server-side programming language. When someone visits a website, the server can use PHP to process a request, retrieve information from a database and generate the page that appears in the visitor's browser.
The language powers widely used content management systems and web applications, including WordPress, Drupal and Joomla. It also powers MediaWiki, the software behind Wikipedia, as well as countless business websites, online services, and legacy applications.
PHP’s widespread adoption makes vulnerabilities in its core engine particularly hard to contain. A flaw in an individual website can often be addressed by its developer. A flaw in PHP itself requires action from the maintainers, hosting providers, software distributors and organisations running affected systems.
What are the two vulnerabilities?
The vulnerabilities involve how PHP handles memory and internal state while processing requests. Security researchers have grouped them under the name PHP2Shell.
The first vulnerability, CVE-2026-109618, involves a flaw in how PHP handles errors when it runs out of memory. In certain situations, PHP may start cleaning up a request before it has fully set up all necessary data. This can cause it to process incomplete or invalid data, potentially creating a security risk.
The second vulnerability, CVE-2026-109619, involves PHP retaining outdated information in its memory. When a request ends, PHP should clear the associated data. However, under certain conditions, references to that data can remain, allowing a later operation to access memory that has already been released.
Both problems can lead to unsafe memory operations and, under the attack conditions demonstrated, remote code execution.
The distinction matters because these are not conventional website vulnerabilities caused by a weak password or an exposed login page. They involve how the programming language itself manages its internal operations.
The PHP advisory identifies the highest risk in certain configurations, particularly Apache’s mod_php, where researchers demonstrated an exploit that could be triggered by an unauthenticated request before application code runs. The precise exposure of other configurations depends on how PHP is deployed.
“One thing organisations must keep in mind with PHP2Shell is that because this flaw triggers inside the core PHP engine before any application code executes, traditional application-level safeguards won't stop it,” says Niv Lanyado, JFrog Security Research team.
“Organisations cannot rely on code-level workarounds; automated visibility across all environments – especially identifying legacy or end-of-life PHP installations that won’t receive vendor binary updates – is essential to ensuring every endpoint is patched or isolated immediately,” he adds.
Why are websites being taken offline?
The immediate concern is that attackers could exploit vulnerable servers before operators can apply fixes.
Government websites in the United Kingdom, Netherlands, France, Denmark and Finland had been taken offline as organisations responded to the disclosure.
These shutdowns were precautionary measures intended to reduce exposure while administrators assessed and patched their systems. They do not prove that all affected websites were breached.
India’s Computer Emergency Response Team (CERT-In) rated the PHP vulnerabilities as critical, warning of a “high risk of remote code execution and complete system compromise”.
Japanese Prime Minister Sanae Takaichi personally took to X to issue an urgent warning about two critical PHP vulnerabilities, urging website operators to prepare to install the security patches and consider temporarily taking their websites offline if they could not patch them in time.
The PHP project released patched versions on October 21. Administrators should move to the fixed release corresponding to their supported version branch.
For organisations unable to patch immediately, cybersecurity guidance recommends assessing exposure and considering taking affected internet-facing systems offline until remediation is possible. Updating to a fixed version remains the primary solution.
What does this mean for AI and cybersecurity?
The PHP incident illustrates a growing tension in cybersecurity. While AI can help defenders identify flaws faster, it can also help attackers turn those findings into working exploits.
Smith noted that threat actors move quickly—especially with the assistance of AI—making this a likely priority target in the coming hours and days.
Consequently, he emphasised that organizations must monitor PHP and web-server processes for unusual activity, command execution, or other indications that an attacker may have already established a foothold.
OpenAI said it believes frontier AI tools found the vulnerabilities before attackers did, giving maintainers and security providers time to prepare fixes. The company described this period as a ‘Defender's Window’, when defenders can respond before technical details become widely available.
However, that window can close quickly. Once a vulnerability and its patch become public, attackers can study the changes to understand what went wrong and attempt to reproduce the exploit. AI tools could accelerate that process, particularly when the software is widely deployed and many systems remain unpatched.

document fetched 2026-10-24 11:25