AI found a decade-old flaw in PHP. Now what?

PHP is the language behind a large share of the web, including WordPress, Drupal, Joomla and Magento. The two flaws, CVE-2026-109618 and CVE-2026-109619, sit in PHP itself. The PHP project says they affect PHP installations serving web requests, whether through PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP or LiteSpeed. PHP used only from the command line is not in scope.

The bugs were found by AI-assisted research. Calif, a security firm, reported the first to PHP on 11 August and the second on 21 August, working with OpenAI's models. Wiz found them independently using its own tooling and AI models, and published its write-up under the headline that AI uncovered them. Whoever gets the credit, the finder was not a person reading code line by line.

Because the flaw is in PHP, updating WordPress or its plugins does not fix it. The PHP runtime has to be updated, and on most hosted sites that is the hosting provider's job.

PHP pre-announced the fixes on 20 October and released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October. Linux distributions and long-term support vendors received the patches in advance. The PHP project says there are no complete mitigations and that updating is the only safe choice.

The disclosure did not go to plan. Technical details leaked on social media on 20 October, before the fixes were out. Cloudflare said it put protective rules live about nine hours ahead of public disclosure and was seeing early attack attempts; its chief executive later said attempts had run into the millions. Those are attempts, not confirmed break-ins: researchers at watchTowr told The Record nobody had been successful so far, and did not expect that to last.

Organisations did not wait to find out. In the UK the Office for Budget Responsibility took its site offline “in view of the critical security issues affecting PHP”, and Oxfordshire County Council and Hillingdon Council took theirs down as a precaution. In the Netherlands the national cyber security centre took its own site offline, followed by others including Overheid.nl. Finland's government ICT centre, Valtori, took public network services offline, and France's Interior Ministry put all of its websites into preventive maintenance.

The UK's NCSC told organisations to apply the updates, and if they cannot, to consider taking the system offline until it can be fully mitigated.

AI is now good at finding bugs that people missed for years. That cuts both ways.

The good side: these flaws were found by researchers, reported privately and fixed in a coordinated way, with distributions patched before the public release.

The hard side: the same capability is available to attackers, and the gap between a bug being known and being used is shrinking. Here the details leaked before the fix, and attempts began within hours.

And the backlog is large. PHP 8.1 and older no longer receive releases from the PHP project. The project published source-level fixes for 7.4, 8.0 and 8.1, and some vendors offer patched builds, but there is no new official release for them. Many business sites still run on those versions, often without anyone in the business knowing.

You do not need a security team to act on this.

Know what you run. Most businesses could not say which version of PHP, or which plugins, sit behind their website or their internal tools. If you cannot list it, you cannot patch it. Ask your web host or developer today which PHP version your site runs and whether it has been updated.

Patch speed is a business decision. The NCSC's advice was to update, or consider going offline until you can. Decide now who in your business makes that call, who they ring at your host or agency, and how quickly, rather than working it out during the next one.

Less software, less risk. Every plugin, server and old system you keep is something an attacker, now helped by AI, can probe. Retiring what you no longer need is the cheapest security you will buy.

Our own websites and products, including this site, ReplyOS, ReplyBench, ReplyScore and VetReady, are built with Next.js and TypeScript and hosted on Vercel. None of them runs PHP, so PHP2Shell does not reach them. We checked our code anyway.

Not running PHP does not make anything invulnerable, and we do not claim it does. The same three lessons apply to the software we do run: we keep a list of what each product depends on, update it on a schedule, and remove what we no longer use.

The same kind of models that helped find PHP2Shell can review your code, list what your systems depend on and flag what is out of date or unsupported. That has usually been too expensive for a small business to do properly. It now takes days rather than months.

That is the kind of practical AI work we do: scoped, at a fixed price, and led by our founder from the first call to handover. If you are not sure what your website or internal tools run on, book a 20-minute call and we will help you find out.