AI Finds Critical PHP Bugs, Triggering Global Cybersecurity Rush

Security firms Calif and Wiz, using advanced AI models, uncovered two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, in the PHP programming language which powers approximately 70% of the world's websites[1][15][16]. These flaws, rated with high severity scores of 9.2 to 10.0, enable attackers to execute malicious code remotely without authentication[1][6]. The discovery prompted a global cybersecurity alert and a rapid push for patches, especially after Amazon Threat Intelligence detected exploitation attempts four days before official fixes became available[3][4].

This incident shows how AI is reshaping vulnerability research, both by accelerating discovery and potentially increasing the speed of exploitation. The widespread use of PHP means these vulnerabilities could affect millions of websites, from government portals to e-commerce platforms, making swift patching essential for internet security[15][16][17].

AI-Driven Discovery

Calif and Wiz independently found the PHP2Shell vulnerabilities, attributing their findings to advanced Artificial Intelligence models[1][6]. In August 2026, Ryan Austin, a security researcher at Calif, used OpenAI's GPT-5.6 Sol model as part of OpenAI's "Patch the Planet" initiative to develop a pre-authentication RCE exploit chain from a theoretical Out-of-Memory (OOM) condition[7]. Simultaneously, Wiz reported both CVEs, employing AI-driven vulnerability research agents powered by Google Gemini and GPT models, along with their proprietary tool, Wiz Atlas[7]. These firms indicated that AI allowed researchers to complete work in hours that previously would have taken months[8].

Exploitation Before Patches

The public announcement of the PHP2Shell flaws occurred on October 20, 2026, with security patches released the next day, October 21, 2026[1]. However, Amazon Threat Intelligence reported identifying an exploitation attempt of the PHP2Shell vulnerabilities in their MadPot honeypot telemetry on October 17, 2026, four days before the official patches were available[3][9][10]. This attempt originated from an IP address linked to a commercial anonymization network, suggesting a threat actor was involved[9]. While researchers noted that not every observed attempt successfully compromised a real-world server, these early attempts indicated that details were circulating before the planned public disclosure[11][14]. Check Point Research estimated that 10% of organizations worldwide experienced exploitation attempts[14].

Global Response

The incident led to a "hectic 72-hour rush" among cybersecurity agencies globally[4]. Leaked vulnerability details contributed to a surge in exploitation attempts[2][4]. As a precaution, several government and company websites, including some in the Netherlands and Finland, were temporarily taken offline to apply updates[8][13][14]. The National Security Agency urged organizations using PHP to update their systems or take them offline if an update was not immediately possible[8].

Key Contributor in Rapid Fixes

Ondřej Surý, Director of DNS Engineering at the nonprofit Internet Systems Consortium, played a significant role in enabling rapid deployment of fixes[5][18]. Surý, who volunteers his time to build ready-to-use packages from PHP source code, quickly created packages for Debian and Ubuntu, including backported fixes, to help administrators update thousands of servers efficiently[18][19]. His repositories carried updated PHP versions and backports, making patches accessible for a wide range of systems[19].

What We Could Not Confirm

We could not confirm how the threat actor obtained exploit information prior to the official disclosure of the PHP2Shell vulnerabilities[9]. The extent to which these early exploitation attempts successfully compromised real-world servers before patches were widely applied also remains unconfirmed[11]. We also could not confirm the exact number of unique internet-facing PHP servers successfully patched versus those remaining vulnerable since disclosure[17].