AI-Assisted Discovery Reveals Critical PHP Vulnerabilities Impacting Up to 70% of Websites

Security researchers using advanced AI models uncovered two critical remote code execution vulnerabilities in the PHP programming language, collectively dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619). These flaws, present in PHP versions dating back to 5.4, affect the core engine and enable unauthenticated attackers to execute malicious code or leak memory on vulnerable servers, independent of the web application running on top.

The vulnerabilities were identified in August 2026 by Ryan Austin of Calif using OpenAI’s GPT-5.6 Sol as part of the 'Patch the Planet' project, with independent discovery by Wiz researchers employing Gemini 4 Argon, GPT-5.6 Sol, and Wiz Atlas. Prior to AI assistance, the memory-safety issues were considered too complex to exploit practically. Patches were developed in coordination with PHP maintainers, OpenAI, and Wiz, modifying substantial code before a planned October 22 disclosure.

Details leaked on Hacker News on October 20, prompting an accelerated release of fixes on October 21 for PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Exploitation attempts were observed shortly after announcement by entities including Cloudflare. The incident highlights AI’s dual role in accelerating vulnerability research while potentially enabling faster exploit development by adversaries. PHP powers a significant portion of the web, including popular platforms like WordPress, with mitigations available for unpatched older versions but full remediation requiring updates and worker restarts.

Broader implications include heightened urgency for coordinated disclosure frameworks and the shrinking window between discovery and potential widespread attacks in an AI-augmented threat landscape.