# AI Found a Crack in the Internet’s Foundation > Source: > Published: 2026-10-21 22:02:10+00:00 ## A hidden flaw put shared web infrastructure on alert PHP, the server-side engine powering an estimated 70% of all websites, including many **WordPress** sites, recently revealed two critical vulnerabilities. When a flaw surfaces in shared infrastructure like PHP, it jeopardizes vast swathes of the Internet simultaneously, affecting millions of operators rather than isolated instances. These two critical memory-corruption vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, allow for **Remote Code Execution (RCE)**. Security teams rated them a severe 9.2 out of 10 on the CVSS v4.0 scale, indicating potential for an attacker to take control of a website’s server without authentication. This risk applies to servers running PHP, not a claim that every PHP site was compromised. OpenAI’s “Patch the Planet” initiative, involving firms like Calif and Wiz, uncovered these flaws, which had lain dormant for over a decade. Following an early leak, the PHP team accelerated the release of emergency patches on October 21st, pushing versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Governments and agencies responded with urgent advisories. The FBI’s Cyber Division, the NSA, and the UK’s **National Cyber Security Centre (NCSC)** recommended immediate patching or taking systems offline if updates were not feasible. Japan’s Prime Minister Sanae Takaichi personally urged action on X, and governments in the Netherlands, Finland, and France reportedly disconnected some services as a precaution. ## The weakest link may be a site nobody maintains Compromised smaller sites, like an old forum or a local booking system, pose a particular risk. These platforms often store personal data—names, addresses, emails, and even passwords—and a breach could expose this sensitive information. While no specific breaches from this flaw have been confirmed, the potential for exposure remains. The long-tail problem exacerbates this risk. While supported **PHP** branches received critical fixes, an estimated 46.1% of sites, based on a sample, may run on end-of-life PHP versions that will never receive patches. These unmaintained installations become permanent vulnerabilities, akin to leaving a back door unlocked indefinitely. Users can take practical steps to protect their data. Employ unique, strong passwords for every online account, ideally managed with a **password manager**. Enable multifactor authentication wherever available to add an extra layer of security. Remain vigilant for suspicious emails or messages that might attempt to exploit concerns about data breaches. If you have concerns about a specific website, contact its operator directly to inquire about their security measures and PHP updates. ## AI found the bug; the clock started ticking AI-assisted code analysis helped researchers uncover PHP’s subtle flaws. OpenAI’s "Patch the Planet" initiative, alongside independent work by security firms Wiz and Calif, identified two critical **Remote Code Execution (RCE)** vulnerabilities. Calif leveraged OpenAI’s GPT-5.6 Sol model, while Wiz used AI-assisted analysis to surface both bugs, which had lain dormant for over a decade. This earlier discovery offered a crucial defensive upside. It gave PHP maintainers, security researchers, and companies like OpenAI a two-month window to verify the flaws, coordinate disclosure, and prepare patches before public details spread. This controlled approach is standard practice, preventing attackers from exploiting known vulnerabilities before fixes are ready. However, the advance also highlights a dual-use risk. While AI accelerates defensive discovery, it equally empowers attackers to find weaknesses. The early leak of vulnerability details, followed by reports of rapid probing by threat actors, significantly narrowed the defenders' lead. For more on the coordinated response, see [Today's PHP Security Release, and How We're Strengthening PHP Security](https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/). These vulnerabilities, rated 9.2 out of 10 for severity, impact almost all major PHP releases over the last decade, including versions like 8.5.12, 8.4.27, and 8.3.36. The rapid patching effort underscores the urgency of addressing AI-discovered flaws at scale. Enjoying this? Get one like it in your inbox each morning. one email a day · unsubscribe in two clicks · no third-party tracking ## The patch is urgent; the bigger problem is permanent Immediate priority for operators: identify PHP versions and apply patched releases like **8.5.12, 8.4.27, 8.3.36, and 8.2.35**. But patching alone is insufficient; investigate prior access to ensure attackers did not already compromise systems, an alert the FBI’s Cyber Division issued. This incident underscores a structural challenge: the Internet relies on aging software like PHP, which has been in widespread production for almost 30 years. Limited maintenance resources and the sheer difficulty of updating a sprawling, decentralized web mean vulnerabilities can persist for over a decade. The broader takeaway is clear: AI can strengthen security, but defenders need faster patching, robust support for legacy systems, and coordinated disclosure to keep pace. As Cloudflare and watchTowr observed, automated mass-scanning and active exploit probing started within hours of the flaws leaking, highlighting the urgent need for a more agile defense. ## Frequently Asked Questions ### What were the PHP vulnerabilities found with AI? Researchers using AI-assisted analysis uncovered two critical flaws in PHP that could enable remote code execution on vulnerable servers. ### Do these PHP flaws affect ordinary internet users? Users do not patch PHP themselves, but vulnerable websites may expose stored personal information. Reuse of passwords can increase the risk to other accounts. ### What should a website owner do? Check whether the site runs an affected PHP version, install the relevant security update, and review server logs for signs of compromise. ### Why is AI-assisted vulnerability discovery significant? AI can help researchers inspect complex code and find subtle flaws faster, giving defenders new tools while also raising the stakes if attackers use similar capabilities.