Researchers uncovered critical security bugs in the PHP programming language on Wednesday, using frontier AI models to identify vulnerabilities that could affect roughly 70% of web infrastructure.
Teams at OpenAI, Google-owned cybersecurity firm Wiz, and Calif identified the flaws collectively named PHP2Shell, which allow attackers to remotely execute code and read sensitive memory data, including passwords.
Investigators discovered the bugs in late August but delayed public disclosure until the PHP Foundation prepared an official fix.
Artificial intelligence accelerated the analysis across multiple applications, reducing work that previously took months down to days and hours.
Wiz researchers used Google’s Gemini 4 Argon, Wiz Atlas, and OpenAI’s GPT-5.6 Sol during the process. Investigators likened the risk to the 2014 Heartbleed bug.
Read: Security by Antiquity Gives Old Tech a Cybersecurity Edge
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could let malicious actors remotely execute code in PHP core, potentially compromising sensitive data and networks.
Advanced AI models have lowered the barrier to turning decades-old flaws into active exploits. The PHP Foundation released a patch for the vulnerabilities and urged operators to update systems immediately.
The National Security Agency urged organisations using PHP to update or temporarily take vulnerable systems offline. Several government websites across Europe went offline as administrators applied emergency patches.
Read: Musk AI Prediction Sees Superhuman Digital Skills by 2027
Cloudflare confirmed it worked with the PHP Foundation, Calif, OpenAI, and Wiz to address the risk of disruption. Researchers at OpenAI, Wiz, and Calif used AI models to uncover PHP2Shell, a set of critical vulnerabilities in the PHP coding language that affect an estimated 70% of the internet.
