AI Found PHP Flaws Hitting "70% of the Internet"; Sites Go Dark to Patch

Two critical flaws in the PHP programming language, found with the help of frontier AI models, were patched on Wednesday, Oct. 21, 2026. The bugs, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed "PHP2Shell" by Wiz Research, can let an unauthenticated attacker run code on a server or read its memory, Wiz said. Wiz says PHP powers 70% of all websites, including WordPress, Drupal, Joomla and Wikipedia's MediaWiki; the BBC said it could not verify that figure.

How AI found them

Wiz said it used its Wiz Atlas tool plus Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol, and that the code had been vulnerable "for more than a decade." "Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours," Wiz wrote. Its timeline shows the first bug found on Aug. 19, reported to PHP on Aug. 24, and patched releases on Oct. 21. Wiz rated severity as high as CVSS 9.2 and said every PHP version back to 5.4 is affected by at least one of the issues.

OpenAI said security firm Calif found a critical flaw using GPT-5.6 Sol through its Patch the Planet program, with Wiz independently reporting both vulnerabilities. OpenAI called it "one of the most impactful security issues in recent memory" and said it has committed $1 billion in subsidized access to its Daybreak security tooling for under-resourced defenders. It also said it worked with the White House's Super Intelligence Force, the Office of the National Cyber Director and CISA on the response.

Sites taken offline

The BBC reported that details leaked on social media on Tuesday, forcing an earlier announcement. Finland temporarily shut its government's public web services, the Dutch cyber-security agency took its own site offline, and the Wikimedia Foundation took "a number of other systems" down as a precaution. The UK's NCSC said organisations that can't patch right away "should consider taking the system offline," and the U.S. NSA issued similar advice on X. Cloudflare CTO Dane Knecht told the BBC he was "seeing early attacks emerging."

What to do

The PHP team issued updates only for its latest release lines; users on PHP 8.1 or older are being told to upgrade, the BBC reported. Wiz said applying the PHP security update "remains the only complete remediation."

It's another sign of how fast AI security tooling is moving; see our earlier story on Anthropic's Claude finding 493 issues in open-source projects.