AI Discovers Critical PHP Security Vulnerabilities – Two critical PHP security vulnerabilities discovered in PHP have triggered an international response, with government agencies and other organizations taking precautionary measures to protect their websites. AI-assisted security research helped identify the flaws, highlighting how artificial intelligence is changing vulnerability discovery and cybersecurity defense.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow unauthenticated attackers to execute code remotely on affected systems. PHP’s developers released security updates on October 21, 2026, and cybersecurity authorities have urged organizations to patch vulnerable installations immediately. https://www.php.net/archive/2026.php
Governments and Global Organizations Take Websites Offline
A number of governments and global organizations have taken down their websites because of concerns about flaws in a programming language that powers much of the internet.
A researcher using artificial intelligence found two critical flaws in a programming language called PHP, which is used in as much as 70% of the world’s websites.
Websites Taken Offline Following Discovery of PHP Security Vulnerabilities
Let’s find out more from our cyber correspondent.
Yeah, it’s an extraordinary situation. We saw website after website being taken offline today as IT teams were scrambling to protect their organizations from the serious risk of a very serious cyberattack.
We saw websites, for example, Edinburgh Council taken offline, the Doctor Who area of the BBC website, too, and companies in Japan, Belgium, and the Netherlands. Some cybersecurity authorities’ own websites were taken offline, even though they were trying to warn people about the seriousness of this.
How Artificial Intelligence Discovered the PHP Security Vulnerabilities
As you say, it all started when cybersecurity researchers were using frontier AI, the most powerful AI models they could, to actively look for flaws in PHP. They discovered two very serious flaws.
They say that this was done way beyond what was capable of a human being. The way they described it is that they found a complex chain of steps at the edge of what human researchers could practically achieve.
In other words, they found that with AI, if you did this, this, this, and this in this particular order, you could hack PHP and therefore compromise a website.
Cybercriminals Use AI to Target Vulnerable Websites
It’s a very serious situation, of course, but it should have been a good news story about AI being used by defenders to find a problem and fix a problem.
What’s happened here is that the bad guys have found out that there is a flaw, and they’re using their own AI to reverse-engineer the method to actively go after websites that haven’t yet patched using the PHP fix that has been issued.
So, I think that’s why the panic has spread today, and I think it’s going to spread even further as more organizations realize that they are vulnerable.
Sources – PHP Security Vulnerabilities
These sources provide authoritative details and are particularly valuable for a time-sensitive security article.
- Official PHP security announcement — released versions and remediation guidance.
- ENISA joint statement on critical PHP vulnerabilities — guidance from European cybersecurity authorities.
2026+1
- US National Security Agency advisory — US government recommendations on patching and mitigating risk.
National Security Agency
Pingback: Google Stock Q3 2026 Earnings: Revenue, AI & Stock Outlook - Sharmilan Vipokan