Back to News
News AlertWorld AI Tech
The PHP Flaw AI Found First, and Why Governments Are Taking Websites Offline
S
Author
Saumya Dawande
Published
October 23, 2026
Reading Time
3 MIN READ
Spread the Word
On October 21, PHP released emergency patches for two critical flaws in the language that Wiz says powers 70% of all websites. Within hours, government and public services across Europe and Asia had taken their own sites offline. The flaws, CVE-2026-109618 and CVE-2026-109619, let an attacker run code on a server, and Wiz demonstrated attacks that need no login against Drupal and WordPress. Both were found with help from AI. Sources: Wiz, PHP2Shell
Wiz Research found the bugs using several AI models, including Gemini 4 Argon and GPT-5.6 Sol. OpenAI says it led a coalition of researchers and security providers that worked on the problem for about two months. The timeline is specific: Wiz found the first bug on August 19, reported it to the PHP security team on August 24, and PHP began a coordinated fix on September 21. The flaws sit in PHP’s core engine, so an application can be vulnerable even when its own code is clean. Both stem from mishandling fatal errors, especially out-of-memory errors, which can leave corrupted state that later requests reuse. Sources: Wiz, PHP2Shell:
This is the double edge. Bugs in a core engine’s memory handling are hard to find through ordinary review, which is why AI was needed here. Wiz also argues that AI lowered the effort needed to chain bugs together and adapt exploits across targets. In other words, the same capability that found the flaw can shrink the time between disclosure and attack. The AP report says the PHP Foundation dates the vulnerability to at least 2024, so the open question is how long it sat in code that many teams trusted. Wiz, PHP2Shell
Governments mostly acted as a precaution. In the Netherlands, organizations followed the national cyber agency and took sites offline, including the Port of Rotterdam, the national government portal Overheid.nl, the KNVB football association, the five largest political parties’ sites, and numerous hospitals. France’s Interior Ministry took prefecture websites offline pending a patch. Finland’s state IT center shut down public web services and said it found no exploitation attempts. Belgium’s foreign ministry went offline after reports of attacks elsewhere, though its cybersecurity center recorded none on Belgian sites. In Japan, the prime minister addressed the issue publicly, and childcare center systems and online games were taken down. The US NSA urged organizations unable to update immediately to take affected systems offline. Factbox
Saumya Dawande
B.Tech AIML @ oriental institute of science technology bhopal
Engineering and tech journalist. I love exploring the impact of emerging technologies on global defense, sovereignty, and everyday life. Always looking for the real story behind the headlines.
