Critical PHP Vulnerability Discovered by AI Reignites Debate Over AI Safety Regulation

Artificial intelligence tools uncovered critical remote code execution flaws in PHP—the language powering roughly 70% of the internet—forcing government websites worldwide offline and reigniting urgency around federal AI safety legislation. On October 21, 2026, PHP released emergency patches addressing two severe vulnerabilities (CVE-2026-109618 and CVE-2026-109619) discovered independently in August by security researchers using frontier AI models, including OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon. The flaws, which had remained hidden in the codebase for over a decade, allow unauthenticated attackers to execute arbitrary code and extract sensitive data—passwords, authentication tokens, and API keys—from vulnerable servers.