Breaking

AI Models Discover Critical PHP Vulnerabilities Affecting Majority of Web Infrastructure

October 22, 2026 at 08:03 EDT

Foundation Models
Security

OpenAI's GPT-5.6 Sol and Google's Gemini models have identified two severe security flaws in PHP, the programming language powering approximately 70% of websites worldwide, in what researchers describe as a major milestone in AI-assisted cybersecurity defense. The vulnerabilities, designated CVE-2026-109618 and CVE-2026-109619 and collectively called PHP2Shell, carry a critical CVSS v4.0 severity score of 9.2 and allow unauthenticated attackers to execute arbitrary code on vulnerable servers.

AI NEWS • OCTOBER 22, 2026

Critical PHP Flaws Discovered by AI

OpenAI's GPT-5.6 Sol and Google's Gemini identified two severe vulnerabilities in PHP before attackers could exploit them, protecting 70% of the world's websites.

The Threat

70%

of websites use PHP

9.2

CVSS severity (critical)

CVEs: CVE-2026-109618/619

The vulnerabilities allow unauthenticated remote code execution on servers, affecting all PHP installations from version 5.4 through 8.5.11. Both stem from unsafe memory handling in PHP's core functions.

Discovery & Defense Timeline

August
Discovery

Oct 20
Leak

Oct 21
Patches

Defender's Window: ~75 days between discovery and public disclosure gave defenders critical time to prepare patches and WAF rules before widespread exploitation.

Global Response

✓ Patches Released

PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 available Oct 21

⚠ Government Action

Europe, S. Korea, Japan took sites offline; NSA advised all organizations

✓ Cloud Defense

AWS, Azure, Cloudflare deployed WAF rules within hours

⚠ Race Against Time

Exploitation attempts began before Oct 21 disclosure

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.