AI Found Critical PHP Flaws—Governments Are Shutting Down Sites

The Bug That AI Found Before Humans Could

Two critical vulnerabilities in PHP—each scoring 9.2 out of 10 on the severity scale—were discovered this week not by security researchers poring over code, but by artificial intelligence systems running independently of each other. One came from Califf, which used OpenAI’s GPT-5.6 Sol to flag the first flaw on August 11. The other was identified separately by Weez, a Google subsidiary, using its own AI model. Both reported the same class of defects: improper exception handling and use-after-free memory errors.

The implications go far beyond a patch cycle.

The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, represent a rare convergence of severity and accessibility. A 9.2 CVSS score places these squarely in the critical category, reserved for flaws that enable complete system compromise with minimal attacker effort. What makes this discovery particularly striking is not just the rating but the origin. Neither Califf nor Weez was commissioned by PHP or any government agency to hunt for bugs. They were running autonomous security analyses when both systems flagged the same categories of defects in the same codebase. That independent convergence—the fact that two unrelated AI tools, using different training data and different architectures, arrived at the same conclusions—is what elevates this from a routine vulnerability disclosure to a signal about the changing nature of threat discovery itself.

Who Is Exposed—and How Badly

PHP powers roughly 70% of websites with detectable server-side programming languages, according to W3Techs. That is not a marginal share. WordPress, Drupal, and dozens of other content management systems run on it. Joomla, MediaWiki, Laravel applications, and countless custom-built platforms all depend on PHP as their runtime foundation. The affected versions span PHP 8.2 through 8.5—specifically, anything below 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Versions 8.1 and earlier have already exited official security support, meaning millions of sites are running code that no longer receives patches at all.

The vulnerabilities allow remote code execution without authentication or login. An attacker does not need credentials, access, or social engineering. They only need the target to be running an unpatched version and, in some configurations, the ability to trigger specific exception-handling conditions. That is the difference between a vulnerability you worry about and one you treat as an emergency.

The attack surface is broad because PHP is embedded in so many layers of the web stack. It is not just public-facing websites. Internal dashboards, API endpoints, customer portals, and backend administrative interfaces all share the same vulnerable runtime. A single misconfigured server can expose an organization to exploitation from anywhere on the internet. And unlike vulnerabilities that require clicking a malicious link or opening a crafted document, RCE through these PHP flaws can potentially be triggered remotely through carefully crafted HTTP requests alone.

Second-order exposure comes through dependency chains. Many organizations do not run PHP directly—they run applications built on PHP frameworks, which bundle their own PHP versions or rely on the server environment. A WordPress site might appear secure because the CMS is updated, but if the underlying PHP version has not been upgraded, the vulnerability remains. This layered dependency makes inventory and remediation significantly harder than a simple version check would suggest.

Governments Are Already Taking Preemptive Action

Netherlands, France, and Finland have temporarily suspended operations of some government websites. Canada has taken similar precautionary measures. In South Korea, the Korea Internet & Security Agency (KISA) issued an update recommendation on October 22, noting the vulnerabilities were discovered through AI-assisted security analysis. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued advisory guidance to affected agencies and enterprises.

These are not standard precautionary pauses. They reflect a rare alignment: a high-severity, unauthenticated remote code execution flaw in foundational web infrastructure, combined with the knowledge that exploitation requires no special access. The governments acting are treating this the way they would treat a zero-day in a widely deployed operating system. When a nation pauses its own web services over a software bug, it sends a clear message about the perceived severity of the threat.

The timing of government action also reveals something important about risk perception. Canada and the European nations moved before widespread exploitation was confirmed. They acted on the potential rather than the evidence of active attacks. This preemptive posture reflects a calculation that the cost of being wrong about the threat is lower than the cost of being right too late. For government infrastructure handling citizen data and critical services, that calculus favors caution—even at the expense of temporary disruption.

Why This Changes the Arms Race

The real story here is not the vulnerabilities themselves—they date back decades. The story is who found them and how fast they moved.

AI models are now routinely discovering security flaws that human auditors have missed. Califf and Weez operated independently. They did not coordinate. Their AI tools converged on the same defect classes in the same codebase. That convergence is the signal. It means the bottleneck for vulnerability discovery is no longer human capacity alone—it is increasingly computational. Organizations that can deploy AI-driven security analysis at scale will find flaws first. The rest will be reacting.

This is not speculative. It is already happening. The timeline matters: Califf reported the first finding on August 11. By late October, the news cycle had shifted from discovery to emergency response. There was no coordinated public disclosure delay. The PHP Group moved quickly, but speed is no match for a threat landscape that is already moving at machine speed.

The acceleration of discovery creates a new dynamic for defenders. In the past, the window between vulnerability discovery and public disclosure was controlled by human researchers—who decided when to publish, often balancing responsible disclosure against the need for community awareness. That gatekeeping function is eroding. When AI systems can discover and report flaws independently, the traditional coordination model breaks down. Multiple actors may report the same vulnerability simultaneously, compressing the timeline from discovery to public knowledge to potential exploitation.

Who Wins and Who Loses

Who wins: Security vendors with AI-driven analysis capabilities, organizations already on PHP 8.4 or 8.5 with automated patching pipelines, and any company that had already upgraded past the supported PHP 8.1 cutoff. The PHP Group itself gains credibility for releasing timely fixes.

Who loses: Every organization still running PHP 8.1 or earlier—a population that KISA explicitly warned must upgrade to a supported version. Small and mid-sized businesses that rely on WordPress or Drupal without dedicated security operations. Government IT departments caught in legacy migration cycles. And critically, every website administrator who assumed that PHP’s dominance meant its security was already battle-tested. It is not. Dominance does not equal safety.

The losses extend beyond direct compromise. Organizations that fail to patch promptly will face not only technical consequences but reputational and regulatory ones. In jurisdictions with data protection laws like GDPR, a breach resulting from known unpatched vulnerabilities can trigger fines, mandatory disclosure, and loss of customer trust. The legal and financial exposure multiplies when the vulnerability was widely publicized and remediation was clearly available.

What Happens Next

The next few weeks will determine whether this becomes a footnote or a cautionary tale. Organizations that fail to patch within the window between announcement and widespread exploitation will face the standard aftermath: compromised sites, data breaches, and regulatory scrutiny. Those that treat this as routine will learn nothing.

The deeper lesson is structural. AI is now the primary discovery mechanism for critical vulnerabilities in widely deployed infrastructure. The race between discoverers and exploiters has accelerated beyond human tempo. The PHP case is likely not an outlier. It is a preview of how future vulnerability management will work—faster, more automated, and far less forgiving of organizations that cannot keep up.

Update your PHP versions. If you are on 8.1 or earlier, start the migration now. The AI that found this bug will not be the last. The organizations that survive this shift will be the ones that treat automated discovery as the new normal—and build their security posture to match.