PHP Vulnerabilities Reveal the AI Era's New Security Paradox

The Patch That Arrived Too Late

PHP’s developers issued emergency updates on Wednesday fixing two critical vulnerabilities—CVE-2026-109618 and CVE-2026-109619—that could allow attackers to execute arbitrary code on websites running the scripting language. Security firms called the flaws among the most severe ever discovered in any software. The problem isn’t just their severity. It’s what this moment reveals about the internet’s hidden architecture and the new rhythm of threat, accelerated by artificial intelligence.

Roughly 70 percent of websites run on PHP. That dominance, built over decades, is now a vulnerability multiplier. Security researcher Nicholas Weaver confirmed exploits were already circulating in the wild, which means systems that haven’t been patched are sitting exposed right now. Palo Alto Networks estimated more than 22.6 million instances of PHP are vulnerable. Another researcher put the number at over 1.3 million websites. The gap between those estimates isn’t a disagreement about methodology—it’s a disagreement about how deeply broken infrastructure runs.

The Memory Hole

The vulnerabilities themselves are technically straightforward, which is part of why they’re so dangerous. PHP handles HTTP requests by allocating memory. When a request exceeds available memory, PHP fails to properly release its hold on that allocated space, leaving the process in an unstable state. An attacker who can manipulate the data PHP encounters in that invalid memory can crash the process, leak sensitive information, or execute remote code.

Cloudflare, which operates some of the internet’s most heavily trafficked infrastructure, warned that the flaws provide a direct path to a server’s file system or database. The NSA issued a similar assessment within hours. CISA, alongside counterparts in the U.K., Canada, Australia, and the European Union, recommended that organizations take PHP-powered sites offline until patches could be applied. Finland disconnected its government websites. The Dutch House of Representatives did the same. These are not reactions to a hypothetical threat.

The Half-Internet Problem

Cisco’s assessment cuts to the core of why this crisis will linger far beyond the initial patch window. Roughly half of all internet-facing PHP instances are running versions too old to receive security updates. These are servers, CMS platforms, and application stacks that have drifted past their supported lifecycles—systems that weren’t decommissioned because decommissioning requires work, coordination, and money. The organizations running them may not even know they exist.

This is the silent architecture of the early internet, still humming along beneath newer platforms. WordPress, Joomla, Drupal—each can run on PHP, and many of their deployments have simply stopped updating. The PHP development team can release patches. They cannot force migration. There is no kill switch for legacy infrastructure, only the slow attrition of neglect.

How AI Changed the Game

The vulnerabilities were discovered by Wiz, a Google-owned security firm, and by Calif, a company that found the flaws using OpenAI’s GPT-5.6 Sol model. OpenAI described the discovery as one of the most impactful security issues in recent memory, noting that the same AI capabilities that can uncover internet-scale vulnerabilities can also accelerate the development of offensive tools. That tension is the defining feature of this moment.

Nicholas Weaver called these PHP vulnerabilities one of the first widespread vulnerability crises of the AI era. His observation is precise. AI systems are exceptionally good at translating a patch into an exploit because a patch is essentially a recipe for change—it shows exactly what was modified and, by inference, what the flaw was. The time between disclosure and weaponization, which previously measured in weeks or months, now compresses toward real time. Weaver put it plainly: “We are in the world where you have to apply updates effectively instantly.”

WatchTowr’s Jake Knott reported that threat intelligence communities were already discussing the vulnerabilities and attempting exploitation, even if successful attacks had not yet been confirmed. The expectation wasn’t doubt—it was patience.

The Government Response

The Trump administration said federal agencies began assessing their PHP usage after learning of the vulnerabilities on October 16. The White House stated it was coordinating with federal agencies and leading AI labs to expedite fixes and protect critical infrastructure. The NSA urged partners to update immediately. These are standard institutional responses to a serious vulnerability. What distinguishes this response is the scale of exposure and the speed of the threat timeline.

Cloudflare deployed firewall rules to protect customers within hours of disclosure—a reminder that intermediaries with the resources to act quickly now serve as the first line of defense for millions of smaller operators who cannot.

What Happens Next

Organizations running recent PHP versions should patch now. Those running unsupported versions face a harder choice: upgrade the underlying platform, migrate away from PHP entirely, or accept the risk until migration is possible. For many, that decision will come too late if exploit tooling matures before action is taken.

The deeper lesson concerns infrastructure strategy. PHP’s continued dominance—despite being a technology whose security model was designed for a simpler web—reflects a broader pattern. The internet runs on systems whose maintenance has fallen behind their deployment. AI accelerates both the discovery of flaws in that aging stack and the speed at which those flaws become weapons. The result is a security environment where reactive patching is no longer sufficient.

This vulnerability event is a stress test for an architecture the world forgot it was running. PHP will not disappear overnight. But the gap between its reach and its upkeep is now measured in exploited instances rather than theoretical risk.