In a landmark moment for AI-driven cybersecurity, artificial intelligence tools from OpenAI and cloud security firm Wiz (a subsidiary of Alphabet/Google Cloud) have discovered two devastating critical vulnerabilities in PHP — the open-source programming language that powers roughly 70% of the world’s websites. The flaws, collectively dubbed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), each carry a CVSS v4.0 score of 9.2 (Critical) and can allow an unauthenticated attacker to remotely execute code and seize full control of a web server with a single request.
The vulnerabilities were first identified in August 2026 by California-based AI red-teaming firm Calif, as part of OpenAI’s “Patch the Planet” initiative, using OpenAI’s GPT-5.6 Sol model. The PHP development team released emergency security patches on October 21, 2026 — but details had already leaked online four days earlier, sparking millions of active attack attempts against an estimated 1.5 million unpatched servers on day one alone.
Security firm Wiz warned: “With 70% of the internet affected, the impact of php2shell cannot be overstated.” Fixed versions — PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 — are now available, and administrators are urged to update immediately. The PHP maintainers stated that there are no complete mitigations short of patching. Beyond remote code execution, researchers have also demonstrated that the flaws can expose passwords, authentication tokens, and API keys stored in server memory.
Source: Fortune – AI tools discovered the PHP vulnerability that could take down 70% of the internet