PHP, the open-source language behind a large share of the world’s websites, released emergency security updates on 21 October 2026 for two critical flaws that could let an attacker take over a web server without logging in. The bugs, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
AI played a big part in finding them. Security firm Calif found one using OpenAI’s GPT-5.6 Sol through OpenAI’s Patch the Planet programme, and Wiz independently found both using its own security agent alongside models from Google and OpenAI. According to TechCrunch, the bugs date back to PHP 5, released in 2004.
The US National Security Agency urged organisations to patch quickly and, where that is not possible, to take affected systems offline, warning that attackers are “likely to weaponize” the flaws.
Why it matters: this is a clear case of AI helping defenders find serious bugs before criminals did. But the PHP Foundation also admits its fix was delayed by its own processes and lack of resources, and says AI tools now find bugs “faster than ever, for defenders and attackers alike”. If your website runs on PHP, including WordPress, check that your host has updated.
Source: PHP Foundation security release