PHP Security Flaws: AI Found Bugs That Rattled the Web

The PHP security flaws just gave the internet its scariest week in years. Two critical bugs in PHP, the programming language behind a huge share of the web, sent governments and companies scrambling to patch or switch their sites off. The twist is who spotted them first: AI models, working for the good guys.

According to BBC News, international agencies urged websites to fix the flaws fast, and organisations that could not patch in time were told to consider taking pages down. Finland shut its public government web services for a while, and the Dutch cyber agency pulled its own site.

What actually broke

PHP shipped emergency updates on Wednesday for two memory-safety bugs tracked as CVE-2026-109618 and CVE-2026-109619. According to The Next Web, both are rated nine point two on a ten-point severity scale, and both let an attacker run code on a server without logging in.

The fixed versions are PHP eight point five point twelve, eight point four point twenty-seven, eight point three point thirty-six and eight point two point thirty-five. The project called updating the only safe choice. The risk is highest on sites running Apache's PHP module, where a single unauthenticated request can trigger the bug before any app code even runs.

The PHP security flaws matter because PHP quietly runs WordPress, Drupal, Joomla and the software behind Wikipedia. That is why this felt so huge. The Wikimedia Foundation said it took a number of systems down as a precaution, which left some people unable to reach parts of Wikipedia on Wednesday, per the BBC.

The AI plot twist

Here is the part that has the security world buzzing. Firm Calif found the first bug in August using OpenAI's GPT five point six Sol during an audit funded by OpenAI's Patch the Planet initiative. Google's Wiz team separately found related issues weeks later, using its own AI agent plus models from Google and OpenAI.

Wiz says these are the most severe vulnerabilities ever discovered by AI, according to the BBC. In its own write-up on the Wiz blog, the company says every PHP release from the last decade is hit by at least one of the bugs, going all the way back to version five point four.

OpenAI pitched the find as proof that AI can catch internet-scale holes before criminals do, a head start it calls the Defender's Window. Calif was more modest. It said it used only generally available models and that knowing PHP's history mattered more than the model, adding that no model can find all bugs with simple prompts, at least for now.

Why the scramble got messy

The patch was meant to land later, but details leaked in a post on Hacker News, so PHP pulled the release forward, the Wall Street Journal reported, as relayed by The Next Web. The EU's CERT-EU and Britain's NCSC told teams to go offline if they could not update on the spot, and the US National Security Agency issued its own alert.

Some well-known names paused parts of their services. Pinboard, the GrapheneOS forum and OBS took pages down, while Laravel halted its Cloud deployments to rebuild on patched images. Even the South African presidency pulled its site on Friday as a precaution, according to TechCentral.

What it means for you

If you only browse the web, there is not much to do except expect a few sites to be flaky while admins patch. If you run a blog, a shop or a side project, check which PHP version your host uses. The flaw sits in PHP itself, so updating WordPress or plugins is not enough. Ask your host to confirm the server patch.

Government agencies also leaned in. The White House said federal teams were working with leading AI labs to speed up a fix, and Japan's prime minister urged people to check whether their public websites ran on PHP. Few bugs have pulled that many top officials into a technical patch cycle.

Security researchers say the bigger lesson is speed. AI can now read huge piles of old code and surface bugs people considered too hard to exploit, and attackers have the same tools. Reports say attack traffic started appearing within hours of the patch, so the gap between a fix and a real-world exploit is shrinking fast.

For Gen Z builders, this is a wake-up call and a career signal at once. Defensive AI is about to be a huge field, and more of the internet's oldest plumbing is going to get audited by machines. Keep an eye on our tech coverage as the cleanup continues, because the full list of affected sites is still growing.

The PHP security flaws are patched, but the patching is not done. Millions of servers still run old versions, and every unpatched one is a target. The next few days will show whether the Defender's Window held, or whether attackers sprinted through it.