PHP2Shell: AI-discovered critical PHP flaws trigger a global patch race across 24 million sites

London — Two critical vulnerabilities in PHP, the language behind much of the public web, were found with the help of artificial intelligence models and triggered a global patching race on Wednesday, Computer Weekly reported. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution and carry a severity rating of 9.2 out of 10.

The flaws, dubbed PHP2Shell by researchers, went undetected for more than a decade: they affect every PHP release dating back to version 5.0 in 2004. PHP powers about 24 million websites, according to BuiltWith, and roughly three-quarters of sites whose language can be identified, according to W3Techs. The emergency patches released Wednesday cover only PHP 8.2 and newer, leaving a long tail of older sites exposed.

The vulnerabilities were located and verified using AI: security firms Wiz and Calif used OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon to find them, coordinating disclosure with the PHP team before publication. But details leaked ahead of schedule and, according to Cloudflare, active attacks were already observed, with attackers mutating their methods to evade protections.

The reaction was immediate worldwide: the UK National Cyber Security Centre advised taking offline any systems that cannot be patched immediately; the U.S. NSA and CERT-EU issued similar warnings. Finland suspended public services as a precaution, the Netherlands took the Overheid.nl portal and the Port of Rotterdam offline, France's Interior Ministry placed its sites in preventive maintenance, and in the UK, Edinburgh Council and BBC pages went dark temporarily. Wikipedia also took down systems until they could be patched, the Wikimedia Foundation said.

Photo: Computer Weekly

Source: Computer Weekly