PHP Flaws Found by AI Trigger Global Cybersecurity Alert — SkimNews
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- PHP powers 70% of the world's websites, including Wikipedia and WordPress, and has underpinned much of the internet’s dynamic content since the 1990s, according to cyber-security firm Wiz.
- Wiz and Calif researchers identified two critical PHP flaws—CVE-2026-109618 and CVE-2026-109619—ranked 9.2/10 in severity, which could allow attackers to take control of web servers and steal data.
- The PHP Foundation released emergency patches on Wednesday after the vulnerabilities were exposed, urging all users to update immediately to prevent potential exploitation.
- Governments and agencies, including the US National Security Agency and counterparts in the EU, Singapore, and Australia, issued alerts warning organizations to patch or take systems offline if unable to secure them.
- Wikimedia, the Finnish government, Edinburgh council, and the Netherlands' cyber-security agency took systems offline as a precaution, while Amazon reported pre-disclosure exploitation attempts and Cloudflare observed millions of post-announcement attack probes.
- OpenAI-developed AI tools were used by researchers to detect the long-hidden PHP flaws, demonstrating AI’s growing role in identifying complex code vulnerabilities faster than traditional methods.
Why it matters: Millions of websites and critical infrastructure systems built on PHP face immediate risk if not patched, with smaller organizations and embedded devices particularly vulnerable; the incident marks a turning point in AI-driven security discovery, where the same technology that finds flaws can also accelerate exploitation at scale.
Ask SkimNews
