Key Notes
- AI-assisted research helped uncover critical PHP vulnerabilities that can allow unauthenticated code execution or exposure of sensitive server memory.
- Supported PHP branches have fixed releases, while selected older versions have minimal source backports or vendor patches rather than renewed upstream support.
- Precautionary website shutdowns and observed attack attempts highlight the urgency of patching, while the eMudhra certificate incident requires separate trust-store remediation.
OpenAI says GPT-5.6 Sol helped researchers uncover a critical PHP vulnerability, as emergency fixes and precautionary website shutdowns put the security of the web’s underlying software back in focus. Security firm Calif made the finding through the company’s Patch the Planet initiative. Wiz independently discovered and reported both vulnerabilities involved in the coordinated response.
The disclosure raises a particular concern for older websites: AI can help defenders investigate deeply embedded flaws, but it can also help attackers adapt exploits faster. Patches are now available for supported PHP branches. Older installations face a harder remediation process, although the claim that every version below PHP 8.2 has been left without any patch option is no longer accurate.
PHP2Shell Reaches Below the Website’s Own Code
The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, are collectively known as PHP2Shell. Finland’s cybersecurity authority lists both as critical, with a CVSS score of 9.2 out of 10. They affect the PHP runtime that processes web requests, rather than a single website’s theme, plugin or application logic.
Wiz’s research describes memory-safety failures that can enable unauthenticated remote code execution or disclosure of sensitive process memory. Its team demonstrated attacks against WordPress, Drupal and Joomla deployments. That does not mean every site can be attacked in exactly the same way: PHP versions, server configurations and memory behavior influence exploitation.
The practical distinction is important for site owners. Updating a content-management system alone does not necessarily replace the vulnerable PHP runtime beneath it. A hosting provider, system administrator or software vendor may need to deliver and deploy the underlying fix.
What AI Changed in the Discovery
OpenAI’s disclosure describes two months of coordination involving maintainers, researchers and infrastructure providers. PHP’s maintainers led the fixes and release. Wiz says its own work used its Atlas platform, Google’s Gemini 4 Argon and GPT-5.6 Sol, underscoring that this was a wider research effort rather than a single model acting alone.
Calif researcher Ryan Austin’s account traces the investigation through a history of PHP memory-limit problems reaching back to 2004, a related 2020 bug report and a 2024 audit. He emphasizes the importance of his prior expertise and a specific theory about the code. The history supports describing longstanding weaknesses; it is not evidence that a chatbot independently uncovered one unchanged, twenty-year-old bug.
The same shift is visible in other security research. We recently reported on GPT-5.6 Sol’s role in a Chrome exploit chain that earned XBOW researchers a $250,000 bounty. Faster investigation can expose weaknesses that survived years of scrutiny, while making the interval between public disclosure and widespread exploitation harder for defenders to manage.
Which PHP Versions Have Fixes?
PHP’s official advisory identifies four fixed releases available on October 21. Operators using distribution packages should also check their vendor’s security notice, since fixes may be backported without adopting the upstream release number.
- PHP 8.2: update to 8.2.35
- PHP 8.3: update to 8.3.36
- PHP 8.4: update to 8.4.27
- PHP 8.5: update to 8.5.12
PHP 8.1 and older no longer receive normal upstream updates. However, the security team has provided minimal source backports for PHP 7.4, 8.0 and 8.1, and some distributions or long-term-support vendors offer their own fixes. Those options require checking the actual package or build in use; they do not restore ongoing upstream support to an obsolete branch.
Even PHP 8.2 is approaching the end of its security support, which runs through December 31, 2026. Emergency patching addresses this incident, while migration planning addresses the next one. Unsupported installations without a verified vendor fix or an applied backport remain a significant concern.
Sites Went Offline, and Attack Traffic Has Been Observed
The Dutch government confirmed that its National Cyber Security Centre temporarily took NCSC.nl offline as a precaution. NL Times also reported taking its own site offline. These defensive shutdowns should not be confused with proof that those organizations were successfully breached.
Cloudflare says it observed attacks targeting customers and attempts to modify malicious traffic to evade its protections. The company deployed web application firewall defenses for free and paid customers, but continues to urge PHP updates. Observed attack attempts establish urgency; they do not, by themselves, establish the number of compromised websites.
The UK’s National Cyber Security Centre advises organizations to identify PHP deployments, monitor exposed systems and apply updates, including vendor fixes for products that bundle PHP. Where immediate remediation is not feasible, it says organizations should consider taking affected systems offline until they can be fully mitigated. Temporary protections should be assessed against the latest maintainer guidance, rather than treated as a substitute for patching.
The eMudhra Certificate Emergency Is a Separate Incident
Alongside the PHP response, browser and operating-system vendors are handling a different weakness involving eight eMudhra intermediate certificate authorities. Google’s security notice says insufficient randomness made their private keys recoverable, enabling forged HTTPS credentials against clients that still trust them. Chrome blocked the affected keys, while other applications and trust stores require their own remediation.
eMudhra’s incident statement says the affected intermediates had not issued end-entity certificates and that its other intermediate CAs and root private keys were not affected. That statement does not remove the need to distrust the compromised keys. This is a certificate-trust problem with a different remedy from updating PHP, and neither incident is evidence that all encrypted web traffic has become unsafe.
Together, the incidents expose how much online security depends on shared components maintained far below the services people recognize. AI-assisted research can help find flaws sooner. The benefit reaches users only when hosting providers, software vendors and site operators can turn those findings into updates that are actually running.
Disclaimer: AIstify is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and insights on artificial intelligence, emerging technologies, automation, and related industries. NuvexMedia LLC invests in and collaborates with companies across the AI, technology, software, and digital innovation sectors. These relationships do not influence AIstify’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2026 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
