PHP Foundation Releases Emergency Patches for Critical AI-Found Flaws

The PHP Foundation released emergency security updates on October 21, 2026, to address two critical zero-day vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Nicknamed PHP2Shell, the flaws carry a 9.2 CVSS v4.0 severity rating and allow unauthenticated remote code execution, potentially granting attackers direct access to server file systems and databases. The vulnerabilities affect nearly all PHP installations from version 5 onward, impacting an estimated 70% of the internet, including platforms like WordPress, Drupal, and Joomla.

The flaws were discovered using artificial intelligence. Security firm Calif used OpenAI's GPT-5.6 Sol model to find the first flaw in August, while Wiz, Inc. independently discovered the second. A leak of the bug details on Tuesday forced the PHP Foundation to accelerate its patch release to Wednesday at 14:00 UTC. Cloudflare and Patchstack reported that early attacks emerged shortly after the leak, leading Cloudflare to deploy Web Application Firewall rules as a temporary stopgap.

In response, governments in Finland, France, the Netherlands, Belgium, and Japan took public websites offline as a precaution. High-profile services including parts of Wikipedia, the Dutch House of Representatives, and various Pokémon applications also suspended operations. The National Security Agency, the FBI Cyber Division, and the UK National Cyber Security Centre urged organizations to update immediately or isolate systems. While Automattic confirmed its hosted platforms were protected via infrastructure-level patching, other agencies warned that manual intervention is required for most PHP installations.