The two most serious PHP vulnerabilities in over a decade were found with the help of artificial intelligence, and the same AI that found them is now helping attackers weaponise them. If your website runs on PHP, this week is the week to check.
The flaws, dubbed PHP2Shell and catalogued as CVE-2026-109618 and CVE-2026-109619, each score 9.2 out of 10 for severity. They allow an attacker to run code on a server without logging in, and they affect versions going back to PHP 5.4, released in 2012.
Here is the part digital teams should sit up for: the bugs went undetected for more than a decade. Researchers at the security firms Calif and Wiz reported them in August after using frontier AI models, OpenAI’s GPT-5.6 Sol and Google’s Gemini 4 Argon, to turn a theoretical weakness into a working exploit in hours.
What this means for your website
PHP sits beneath a huge share of the web, including WordPress, Drupal and Joomla. Roughly 70 percent of websites whose server-side language is known run PHP, and researchers estimate 1.3 million internet-connected hosts are potentially exposed. Emergency patches shipped on October 21 for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, but PHP 8.1 and earlier get no official fix.
The United States National Security Agency issued a rare public warning telling organisations to take sites offline if they cannot update immediately, and Cloudflare says it is already seeing early attacks. Our earlier story on the Claude-assisted Chrome fix showed AI cutting both ways in security; this is the sharper edge.
The checklist
Find out what PHP version your sites run, patch to a supported release, and check with your host, because Computer Weekly notes that a WordPress update alone does not fix the underlying PHP exposure. For marketers running campaign microsites and landing pages on forgotten servers, this is exactly the kind of shadow infrastructure that gets breached first.
AI found the flaws in hours. Do not give attackers the same head start.
