AI-assisted security research has uncovered critical PHP vulnerabilities, prompting urgent warnings about the safety of millions of websites. The U.S. National Security Agency issued a security alert Wednesday, urging administrators to address the flaws immediately.
The PHP Foundation released emergency fixes for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Under certain conditions, attackers could execute malicious code without authentication, potentially accessing server files, databases and sensitive information.
PHP is among the internet’s most widely used programming languages. According to W3Techs data, it powers approximately 69% of websites with an identifiable server-side programming language. A developer analysis previously highlighted its continued importance despite perceptions that PHP was becoming outdated.
AI uncovers critical PHP vulnerabilities dating back decades
The flaws affect PHP’s memory management and error-handling systems. Researchers found that certain errors could leave corrupted memory behind, creating opportunities for attackers to take control of affected servers.
Security firm Calif discovered one vulnerability using OpenAI’s GPT-5.6 Sol through its Patch the Planet initiative. In a coordinated disclosure report, OpenAI said researchers identified the problems before malicious actors could exploit them.
Separately, Google’s Wiz security team uncovered vulnerabilities using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol. Its technical analysis explains how AI helped researchers develop working exploits for weaknesses that had remained difficult to exploit for years.
Some affected code dates back to PHP 5.4. The PHP Foundation acknowledged that signs of one issue emerged during security work in 2024, but technical challenges and limited resources delayed its resolution.
The discovery also reflects AI’s growing role in vulnerability research. TechAmerica.ai previously reported how researchers used Claude to identify security weaknesses in OpenAI systems.
Website operators urged to install security patches
The PHP Foundation released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Administrators running older, unsupported releases must move to a supported version or obtain verified vendor security fixes.
WordPress also issued a public security statement clarifying that the vulnerabilities affect PHP itself, not WordPress specifically. Updating WordPress alone will not resolve the problem. Website owners should confirm that their hosting providers have patched the underlying PHP installation.
The disclosure followed coordinated work involving OpenAI, Wiz, the PHP security team and major infrastructure providers. Companies including Cloudflare, AWS, Microsoft and Automattic helped prepare protections ahead of the public announcement.
Security teams warn that AI can also help attackers adapt exploits across different server configurations. That makes delayed patching particularly risky now that technical details are public.
Website operators should verify their PHP versions and apply the appropriate security updates immediately. If patching isn’t possible, operators may need to take vulnerable systems offline to prevent unauthorized access temporarily.
