AI Uncovers Two Critical PHP Vulnerabilities After More Than a Decade
Introduction
Two critical security vulnerabilities in PHP triggered a global cybersecurity alert in October 2026. The flaws had remained undetected for more than a decade before researchers used advanced artificial intelligence tools to help uncover them.
The discovery prompted security agencies and organizations worldwide to take urgent action. Some websites were temporarily taken offline while administrators assessed their exposure and applied security updates.
The incident highlights a serious risk for website owners: vulnerabilities in widely used software can affect thousands of applications, even when those applications were not directly responsible for the underlying flaw.
What Happened?
On October 21, 2026, the PHP project released security updates addressing two critical vulnerabilities in the PHP runtime.
Researchers from Calif and Wiz identified the flaws with assistance from advanced AI tools. The discoveries were part of a wider effort to use AI to find and fix vulnerabilities in important software before attackers could exploit them.
The two vulnerabilities were assigned these identifiers:
Both vulnerabilities received a critical severity score of 9.2 out of 10 under CVSS v4. Successful exploitation could allow remote code execution, potentially giving an attacker control over an affected server.
The announcement led cybersecurity agencies to urge organizations to patch affected installations immediately. Where immediate remediation was not possible, some authorities recommended temporarily taking vulnerable systems offline.
Sources: PHP security advisories, CERT-In advisory.
Why Are These Vulnerabilities So Serious?
PHP is a server-side programming language used by a substantial portion of the web. It supports content management systems, ecommerce platforms, business applications, and countless custom websites.
A vulnerability in the PHP runtime can therefore affect many applications simultaneously.
Remote Code Execution
The most serious risk is remote code execution. Depending on the affected system and its configuration, an attacker may be able to execute unauthorized commands on a vulnerable server without first logging in.
This could lead to several consequences:
-
Unauthorized access to sensitive files and application data.
-
Installation of malicious software.
-
Modification of website content.
-
Compromise of application credentials.
-
Further attacks against connected systems.
The actual impact depends on the server's permissions, configuration, and other security controls.
Exposure Across Multiple Platforms
The problem was not limited to websites built directly with PHP. Applications and platforms that depend on the PHP runtime could also be affected.
This includes environments running content management systems such as WordPress, Drupal, and Joomla, as well as other PHP-based applications.
Updating an application does not necessarily update the underlying PHP runtime. Website owners need to check both.
How Did AI Help Discover the Flaws?
The discovery demonstrates how AI can assist security researchers in analysing complex software.
Researchers used advanced AI models to investigate code, explore potential vulnerabilities, and help develop and validate working exploits. Tasks that traditionally require extensive manual investigation can sometimes be accelerated through this approach.
AI did not independently replace the researchers or the PHP maintainers. Human expertise, technical validation, responsible disclosure, and the development of security patches remained essential.
The important change is the speed at which sophisticated tools can help researchers examine mature codebases and investigate weaknesses that may have escaped earlier reviews.
This also creates a challenge for cybersecurity. Techniques that help defenders find flaws may eventually help attackers develop exploits more quickly.
Why Were the Flaws Missed for So Long?
The vulnerabilities involved low-level memory handling within the PHP runtime. Such defects can be difficult to identify because their behaviour may depend on unusual execution conditions rather than ordinary application inputs.
Software can undergo years of development and testing without every possible execution path being examined.
Traditional testing often focuses on expected behaviour, compatibility, and known failure conditions. Security research must also investigate unexpected states, memory corruption, and unusual sequences of operations.
The incident is a reminder that mature software is not automatically secure simply because it has been widely used for years.
Which PHP Versions Are Affected?
According to the published security guidance, the vulnerabilities affect older PHP releases, including PHP versions that have reached end of life.
The patched releases are:
| PHP branch |
Fixed version |
| PHP 8.5 |
8.5.12 |
| PHP 8.4 |
8.4.27 |
| PHP 8.3 |
8.3.36 |
| PHP 8.2 |
8.2.35 |
PHP 8.1 and older versions are no longer supported and do not receive fixes for these vulnerabilities. Organizations using them should plan to migrate to a supported release.
These version details are based on the security advisories available at the time of writing. Administrators should verify the latest guidance before making changes.
What Should Website Owners Do Now?
Organizations running PHP should take the following steps.
1. Check the PHP version. Confirm the version used by the production server, not just the version installed on a developer's computer.
2. Identify every affected installation. PHP may be running through a hosting provider, a container, a control panel, or a third-party application.
3. Install the relevant security update. Upgrade to a fixed, supported PHP release and test the application to identify compatibility issues.
4. Contact the hosting provider if necessary. If the website uses managed hosting, ask whether the underlying PHP runtime has been patched.
5. Investigate possible compromise. If the server was exposed while vulnerable, review logs and suspicious activity. Applying a patch does not prove that no attacker accessed the system before the update.
6. Take appropriate temporary precautions. If a critical system cannot be patched promptly, follow the relevant security authority's guidance and assess whether temporary isolation or taking the service offline is necessary.
For organizations in India, CERT-In's advisory provides additional guidance.
Conclusion
The discovery of two critical PHP vulnerabilities shows how AI-assisted research can expose serious weaknesses in foundational software, even after those weaknesses have remained hidden for years.
It also demonstrates why organizations cannot rely solely on a technology's age, popularity, or previous testing history as proof of security.
For website owners, the immediate priority is to identify affected PHP installations, apply the relevant security updates, and investigate potential exposure.
For the wider software industry, the lesson is clear: AI is changing the speed of vulnerability discovery, making timely patching and responsible security maintenance more important than ever.
At Aavitech Solutions, we believe reliable software requires continuous attention to security, from development and testing through deployment and maintenance. Keeping underlying technologies updated is an essential part of protecting business applications and customer data.
Frequently Asked Questions
What are the two PHP vulnerabilities discovered in October 2026?
They are CVE-2026-109618 and CVE-2026-109619. Both are critical flaws that can potentially enable remote code execution.
Did AI discover the PHP vulnerabilities?
AI tools assisted researchers at Calif and Wiz in identifying and investigating the flaws. Researchers and maintainers then validated the findings and developed security fixes.
Are WordPress websites affected?
A WordPress website may be affected if its underlying PHP runtime is vulnerable. Website owners should check their hosting environment and apply the relevant PHP security updates.
What happens if a website does not update PHP?
An exposed vulnerable server could be at risk of unauthorized code execution, data access, or further compromise. The actual risk depends on the environment and applicable security controls.
Is updating PHP enough to secure a compromised website?
Not necessarily. Updating addresses the vulnerability, but administrators should also investigate suspicious activity if the system was exposed before patching.
References