Two critical vulnerabilities in PHP, the decades-old programming language that still underpins a majority of the world's websites, triggered a rare, coordinated global security scramble this week after researchers said artificial intelligence tools had made the flaws practical to exploit at scale. Government websites in the Netherlands, Finland, France and Australia went briefly offline Wednesday as agencies rushed to apply emergency patches, and both Wikipedia and the Internet Archive took systems down temporarily as a precaution.
The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed "php2shell" by the security firm that disclosed them, allow unauthenticated attackers to remotely execute code on vulnerable servers and carry a near-maximum severity score of 9.2 out of 10 under the industry's standard scoring system. Cloud security firm Wiz, which led the research, said the underlying flaws had existed in PHP's codebase for years but had gone undetected until AI-assisted analysis made it practical to find and weaponize them.
How AI Changed the Equation
Wiz researchers said they used a combination of Google's Gemini and OpenAI's GPT models during their research, part of a broader pattern security researchers say is reshaping both vulnerability discovery and exploitation. The episode echoes a separate case disclosed earlier this year in which Google's Threat Intelligence Group said it had found the first known instance of attackers using an AI model to help build a working exploit for a different piece of software, a two-factor-authentication bypass bug that was disrupted before it could be used in a mass campaign.
Data from the internet-scanning service Censys, cited by multiple outlets, indicated that roughly 1.5 million of the 2.6 million internet-facing hosts running PHP have no available fix yet installed, leaving a vast attack surface even as the PHP Foundation raced to ship emergency patches. Cloudflare's chief technology officer said the company had already observed "early attacks" attempting to exploit the flaws, though widespread successful breaches did not appear to be underway as of Wednesday.
A Coordinated Scramble
The U.S. National Security Agency urged organizations running affected PHP versions to update immediately or take vulnerable systems offline until they could be patched, guidance echoed by cybersecurity agencies in Europe and Australia. The decision by several governments to proactively pull services offline rather than risk exploitation reflects how seriously security officials are treating the flaw's scale — PHP remains the backbone of a huge share of the public internet, powering everything from small blogs to large government portals and major platforms including, historically, Facebook and Wikipedia.
Security researchers cautioned that the real risk window will likely extend for weeks or months, since many organizations running PHP on legacy infrastructure are slow to apply patches even for critical, widely publicized flaws. The PHP Foundation said it was continuing to monitor exploitation attempts and would issue further guidance as the patching effort continued.
What It Means Going Forward
The episode is likely to intensify debate over AI's dual-use role in cybersecurity: the same tools that let Wiz's researchers find and responsibly disclose the php2shell flaws before large-scale exploitation could, in other hands, just as easily be used to discover and weaponize the next critical bug first. Several security firms said they expect AI-assisted vulnerability research to become standard practice on both sides of the fight within the next year, raising the stakes for how quickly software maintainers like the PHP Foundation can patch and distribute fixes once a flaw is found.
