Two critical PHP vulnerabilities, found with the help of AI security tools from OpenAI and Google's Wiz, were patched on 21 October. Within hours the US National Security Agency told website owners that any server it could not update straight away should be taken offline until it could be. PHP runs most of the web, so the warning reaches far beyond one company or one country.
The episode is also the clearest test so far of a question regulators have been circling for a year: what happens when AI finds serious bugs faster than open-source projects can fix them, and faster than disclosure rules were designed for?
What the PHP vulnerabilities allow
The PHP Foundation published fixes in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Its security post describes two flaws:
- CVE-2026-109618, a remote code execution bug triggered when a request hits PHP's memory limit at the wrong moment. Internal data is left half-built and later treated as valid. On Apache with mod_php, the Foundation says an unauthenticated request could trigger it before any application code runs, and full remote code execution was shown with default settings.
- CVE-2026-109619, a use-after-free in which a fatal error leaves internal state pointing at memory from a previous request. The Foundation says remote code execution was demonstrated against a real application on Apache with mod_php.
The Foundation puts the severity at a CVSS score of 9.2. It says a score of 10.0 that circulated before release was wrong. At the time of disclosure, it reported no working exploits in the wild.
TechCrunch, citing W3Techs, says PHP powers roughly 70% of websites, including those built on WordPress. WordPress said the flaw is not specific to its software, so site owners have to patch the server itself, usually with their host.
How AI tools found decades-old bugs
The timeline in the Foundation's post shows several teams converging on the same root cause over the summer.
- A PHP core developer paid by the Foundation found early signs while fixing an issue from a 2024 audit by Quarkslab.
- Calif, a security firm working under OpenAI's "Patch the Planet" programme, reported unconditional remote code execution on 11 August. OpenAI says Calif used GPT-5.6 Sol to find it.
- OpenAI reported the same root cause that day and sent further attack paths on 18 September.
- Wiz reported attack vectors on 24 August. According to TechCrunch, Wiz used its Wiz Atlas agent along with Gemini 4 Argon and GPT-5.6 Sol.
Wiz's write-up makes the point that matters for policy. The bugs were known to be hard to exploit, and that difficulty had kept them safe in practice. "With AI this is no longer a barrier," the company wrote. TechCrunch reports that the flaws date back to PHP 5, released in 2004.
The Foundation says it now uses AI too. Alpha-Omega scanned PHP with Anthropic's Claude Mythos earlier this year, and the security team has added OpenAI's Daybreak Red to check incoming reports and exploits. People still make the final calls and write the patches, the post says. Since 1 July the team has published 15 CVEs and handled more than 100 reports that were invalid, duplicated or could not be reproduced.
The disclosure did not go to plan
The release was meant for 22 October. On 20 October, around 15:00 UTC, the CVE numbers appeared online with a wrong release time and a wrong score. Calif then published a video by mistake that showed its proof of concept; it was deleted, but copies spread. On the morning of 21 October, Chainguard shipped built images containing the fix before the official release.
"Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release," the Foundation wrote. It moved the release forward to 21 October at 14:00 UTC.
The Foundation was blunt about its own role. It called an earlier delay "a structural failure, caused by both the security team's decision process and its lack of resources." Its security team will now decide by majority rather than consensus, and will bring in leadership earlier on hard cases.
Why regulators should pay attention
Three policy questions come out of this release.
Funding. The Foundation says the fix happened because funding let several people work on it full time, and that the 2024 audit was paid for by Germany's Sovereign Tech Agency. It is asking companies, hosts and governments to sponsor the work. Public money for open-source security is still small next to the number of public services that run on these projects.
Disclosure timelines. Coordinated disclosure assumes a reasonable gap between a private report and public details. When several AI-assisted teams find the same bug in the same month, and one mistaken upload can leak an exploit, that gap shrinks. Our earlier report on AI agents hacking more than 100 sites for about $50 each showed the attacker side of the same shift.
Who gets AI bug-hunting first. OpenAI and Google both ran private programmes and worked with the PHP project before going public. Wiz thanked Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft and Vercel for help testing the patches. Large hosts were therefore ready early. Small hosts, public bodies and businesses in markets with fewer security staff were not part of that circle.
What site owners should do now
- Check which PHP version your server runs. TechCrunch notes that PHP 8.1 and older are no longer supported.
- Move to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or ask your host to confirm in writing that it has.
- If you cannot patch quickly, follow the NSA advice and take the site offline until you can.
- Check that container images, control panels and other bundled PHP builds you rely on have been rebuilt with the fixed versions.
"If you run PHP, it is imperative that you update now," the Foundation wrote. The harder work, deciding how open-source security is paid for when AI keeps finding old bugs, is a job for governments as much as for volunteers.
