Cyber A.I. ProsGet My Free Prototype
Menu

A.I. news · October 22, 2026

OpenAI and Google's A.I. Helped Find Critical Website Flaws — Patch PHP Now

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities allowing unauthenticated remote code execution.

🚨 What happened and what to do first

If your website runs on PHP, update it today. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical flaws. Either one could let an attacker run code on a server without logging in.[1]

PHP is the language behind a huge part of the web. It reportedly powers about 70% of websites, including WordPress, Drupal and MediaWiki.[2]

🔎 How serious are these flaws?

The two flaws are CVE-2026-109618 and CVE-2026-109619. Each one scores 9.2 on the CVSS severity scale.[2]

All PHP installations that serve web requests are at risk. The risk is highest for a setup called mod_php, where PHP says an exploit has been shown to run before the website's own code.[1]

Wiz says it showed code running against WordPress, Drupal and Joomla.[2]

Cloudflare says the vulnerability leaked before the official release date. It also says it saw attack traffic aimed at its customers.[3]

🤖 Where A.I. fits in

Wiz Research says it used A.I. models to find the bugs, build test attacks and check the fixes. Researchers from Wiz, OpenAI Codex Security and Calif worked with the PHP security team.[2]

✅ Your update checklist

First, list the sites and apps you run on PHP. Start with anything open to the internet, as the UK's NCSC advises.[4]

If a host runs your site, ask them to apply the update. Updating WordPress or your plugins won't help, because the flaws are in PHP itself.[3]

Linux vendors got the patches in advance. For example, Ubuntu 24.04 LTS has a fixed PHP 8.3 package numbered 8.3.6-0ubuntu0.24.04.13.[1][5]

Our take: an older-looking version number can still be safe. Ask your host to confirm the PHP serving your site is fixed for both flaws, and which build and advisory prove it.

If you run your own server, Wiz says to install a fixed PHP release on every runtime and restart workers.[2]

Cloudflare turned on default protection for free and paid WAF (web firewall) customers from October 21 at 3:02 am UTC. It still says to patch PHP.[3]

If you can't fix it today, ENISA says to consider isolating exposed apps until fixes are applied. PHP 8.1 and older no longer get updates from the PHP project, so ask your vendor about those.[6][1]

❓ What we still don't know

EU bodies and the UK's NCSC both urge immediate action.[6][4]

The sources we have don't say how many sites have been broken into, so we won't guess.

💡 Our take: what this could mean for you

  • Ask your host today to confirm the PHP serving your site is fixed for both flaws, and which build and advisory prove it.
  • Don't judge by the version number alone, and remember that updating WordPress or plugins won't fix this.
  • If you can't patch today, consider taking exposed apps off the public internet until you can.

Have a business or a business idea? 🚀

Trinity builds a free, personalized website prototype for it — no credit card.

Get my free prototype

Get the weekly A.I. news email

Weekly A.I. news. We email a confirmation link first; unsubscribe anytime.

Sources

  1. PHP: News Archive - 2026 — PHP (php.net)
  2. PHP2Shell — AI uncovers critical vulnerabilities in the backbone of the web — Wiz Research (php2shell.com)
  3. Cloudflare deploys protections against php2shell vulnerability — Cloudflare
  4. Critical security issue affecting PHP — NCSC (UK)
  5. USN-8948-1: PHP vulnerabilities | Ubuntu security notices | Ubuntu — Ubuntu (Canonical)
  6. Joint statement on critical PHP vulnerabilities | ENISA — ENISA