AI-discovered PHP flaw puts government websites at risk worldwide
AI-assisted discovery of two critical PHP vulnerabilities has triggered global security warnings, with governments urging immediate patches to protect vulnerable websites and servers.
A critical security flaw in PHP, a programming language used by a large share of the internet, has triggered urgent warnings from cybersecurity agencies worldwide, with some government websites temporarily taken offline as a precaution.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 and collectively referred to as “PHP2Shell,” could allow attackers to execute malicious code on affected servers without requiring login credentials. Depending on the level of access gained, attackers could potentially steal sensitive information, alter data or disrupt online services.
PHP developers released security updates on October 21 to address the vulnerabilities. Agencies in Europe, North America and other regions have urged organisations to identify affected systems and apply the fixes as quickly as possible.
AI helps identify critical vulnerabilities
Artificial intelligence played a role in identifying the security flaws. OpenAI said its Calif research team identified one vulnerability using an AI model, while cybersecurity firm Wiz independently discovered and reported both issues.
The vulnerabilities affect PHP itself, which runs on web servers to support dynamic websites and online applications. This means the risk is not limited to a particular website or content management system.
PHP is widely used across the internet, including by platforms and applications built around technologies such as WordPress, Drupal and Joomla. However, the actual exposure depends on the PHP versions and server configurations in use.
Governments take precautionary action
Several governments and cybersecurity agencies have issued urgent warnings, while some public-facing websites have been temporarily taken offline to allow administrators to apply security updates and assess potential exposure.
The US National Security Agency has urged organisations to prioritise patching PHP-based systems. It also recommended taking vulnerable services offline if they cannot be secured promptly.
The UK's National Cyber Security Centre has similarly advised organisations to identify systems running PHP, prioritise internet-facing services and install the relevant updates. Canada's Cyber Centre has also issued an alert outlining the risks and recommended protective measures.
What makes the flaw dangerous?
The vulnerabilities are particularly concerning because successful exploitation may not require an attacker to authenticate first. This could give malicious actors a route into vulnerable servers, potentially exposing files, databases and other systems connected to them.
The PHP security team has released fixes for supported versions, including PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Organisations should confirm the appropriate update for their installation and follow guidance from their software and hosting providers.
Updating software is only part of the response. Organisations must also investigate signs of compromise because installing a patch does not necessarily remove malicious access that may already have been established.
The incident highlights how a vulnerability in widely used software can create risks across government agencies, businesses and other organisations at the same time. Security teams are being urged to act quickly to reduce exposure and monitor systems for suspicious activity.
