Critical security vulnerabilities in the PHP web scripting language, potentially affecting a vast number of internet sites, have been identified with the assistance of artificial intelligence. The PHP Foundation released emergency patches for versions 8.2, 8.3, 8.4, and 8.5 following the discovery of these flaws, which had been present in the codebase for over a decade. The vulnerabilities, collectively known as "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619), could permit attackers to execute unauthorized code on servers, potentially leading to data theft or complete system compromise.
The discovery highlights a new phase in cybersecurity where AI tools accelerate the identification of deep-seated software weaknesses. Researchers at Wiz and Calif, working with advanced AI models, were instrumental in uncovering these flaws. These AI-assisted discoveries underscore a growing concern that while AI can aid defenders in finding vulnerabilities, it can also significantly shorten the time attackers have to exploit them before patches are applied. The speed at which exploits were developed after the vulnerabilities' disclosure has intensified this concern, with reports of exploitation attempts occurring even before the public announcement of the flaws.
The vulnerabilities stem from memory management and error handling within PHP. Specifically, CVE-2026-109618 involves memory corruption during error handling, where incomplete data might be misinterpreted, while CVE-2026-109619 concerns internal request state surviving after its memory has been freed, potentially being reused by subsequent requests. These issues are particularly serious because they reside in core components of PHP that are accessed with nearly every request, making them difficult to fix without impacting compatibility or performance.
The potential impact is substantial, as PHP powers an estimated 70% of all websites globally, including those built on popular content management systems like WordPress and Drupal. While not every PHP installation is vulnerable, the widespread use of the language means millions of websites could be at risk. Organizations have been urged to update their PHP installations immediately, with particular focus on internet-facing systems. However, older versions of PHP, such as PHP 8.1 and earlier, are no longer receiving security updates and will remain vulnerable, necessitating an upgrade to a supported version.
The rapid development of exploits following the disclosure has created a race against time for system administrators. Cybersecurity experts warn that the pace of AI-driven vulnerability discovery and exploitation is accelerating, potentially leading to a "vulnerability tsunami" where the security community struggles to patch critical infrastructure quickly enough. This incident serves as a stark reminder of the evolving threat landscape and the imperative for swift security patching in the age of advanced AI.