PHP's Core Flaw: AI Found It Fast, Patching 70% of the Web Is the Hard Part

On October 21, 2026, PHP's developers released emergency updates fixing two critical vulnerabilities in the core scripting language that powers roughly 70% of websites worldwide. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, include memory disclosure and unauthenticated remote code execution in PHP itself — not in any application built on top of it. Every PHP version released in the last decade, back to 5.4, is affected by at least one. Government agencies urged organizations to take sites offline until they could be fixed. PHP's maintainers said all users should update immediately.

The discovery path is the part that matters. Wiz Research independently found and reported both vulnerabilities. OpenAI said it identified a critical flaw using GPT-5.6 Sol as part of its Patch the Planet initiative. PHP maintainers led the fixes, with Wiz and Cloudflare contributing coordination. Separately, Anthropic's Project Glasswing — launched about a month earlier with roughly 50 partners — reported using Claude Mythos Preview to find more than ten thousand high- or critical-severity vulnerabilities across systemically important software.

PHP underpins WordPress, Joomla, Drupal, and Wikipedia's MediaWiki. A core-engine RCE flaw puts an enormous number of sites at immediate risk of server takeover, data theft, and defacement. But the deeper shift is structural: AI is now finding vulnerabilities faster than humans can verify, disclose, and patch them. The bottleneck has moved from discovery to remediation.

That reframes the PHP episode. It is less a story about one bad patch than about an emerging AI-driven vulnerability-discovery era. When AI agents can surface thousands of high-severity flaws in weeks, the limiting factor is no longer finding bugs — it is the human pipeline for confirming them, coordinating disclosure, and getting patches deployed across millions of installations, many run by operators with no security team.

What Defenders Should Do

Update PHP to the latest patched release immediately. If you cannot patch within hours, take affected sites offline — government agencies recommended exactly that.