Two critical vulnerabilities in PHP’s core engine, uncovered independently by AI tools from Calif and Wiz, left every version since 5.4 open to unauthenticated remote takeover. A leak before the patch was ready sent attackers probing within hours and pushed France, Finland, Japan and the US to take public sites down.
On October 21, 2026, a global cybersecurity alert was triggered after advanced artificial intelligence models discovered a catastrophic pair of vulnerabilities lurking deep within the core engine of PHP, the programming language that powers roughly 70% of the internet. Dubbed “PHP2Shell” (specifically tracked as CVE-2026-109618 and CVE-2026-109619), the emergency forced governments in France, Finland, Japan, and the U.S. to temporarily take vital public websites offline to patch their systems.
The discovery has sent shockwaves through the tech community, not just because of the scale of the threat, but because it highlights a major paradigm shift: AI is now independently uncovering structural flaws that human researchers missed for decades.
The PHP2Shell Flaws: What Happened?
The vulnerabilities are memory-safety flaws inherent to the core PHP engine itself, completely independent of whatever application code a developer has written on top of it. Every single version of PHP released over the last decade (dating all the way back to version 5.4) is affected.
- The Technical Threat: PHP2Shell allows for unauthenticated Remote Code Execution (RCE) and memory disclosure.
- The Impact: Attackers can remotely bypass security parameters without any login credentials, access a server’s file system, steal database contents, deface the website, or completely hijack the underlying infrastructure.
- The AI Connection: According to security firm Wiz, the flaw was virtually invisible because proving it could be weaponized required an incredibly complex chain of exploit steps at the absolute outer edge of what a human brain could map. Advanced AI models bridged that gap instantly.
How AI Uncovered the Bug
The bug was identified using a collaborative effort of autonomous AI vulnerability research tools. The cybersecurity firm Calif first flagged the core issue on August 1 using OpenAI’s GPT-5.6 Sol model during a “Patch the Planet” initiative. Concurrently, Alphabet-owned security firm Wiz independently discovered the flaw using its AI tool Wiz Atlas, backed by Google’s Gemini 4 Argon.
While the AI was used defensively to spot the flaw, it triggered an emergency scramble because the details leaked on social media right before the official patch could be gracefully deployed.
The Global Cyber Scramble
The leak gave malicious actors a temporary blueprint to begin probing the web. Infrastructure providers like Cloudflare immediately registered early attacks attempting to capitalize on the vulnerability.
Because PHP underpins standard software like WordPress, Drupal, and Wikipedia, the threat to global business and state infrastructure was immediate. The US National Security Agency (NSA) and the FBI issued urgent warnings stating that if website operators could not apply the fix immediately, they should take their websites offline until the systems were mitigated.
