AI found flaws in the code behind 70% of the web. The fix took two months.
The New Stack Amanda Caswell ● Covered by 6 sources
AI helped find two critical bugs in PHP, the code behind most websites. The fix took two months, and attackers were already probing before the public warning.
Based on reporting by The New Stack, Amanda Caswell — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
PHP runs a huge share of the web, so when its core engine breaks, the blast radius is bigger than any one app. This week, researchers said frontier AI models helped uncover two critical flaws in PHP, now tracked as CVE-2026-109618 and CVE-2026-109619 and grouped under the name PHP2Shell. Both score 9.2 on the CVSS v4.0 scale.
The bugs sit in PHP’s error handling, where a crash or memory failure can leave old memory references hanging around for the next request to trip over. That opens the door to use-after-free and type confusion, the kind of memory-safety mess developers keep trying to stamp out by moving sensitive code away from C. Wiz says attackers could use the flaws to pull data out of server memory or run code on WordPress, Drupal, and Joomla without logging in.
The striking part is how long the problem had been sitting there. At least one flaw affects every PHP release from the past decade, and some of the vulnerable code dates back to PHP 5.4. Wiz says the bugs were hard to spot because exploiting them meant chaining together several weaknesses, and that a single researcher working with frontier models did in about a week what might once have taken months from a team.
The reporting timeline was tight, too. Wiz says it found the first flaw on August 19, proved unauthenticated code execution against Drupal the next day, did the same on WordPress on August 21, and reported everything to PHP’s security team on August 24. The team acknowledged it on September 21, then coordinated a fix that landed Wednesday.
Cloudflare says it started default protection for customers at 3:02 a.m. UTC Wednesday, about nine hours before the public disclosure, and saw attack traffic while watching payloads change to dodge the rules. But the company was blunt that a firewall is only a stopgap. Customers still need to patch their PHP installs, and if they use a Linux distro or managed host, they need to check whether the fix was backported without a version bump.
My take — AI-written commentary, not fact-checked reporting
This is the part where security teams pretend the robots are only helping the good guys. They aren’t. AI is now a very efficient bug finder, which means the boring job of patching, backporting, and verifying becomes even more important, not less. The industry keeps buying speed and then acting surprised when speed cuts both ways.
Read more about this at: The New Stack