AI helped discover the PHP vulnerability that could take down 70% of the internet. Now, the race is on to patch it before AI-powered hackers attack
Fortune Emily Forlini ● Covered by 3 sources
PHP got two critical holes and an emergency patch today. They may let attackers run code across huge chunks of the web if sites don’t move fast.
Based on reporting by Fortune, Emily Forlini — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
The PHP Foundation has pushed out an emergency fix after disclosing two critical vulnerabilities in PHP, the open-source language that runs a huge share of the web. The bugs are now tracked as CVE-2026-109618 and CVE-2026-109619, and the foundation’s advice is blunt: patch immediately or take your site offline until you can.
That warning was not theoretical. Before the official release, opportunistic attackers were already trying to use the flaw, according to Cloudflare CTO Dane Knecht, whose company says it protects millions of websites. One startup founder said the bug was “real bad” after hackers allegedly stole source code, exposed cookie data and leaked legal documents. Government agencies in the Netherlands and Finland have also taken sites offline as a precaution, Reuters reported.
The scale is the uncomfortable part. Python and JavaScript may get the cultural attention, but PHP is still everywhere, from WordPress-powered sites to Microsoft.com, Wikipedia.org, Archive.org, TheGuardian.com and Baidu.com, according to W3Techs. Reuters said WordPress powers roughly 40% of all websites. Palo Alto Networks’ first look found 22.6 million potentially vulnerable instances.
Security officials have started moving in a pack. The FBI’s cyber division, the National Security Agency, Japan’s prime minister, the EU’s computer emergency response team and other national agencies all urged organizations to update. Researchers told Fortune the flaw can let attackers remotely execute code on unpatched PHP systems, then use that machine as a way into the wider network.
What makes this story stranger is who found it. OpenAI said its GPT-5.6 Sol model helped uncover the issue, alongside other AI tools, and multiple groups had independently found parts of the bug in August before joining a coordinated disclosure effort with the PHP Foundation. OpenAI said the flaw had existed in PHP for 14 years. AI didn’t invent the hole. It helped shine a floodlight on it, and that changes the tempo for both defenders and attackers.
My take — AI-written commentary, not fact-checked reporting
This is the part where the industry pretends surprise is a strategy. Open-source software does not fail because it is open; it fails when everyone assumes someone else is watching. AI just made the watching faster, and the exploit-writing faster too, which is a lovely upgrade for nobody.
Read more about this at: Fortune