Businesses
AI Uncovers Critical PHP Security Flaws, Putting Millions of Websites at Risk: What Businesses Need to Know
26 Oct 2026
Two critical vulnerabilities in PHP, a programming language used across millions of websites, highlight how artificial intelligence is accelerating both cybersecurity research and potential cyberattacks. With more than 22.6 million publicly exposed PHP instances identified as potentially vulnerable, businesses face growing pressure to secure their digital infrastructure.
Artificial intelligence is changing the speed at which software vulnerabilities can be discovered, tested and potentially exploited. Two critical security flaws in PHP, a programming language widely used across the internet, have brought this challenge into focus, raising concerns about the security of enterprise websites, applications and digital infrastructure.
Disclosed on 21 October 2026, the vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow attackers to execute malicious commands on affected servers without valid login credentials.
According to reporting by IBM Think journalist Sascha Brodsky, security researchers at Wiz used AI agents to help discover, combine and test the vulnerabilities. Palo Alto Networks' Unit 42 subsequently reported malicious activity involving the flaws, increasing the urgency for organisations to investigate their exposure.
The vulnerabilities affect PHP itself rather than a particular website or content management platform, creating potentially widespread implications for businesses operating web applications built with technologies such as WordPress, Drupal and Laravel.
How AI Helped Uncover Critical PHP Vulnerabilities
The newly disclosed vulnerabilities involve memory-management problems within the PHP runtime. Under certain conditions, these flaws could allow attackers to execute code remotely without authenticating themselves.
Because PHP processes incoming web requests before application-level code runs, weaknesses in the underlying language runtime can affect multiple types of websites and services.
Researchers at Wiz used AI-assisted security analysis to identify and investigate the vulnerabilities, combining automated reasoning with human expertise to develop and validate working demonstrations.
The discovery illustrates how AI is becoming increasingly useful in cybersecurity research, particularly when identifying complex weaknesses that might otherwise require substantial manual investigation.
However, the same capabilities can create challenges for defenders. Once vulnerabilities become publicly known, attackers may also use automated tools to accelerate reconnaissance and attempted exploitation.
In an IBM Think report published on 22 October, Mark Hughes, IBM Global Managing Partner for Security Services, warned:
Critical PHP flaws may let attackers run commands without signing in. Patch now; isolate what cannot be fixed.
His warning highlights the importance of responding quickly when vulnerabilities affect widely deployed software components.
More Than 22.6 Million PHP Instances Potentially Exposed
The scale of PHP adoption makes the vulnerabilities particularly concerning for organisations operating internet-facing applications.
According to IBM Think's reporting, Palo Alto Networks identified more than 22.6 million publicly exposed PHP instances that may be vulnerable.
That figure represents potential exposure rather than confirmed security breaches. Not every identified instance is necessarily exploitable, and the number should not be interpreted as the total number of compromised websites.
Nevertheless, the findings demonstrate how a security weakness in a common software component can create risks across a large number of organisations.
Businesses using PHP-based applications may be affected regardless of whether they developed the software themselves or rely on third-party platforms.
PHP processes web requests before WordPress, Drupal, Laravel or other application code runs,” Hughes explained. “All PHP systems serving web traffic need review.
The vulnerabilities are particularly significant for enterprise environments with multiple websites, legacy applications, cloud services and containers, where identifying every affected PHP installation can be challenging.
Why AI Is Changing the Cybersecurity Response Window
The vulnerabilities also raise broader questions about how AI is reshaping the relationship between cybersecurity researchers and malicious actors.
Traditionally, discovering complex software weaknesses and developing working exploits could require extensive technical analysis. AI-assisted research can accelerate parts of this process, reducing the time between vulnerability discovery and the emergence of potential attacks.
IBM's newsletter also cited its 2026 Cost of a Data Breach Report, stating that AI-driven attacks had increased by 56% compared with the previous year.
The company highlighted the growing use of AI-generated impersonations, malicious software and other automated techniques in cybercrime.
IBM Senior Vice President Rob Thomas warned that faster vulnerability discovery and exploitation are placing additional pressure on organisations to identify weaknesses and deploy fixes.
This changing environment creates a dual challenge for businesses. Security teams must improve their ability to detect vulnerabilities while ensuring that software updates, access restrictions and incident-response procedures can keep pace.
Artificial intelligence can support defensive operations, but its effectiveness depends on how organisations integrate these capabilities into existing security processes.
Which PHP Versions Are Affected?
The PHP development team released security updates on 21 October 2026 to address both vulnerabilities.
The fixes are available in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
| PHP version branch | Security update |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
| PHP 8.1 and older | Unsupported upstream; upgrade or consult the vendor about maintained security fixes |
Source: PHP official security releases, 21 October 2026.
The PHP project has confirmed that both vulnerabilities could enable unauthenticated remote code execution and advises organisations to update affected systems immediately. It also states that there are no complete alternative mitigations, making patching the essential response.
What Businesses Should Do to Protect Their Systems
For organisations operating PHP-based websites and applications, the immediate priority is identifying vulnerable software installations and applying the appropriate security updates.
Security teams should examine internet-facing applications, cloud environments, container deployments and older systems that may still rely on outdated PHP versions.
Updating the software alone is not sufficient unless the organisation verifies that the patched runtime is actually being used by its applications.
Businesses should also review available security logs and investigate potentially suspicious activity, including unexpected commands, unusual application behaviour and unexplained outbound network connections.
Systems that cannot be updated immediately may need to be isolated from public networks until appropriate protections are implemented.
Particular attention should be given to Apache mod_php configurations, which IBM and the PHP project identify as presenting significant risks because of how PHP operates within the web server.
The wider lesson for businesses is that vulnerability management must account for the underlying technologies supporting websites and enterprise applications, not only the software visible to end users.
The Future of AI-Assisted Software Security
The PHP vulnerabilities demonstrate both the opportunities and challenges associated with using artificial intelligence in cybersecurity.
For security researchers, AI can help identify previously overlooked weaknesses, analyse complex systems and accelerate the development of software fixes.
For businesses, however, faster discovery also means that the period available to respond to emerging threats may become shorter.
IBM has highlighted Lightwell, an initiative combining AI with human expertise to help address vulnerabilities in open-source software without always requiring major upgrades.
Such approaches illustrate how AI could contribute to more efficient software maintenance and security remediation.
However, automated tools do not eliminate the need for technical oversight, accurate asset inventories and established governance processes.
The discovery of the PHP vulnerabilities reinforces a fundamental cybersecurity priority: organisations must understand the software components their operations depend on and maintain the ability to update them quickly.
As AI accelerates the discovery and exploitation of security weaknesses, businesses that strengthen their vulnerability management, monitoring and incident response capabilities will be better positioned to protect their digital infrastructure.
Sources
- IBM Think — Sascha Brodsky, 22 October 2026: Critical PHP Flaws Put Millions of Websites at Risk as Exploit Attempts Emerge.
https://www.ibm.com/think/news/critical-php-flaws-millions-websites-risk-exploit-attempts-emerge - PHP Development Team — Official Security Updates, 21 October 2026: Details of CVE-2026-109618 and CVE-2026-109619 and the updated PHP versions.
https://www.php.net/archive/2026.php - CERT-EU — Critical Vulnerabilities in PHP, 21 October 2026: Technical assessment and recommendations for organisations.
https://cert.europa.eu/publications/security-advisories/2026-018/ - Google Cloud — Responding to Core PHP Vulnerabilities, 21 October 2026: Information on the vulnerability discovery and AI-assisted security research.
https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619
