PHP rushes out emergency patches for two critical bugs AI found first

PHP released urgent security updates on Wednesday to fix two critical bugs. These bugs could let an attacker run their own code on almost any server using PHP, without needing to log in. The release came after two stressful days when websites around the world went offline before a fix was ready.

The updated versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two bugs that can cause unsafe memory use. The bugs are tracked as CVE-2026-109618 and CVE-2026-109619. Both received a score of 9.2 on the CVSS v4 security risk scale, according to the PHP project. The project said that installing the update was “the only safe choice”. The risk is greatest for websites using Apache with mod_php. In these setups, an attacker can trigger a bug by sending a request, before the website's own code even starts running.

What makes this release unusual is how the bugs were found. Security company Calif found the first bug in August, with help from OpenAI's GPT-5.6 Sol AI model. This happened during a review of PHP's source code, paid for by OpenAI through its Patch the Planet initiative. Google's Wiz team said it found the bugs independently several weeks later. It used Wiz Atlas, Google's Gemini 4 Argon and GPT-5.6 Sol. PHP's security notice gives credit to researchers from Calif, Wiz and OpenAI.

The companies disagree on what it means

OpenAI said the discovery shows that AI can find serious weaknesses affecting large parts of the internet before criminals do. The company calls this a Defender's Window.

“Given the severity of these flaws and PHP's widespread use, we consider this one of the most impactful security issues in recent memory,” OpenAI wrote.

OpenAI has promised $1bn in discounted access to its Daybreak cyber programme to help defenders who lack enough resources. Calif took a more cautious view. In its own report, the company said it used only AI models that anyone could access and did not use special tools. It said that understanding PHP's history mattered more than the AI model itself.

“No model is simply capable of unearthing ‘all bugs’ with simple prompts. At least for now,” the company wrote.

OpenAI's AI models helped researchers find critical security flaws in PHP.

OpenAI (@OpenAI) October 21, 2026

Websites went dark before the patch

Governments and companies acted before the fix was available. The EU's cybersecurity agency CERT-EU and the UK's National Cyber Security Centre (NCSC) both advised organisations to take affected systems offline if they could not update them right away. The US National Security Agency also issued an alert. Bookmarking service Pinboard, the GrapheneOS forum and the OBS streaming tool took parts of their websites offline. Laravel stopped its Cloud deployments while it rebuilt them using updated software images.

The update also arrived earlier than planned. PHP had scheduled its release for 14:00 UTC, with restrictions on sharing details due to end the following day. The team moved the release forward after information about the bugs leaked in a post on Hacker News, the Wall Street Journal reported. Security company watchTowr confirmed that the bugs were real before any fix was available. A working example of an attack, known as a proof-of-concept exploit, then spread online.

Volker Dusch, a security engineer at the nonprofit PHP Foundation, told the Wall Street Journal that this was the most serious problem PHP had faced in more than ten years. He compared it to Heartbleed, a bug discovered in 2014 that triggered a worldwide race to install fixes. Wiz compared the PHP bugs to both Heartbleed and Log4Shell. Wiz estimates that PHP powers about 70% of all websites.

More than a decade of exposure

PHP did not say which oldest version was affected. But Calif, Wiz and Cloudflare all said the bugs could affect PHP 5.4 and newer versions. That means more than ten years of PHP releases may be involved. Because the bugs were so serious, the PHP team also released fixes for older versions 7.4, 8.0 and 8.1, even though these versions are no longer officially supported. The team warned that changing settings cannot fully replace installing the update. WordPress, which runs on PHP, also urged website owners to update. It pointed out that PHP versions older than 8.2 no longer receive security fixes.

Companies that provide internet services took steps to block attacks while people waited for updates. Cloudflare said it enabled web application firewall rules for all its customers, including those using free accounts, at 03:02 UTC. The company said this was about nine hours before the bugs were publicly disclosed. It watched attackers change their attack attempts to get around the rules as the rules were put in place.

The PHP fixes are now live. Start installing the updates. Huge thanks to everyone who worked together, including @ThePHPF!

Dane Knecht (@dok2001) October 21, 2026

This is the second time in a few months that AI has helped find bugs in web software that led to large numbers of updates. In July, bugs in WordPress were widely attacked. OpenAI said the PHP bugs are among several serious security weaknesses it has already discovered. The company expects “similar findings to increase sharply” in the coming months. For now, PHP says the only reliable fix is to install the update.