AI exposes a hidden flaw threatening 70% of the web

AI models helped uncover PHP2Shell, a critical vulnerability buried in PHP for years that puts most of the Internet at risk

October 22, 2026

AI exposes a hidden flaw threatening 70% of the web

Artificial intelligence has helped expose one of the most serious security threats to the web in years. Researchers used advanced AI models to uncover critical vulnerabilities in PHP, the server-side programming language that powers around 70% of websites worldwide. Dubbed PHP2Shell, the flaws could allow attackers to execute malicious code on vulnerable servers, access sensitive data, and compromise websites without authentication.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, affect PHP’s core engine rather than a specific website or application. They stem from memory-management errors that can occur when a request fails unexpectedly. Under certain conditions, PHP may continue using corrupted or already-released memory, creating an opportunity for attackers to manipulate server processes.

The discovery highlights how AI is changing vulnerability research. Security teams from Calif, Wiz, and OpenAI used advanced AI models GPT-5.6 Sol and Gemini 4 Argon to analyze PHP’s source code, investigate complex memory-safety issues, develop working exploits, and validate fixes. The flaws had remained difficult to exploit for years, but AI-assisted analysis and iterative testing helped researchers turn them into practical attack methods.

The impact extends across the web ecosystem. Researchers demonstrated remote code execution against widely used platforms, including WordPress, Drupal, and Joomla. Because the vulnerabilities reside in PHP itself, even applications with otherwise secure code may be exposed if they run an affected version (going back to PHP 5.4).

The PHP development team released emergency security updates on October 21, 2026. However, the risk did not end with the public disclosure. According to Amazon Threat Intelligence, exploitation attempts targeting its honeypot infrastructure were observed as early as October 17, four days before the vulnerabilities were publicly announced. Additional attempts appeared around the time the fixes were released.

This case illustrates a growing challenge for cybersecurity teams. AI can accelerate vulnerability discovery and help defenders develop patches, but it can also help attackers analyze security updates and adapt exploits to different environments. As the technical expertise and time required to exploit complex flaws decrease, the window between disclosure and widespread exploitation may shrink dramatically.