AI-assisted research helped identify two critical PHP flaws, patched Oct. 21, and the response involves report triage by maintainers and urgent system inventory and patching by operators.
W3Techs said PHP was used by 69.2% of websites whose server-side language it could identify on Oct. 30. That share does not show how many sites run affected versions or remain unpatched. PHP rated CVE-2026-109618 and CVE-2026-109619 at 9.2 on the CVSS v4.0 scale; the fixes are in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The project’s Oct. 21 release of fixes for two critical flaws followed research involving Calif, OpenAI and Wiz.
The PHP Foundation said Calif began auditing PHP on July 30 and a Calif researcher reported an unconditional remote-code-execution flaw on Aug. 11. OpenAI said Calif used its GPT-5.6 Sol model. The Foundation said OpenAI independently reported the same root cause and Wiz found additional attack paths; OpenAI’s account says Wiz independently discovered and reported both flaws. PHP maintainers led the fixes.
OpenAI said it believed AI tools found the flaws before attackers did. Amazon Web Services (AWS) later reported an attempted exploit against a honeypot on Oct. 17, four days before public disclosure. AWS could not establish how the actor learned about the flaw or whether the attempt would have worked against a real system. The Cybersecurity and Infrastructure Security Agency (CISA) said it had not observed exploitation when it issued an alert on Oct. 21.
Palo Alto Networks’ Unit 42 reported active exploitation on Oct. 29 against internet-exposed management interfaces on PAN-OS firewalls. Dream Research reported that a campaign had rooted 25 PAN-OS firewall and management servers. Dream also said it found AI tools configured in the attackers’ infrastructure, but had no direct evidence they were used to create the exploit or follow-on scripts. Unit 42 said it verified the attackers’ tools and Dream’s reported results.
The workload extends beyond PHP. Mozilla said Firefox releases fixed 423 security bugs in April 2026, including 271 identified with Claude Mythos Preview. Google said Chrome 149 and 150 fixed 1,072 bugs, more than the previous 23 milestones combined. The figures reflect different release periods and processes.
The PHP Foundation said it had published 15 CVEs since July 1 and reviewed more than 100 reports that were invalid, duplicates or could not be reproduced. It said people made the decisions and worked on every patch. Its 2025 report recorded $730,534 in sponsor and individual contributions and 11 contracted developers at year-end. Expenses exceeded donations by about $139,000 as the Foundation maintained technical staffing, though it also described itself as financially solvent with healthy reserves.
Mozilla uses “patch gap” for the period after a fix enters the codebase and before it reaches most users, and warns that AI can help attackers analyze fixes before updates are widely installed. CISA advised organizations to inventory all PHP installations, including those embedded in other software, then apply fixes promptly, prioritizing internet-facing systems. The PHP project will stop issuing security fixes for PHP 8.2 after Dec. 31, 2026.
