AI just found a flaw in software running most of the web! One request hijacks the server

PHP is the quiet workhorse of the internet — the programming language running behind a huge share of the websites you use every day. This week, researchers revealed that it has been carrying critical, exploitable flaws, and that artificial intelligence helped find them.

The Flaws

The vulnerabilities, collectively named PHP2Shell, are two critical bugs in PHP's core engine, formally logged as CVE-2026-109618 and CVE-2026-109619. They allow 'unauthenticated remote code execution' — meaning an attacker who has not logged in, and needs no credentials, can run their own commands on the server.

By PHP's own severity rating they score 9.2 out of 10; one security firm, watchTowr, rated one of them a maximum 10.0. A working exploit has already shown that a single web request can trigger the attack before the site's own application code even runs, with servers using a common setup called mod_php the most exposed.

The Scale

The reason this set off a global scramble is reach.

PHP runs roughly 70 per cent of all websites in the world. That figure describes how widespread PHP is, not how many sites are confirmed vulnerable — as CNBC notes, not every PHP site is necessarily exposed. But the potential blast radius is enormous, which is why companies including Google, OpenAI and Amazon moved quickly to respond, and PHP shipped emergency patches on October 21.

The AI Twist

The detail that makes this more than a routine patch story is how the flaws were found.

The bugs had, in effect, been sitting in the code for a long time. What changed is that researchers used frontier AI models to hunt for them — reportedly using an OpenAI model as part of a project aimed at finding and fixing vulnerabilities in widely used software before attackers do. The security firm Wiz said AI 'substantially reduced the barrier' to turning a longstanding, hard-to-spot weakness into a working exploit.

That cuts both ways, and this is the uncomfortable part.

The Double-Edged Sword

The same capability that let defenders find PHP2Shell can let attackers find the next one.

Used by the good guys, AI becomes a tireless auditor, surfacing dangerous bugs in critical software so they can be fixed — a genuine gift to security. Used by the bad guys, the same tools lower the skill and effort needed to discover and weaponise flaws at scale. PHP2Shell is a clean illustration of both faces at once: AI found it in time to patch it, and AI makes it more likely that something equally serious will be found by someone with worse intentions.

The Fair Point

In fairness, this instance is a win for the defence. The flaws were found by researchers, responsibly disclosed, and patched before any mass exploitation was reported. 'AI helped find a bug so it could be fixed' is, on its own, good news. The worry is structural, not about this case: a world where finding critical vulnerabilities gets dramatically easier rewards whoever moves fastest — and that is not always the defender.

What To Watch

How quickly the huge population of PHP servers actually gets patched, because unpatched ones will be targeted. Whether attackers use the same AI-assisted techniques to find the next PHP2Shell. And whether 'AI finds the vulnerabilities first' becomes a durable advantage for defenders or an arms race that favours offence.

For now the advice is blunt: if you run anything on PHP, patch it now.