Artificial intelligence has helped security researchers uncover two critical vulnerabilities in PHP, the programming language used by a substantial proportion of the world’s websites.
The vulnerabilities, collectively known as PHP2Shell, could allow attackers to execute malicious code on vulnerable web servers or access sensitive information without authentication.
Researchers from Wiz, Calif and OpenAI used advanced AI models to identify and investigate weaknesses that had remained undetected for years.
The discovery prompted an international response involving software maintainers, cloud providers and cyber security agencies. Emergency patches have now been released, while Cloudflare and other providers have introduced additional protections.
Key facts
- Two critical vulnerabilities have been identified: CVE-2026-109618 and CVE-2026-109619.
- Both involve memory-handling weaknesses within PHP itself.
- Researchers demonstrated remote code execution against affected web applications.
- AI models helped researchers discover and investigate the vulnerabilities.
- Emergency updates are available for supported PHP versions.
- Cloudflare has deployed additional web application firewall protections, but these do not replace patching.
Our take
This is one of the most significant examples yet of AI accelerating vulnerability discovery. The positive development is that AI-assisted research helped defenders identify serious weaknesses and coordinate protections before widespread exploitation.
However, the same capabilities could allow attackers to discover and exploit vulnerabilities much faster.
For New Zealand organisations, the immediate priority is identifying affected PHP installations, applying security updates and checking for evidence of compromise where appropriate.
This reinforces the need to shorten the time between vulnerability discovery, assessment and remediation.
Traditional vulnerability management and incident response processes may struggle to keep pace as AI accelerates both defensive research and offensive capabilities.
