Wiz: AI models from OpenAI and Google found decade-old PHP flaw rated 9.2
When details of two critical vulnerabilities in the PHP programming language leaked two days ahead of schedule, governments, healthcare institutions, universities and major web services across Europe took their websites down as a precaution. What makes this story notable for the AI field: security firm Wiz says the vulnerabilities — which had been lurking for ten years — were found using AI models from OpenAI and Google.
What happened
PHP published a security advisory on 21–22 October 2026 patching two critical remote code execution vulnerabilities: CVE-2026-109618, a flaw in out-of-memory handling, and CVE-2026-109619, a use-after-free memory error. Both received a severity rating of 9.2 out of 10, and the fix arrived in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (PHP advisory via TechRadar/Yahoo, 064d8660).
According to PHP, "all PHP installations that serve web requests are affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed." PHP added: "We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs" (064d8660).
The timing was made worse by a leak: information about the vulnerabilities ended up on the internet two days before the planned coordinated publication. That triggered serious alarm, and per Reuters several government, healthcare and education sites in Europe were temporarily shut down as a precaution (064d8660).
How AI was used
The news is not just the flaws, but how they were found. Security firm Wiz said it had used OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon to discover the vulnerabilities, which had existed for ten years. These are company claims relayed through journalists, not independently verified (544434f4).
OpenAI presents the story somewhat differently: in a blog post, the company says it led a coalition of researchers, security vendors and others that worked on the PHP vulnerabilities for two months. "PHP's maintainers led the fix and the release, with our teams and partners such as Wiz, Cloudflare and others contributing research, technical support and coordination to prepare protections before public disclosure," the company writes. It also calls the flaws "one of the most impactful security issues in recent memory" and says AI apparently found them before any attackers did (e2623c95).
The division of credit between Wiz and the OpenAI coalition is not settled in the source material. What is firmly established is that both sides confirm AI tools were a central part of the discovery work.
Why websites were taken down
The list of organisations that closed sites is long: the city councils of Edinburgh, Oxford and Bristol, France's interior ministry, Finland's government, the Dutch parliament, several European universities, the anonymous forum 4chan, and a range of social media and business services. The OBR, NHS Scotland and parts of Wikipedia were also reported down, and Amazon says it detected an exploitation attempt (544434f4, 81dfa2af).
The reason for the precautions is clear from the infrastructure side. Cloudflare's CTO Dane Knecht said hours before PHP released the fix that the company was "seeing early attacks emerging" and updating mitigations as new attack vectors appeared (064d8660). Cloudflare says it logged "millions" of attempts on its network, but there is no evidence any of them succeeded (81dfa2af).
Authorities intervened with unusual forcefulness. The FBI's cyber division warned that the vulnerabilities could let malicious actors execute code remotely in PHP, raising the risk that sensitive data and networks could be compromised. The agency advised operators to take websites offline if they could not patch them immediately. The NSA issued similar advice (e2623c95, 544434f4).
Why AI changes which flaws are dangerous
Here lies perhaps the most important lesson. The vulnerability existed for ten years precisely because it was considered impractical to exploit. Alan Woodward, a professor at the University of Surrey, explains why: "It's actually very, very hard to exploit. It requires millisecond timing. The reason people thought it was too complicated was that it would have taken a team of people forever to find the right timings. But what AI does — it doesn't take tea breaks, it doesn't go home at six o'clock: you can just set masses of them going, and eventually they will arrive at the right answer for how to exploit it" (04711335).
In other words: AI changed not just the discovery of the flaw, but what counts as practically exploitable. A flaw humans shelved as too difficult, AI found first — and in principle the same logic applies to attackers going forward. At the same time, it is worth noting that the flaw is still not easy to exploit: a security researcher BBC technology and AI editor Zoe Kleinman spoke to said he had been up all night trying it as an experiment, without success (1407067c).
The residual risk is large
Figures from VirusTotal, cited by BleepingComputer, show the scale: over 5.1 million PHP hosts are exposed on the internet, of which around 3.8 million have at least one open port (064d8660). PHP 8.1 and older versions do not receive the full fix, meaning a large share of the exposed hosts remain vulnerable.
The episode also reveals an organisational failure. According to a blog post from the PHP Foundation, which stands behind the development and which New Scientist has reproduced, the foundation admits that signals about the vulnerability emerged as early as 2024 — without anything being done (04711335). According to the same coverage, the foundation did not respond to an interview request in connection with the reporting. Every PHP version released over the past decade is affected by at least one of the two vulnerabilities (04711335).
What remains unresolved
Several questions remain open. First: no confirmed successful attacks had been reported as of 22 October, but it is unknown whether any attacks succeeded before the patching — affected companies may lack full visibility. Second: the credit is unsettled. Wiz presents itself as the discoverer, using OpenAI and Google models; OpenAI presents itself as the leader of a coalition that found the flaws before attackers. The sources are not aligned on who deserves the credit, and both accounts are company claims. Third, the sources also disagree about PHP's share of the web — figures like 70 percent, two-thirds and "millions of websites" circulate side by side and cannot be reconciled from the available documentation.
There is also a positive perspective. Gina Neff, professor of responsible AI at Queen Mary University, called the episode a good news story on BBC Radio 4: "We have seen how a team of people supported by the big AI company used AI to find the problem, worked for months together to solve it and made sure everyone is prepared to be safe and secure" (1407067c).
That assessment has something to it: the defence appears to have won this round. But the episode also shows that AI has moved the boundaries of which vulnerabilities are possible to exploit — and that the defenders' margin, this time two days of alarm and shut-down websites, is far too small when the infrastructure is global and maintenance has partially failed for years.