AI identifies critical 14-year-old security flaws in PHP

Researchers have discovered two critical security vulnerabilities in PHP, the programming language used to power a significant portion of the web. The flaws, identified as CVE-2026-109618 and CVE-2026-109619, have existed since 2012 in PHP 5.4.

Both vulnerabilities received a severity score of 9.2 out of 10, as they allow attackers to execute arbitrary code on servers running the affected software. The flaws were initially spotted by Calif’s team on August 1 with the assistance of artificial intelligence. OpenAI and Wiz also independently identified the bugs, with OpenAI noting its involvement in preparing fixes before the public announcement.

The PHP Foundation released patches on October 21. Following the leak of the bug IDs, the NSA advised users unable to update immediately to take their systems offline, while Amazon reportedly observed attack attempts prior to the news becoming public.