Some websites go offline over critical PHP flaws found using AI
Wiz says the flaws sat in PHP for more than a decade before AI tools helped expose them.
Some governments and other organisations took websites offline temporarily on 21 October as the PHP project released fixes for two critical flaws that security firm Wiz says it found with the help of AI.
The PHP project’s security advisory says the flaws can allow unauthenticated remote code execution, and that all PHP installations serving web requests are at risk. The project rates the risk highest for Apache with mod_php.
For mod_php, the project has a demonstrated exploit where an unauthenticated request can trigger the attack “before any application code runs”.
The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and the project said in a notice on 20 October that both are rated 9.2 on the CVSS v4.0 scale.
Which versions are fixed, and what to do
| branch | fixed in | note |
|---|---|---|
| PHP 8.5 | 8.5.12 | update released |
| PHP 8.4 | 8.4.27 | update released |
| PHP 8.3 | 8.3.36 | update released |
| PHP 8.2 | 8.2.35 | end of life on 31 December 2026 |
| PHP 8.1 and older | no project update | vendors may offer their own fixes |
PHP 8.1 and older no longer receive updates from the project, though some Linux distributions and long-term-support vendors provide backported fixes. For people who build PHP from source or have no access to a long-term-support vendor, the security team also published minimal backports for PHP 7.4, 8.0 and 8.1.
The advisory says only an update is a complete solution. Its stopgaps, such as a low post_max_size or switching off session.upload_progress.enabled, “reduce exposure to specific attack paths but do not make an installation safe”.
Wiz said defenders should pay particular attention, until systems are patched, to unusual multipart requests followed by memory-limit errors or repeated HTTP 500 responses, among other signs.
How Wiz says it found them
Wiz Research said in a blog post on 21 October that it used Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol throughout its research. The company says the vulnerable code had been in PHP for more than a decade, and that every PHP version released in the last decade is affected by at least one of the flaws, going back to version 5.4.
Turning the flaws into working exploits required a chain of steps “at the edge of what human researchers could practically achieve”, Wiz said, and frontier AI models substantially reduced that barrier. Wiz says it demonstrated unauthenticated code execution on WordPress, Drupal and Joomla using their latest container images at the time of testing.
Websites taken offline
The Finnish government’s website was only partly available on 21 October, the Associated Press reported, with a message to visitors saying that government websites were fully or partially unavailable while the issue was being resolved.
The FBI’s cyber division warned that the flaws could let malicious actors run code remotely, and recommended that operators take websites offline if they cannot update immediately.
