PHP runs WordPress, Joomla, Drupal and Wikipedia’s MediaWiki. Wiz says the language powers about 70% of websites worldwide. In a coordinated disclosure effort, OpenAI, maintainers, researchers and security providers addressed critical vulnerabilities in PHP’s core engine. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, each rated CVSS 9.2.
A frontier model helped find one of the flaws. OpenAI says GPT-5.6 Sol identified a critical PHP vulnerability as part of its Patch the Planet initiative. Wiz Research independently discovered and reported both vulnerabilities. The case places AI-assisted discovery in the code shared by websites, rather than only in individual applications.
Two CVEs affect PHP’s engine, not a specific application
CVE-2026-109618 covers out-of-memory corruption; CVE-2026-109619 covers stale global state across requests. The PHP2Shell disclosure assigns both a CVSS severity score of 9.2. CVSS rates vulnerability severity; it does not, by itself, establish how exposed a particular deployment is.
Wiz’s technical account describes memory disclosure and unauthenticated remote code execution in PHP itself. RCE can let an attacker execute code on a target system. Because the vulnerable code is in the engine, an application’s own code can be secure and still run on an affected PHP version. The disclosure says even a simple “Hello World” application can be affected.
Wiz reports that every PHP version released in the last decade is affected by at least one of the vulnerability classes, reaching back to version 5.4. That is a broad version range, but it does not establish that every PHP website has been attacked or that all deployments are equally exploitable. Wiz says successful exploitation could allow attackers to take control of affected servers, steal sensitive data or deface websites.
What AI contributed, and what the record shows
The public accounts support a specific claim, not a sweeping one: GPT-5.6 Sol helped identify a critical flaw, and Wiz independently discovered and reported both vulnerabilities. OpenAI describes its role as leading a global response with maintainers, researchers and security providers. The OpenAI account presents the work as coordinated disclosure, not a demonstration that a model replaced the people who verified, reported and fixed the issues.
Wiz says frontier AI models substantially reduced the barrier to turning a longstanding flaw into an exploit. That is important, but it does not mean every model-generated lead is a valid vulnerability or that an exploit works in every environment. The public evidence here does not detail the model’s full workflow or establish that it independently produced a working exploit. The sound conclusion is narrower: AI contributed to finding a serious flaw in a foundational language, while researchers and maintainers remained part of the discovery and response.
Automation in PHP security predates frontier models. The FIXX research paper describes a tool for finding similar instances of known exploits in PHP applications. In an evaluation involving 32 CVE reports and 19 applications, FIXX found 1,097 similar exploitable paths that led to 10 new CVE entries. The Phuzz paper introduces a coverage-guided fuzzer for PHP web applications. These projects show that automated approaches can expand testing in defined settings; they do not establish that any one tool can audit all of PHP’s engine or replace expert review.
The shift is from automated assistance to a larger discovery surface. Frontier models may help researchers inspect code and pursue patterns that conventional tools or limited review time leave unexplored. The PHP disclosures make that possibility concrete, but the available reporting does not provide a measured comparison of model performance against human review. Claims about superior speed or coverage should wait for that evidence.
AI-assisted review faces a verification bottleneck
Over the next 18 months, AI-assisted static analysis will become a standard security gate for software with significant security responsibilities. That is a forecast, not a reported industry policy. Its basis is an economic pressure: codebases are large, expert review takes time, and automated searches can be repeated. If tools surface credible flaws in widely used components, organizations have a reason to run them earlier and more often.
More findings also create work. Each candidate needs reproduction, impact assessment, disclosure handling and a fix. False positives and duplicates consume maintainer time; a discovery tool that produces more reports than a project can triage may shift the bottleneck rather than remove it. The value of AI-assisted analysis will therefore depend on whether it produces actionable findings that teams can verify, not simply on the number of alerts it generates.
That changes the likely shape of security budgets. Periodic penetration testing remains useful for assessing deployed systems, but it answers a different question from source-code analysis of a shared runtime. Organizations may increasingly ask software suppliers how they scan foundational components during development and how they validate machine-generated findings. Those procurement demands are a plausible consequence of the PHP case, not a documented response to it so far.
The prediction is testable: within 18 months, security-sensitive development will routinely include AI-assisted static analysis as a required gate. Evidence against the forecast would be continued reliance on periodic manual review without new development or procurement requirements, or tools that fail to produce findings maintainers can reproduce and fix. The decisive measure will be operational adoption and verified fixes, not demonstrations that a model can spot a bug.
PHP patches turn discovery into a deployment test
The PHP Foundation released two patches for the vulnerabilities, according to NPR’s report. The immediate response is concrete: identify affected installations, apply the fixes and verify that deployed runtimes have been updated. PHP’s reach means that work spans maintainers, hosting providers and site operators, but the sources do not establish how many installations remain unpatched or have been exploited.
The broader risk comes from shared dependencies. A website can inherit an engine flaw even when its application code is secure, and PHP’s use across major platforms gives a core vulnerability potential reach beyond one product. That makes patch distribution and verification as important as discovery. AI can help expose weaknesses; people still have to establish, disclose and repair them.
The PHP disclosures began with researchers, a model-assisted finding and independent reporting, then moved through coordination and patches. That chain is the practical test for AI-assisted security: discovery matters only when credible findings reach maintainers and fixes reach the software people run.
