AI-generated, human-reviewed.
How AI Exposed a Massive PHP Vulnerability – What You Need to Know
Artificial intelligence has surfaced a severe security weakness in PHP affecting the vast majority of internet-facing websites and applications. The exposure of this critical flaw marks a turning point for how vulnerabilities are discovered, disclosed, and patched in today's internet infrastructure.
On Security Now, Steve Gibson and Mikah Sargent unpacked the discovery, the scale of exposure, the pivotal role of AI, and what this means for enterprise security and ordinary users. This episode offers a crucial update for anyone running web applications—and a preview of the more turbulent era of cybersecurity we are entering.
How AI Uncovered and Accelerated PHP's Biggest Security Crisis
AI technology, specifically large language models and security tools from organizations like OpenAI, was leveraged to conduct deep code analysis on PHP, a programming language that powers approximately 70% of the world's websites, including WordPress, Drupal, and major e-commerce and CRM systems.
According to Security Now, this newfound AI capability helped researchers discover two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, collectively known as "php2shell"), which allowed for remote code execution by unauthenticated attackers on any server running default PHP configurations since 2012. The flaw persisted through every PHP release in the last 14 years until it was patched in October 2026.
Importantly, the security hole had been acknowledged for years but was not considered exploitable—until AI demonstrated otherwise. This underscores a new reality: what was once dismissed as low-risk can quickly become an internet-wide emergency in the era of AI-powered hacking.
Why the PHP Vulnerability Matters
PHP is not a legacy technology—it remains fundamental to critical services and modern websites. Popular content management systems (WordPress, Joomla, Magento), education platforms (Moodle), cloud storage solutions (Nextcloud, ownCloud), and major admin tools (phpMyAdmin, cPanel) all depend on PHP.
Security Now highlighted that more than 2.6 million internet-facing servers were immediately found to be vulnerable. Worse, about 42% ran end-of-life PHP versions with no available patch. Even sites not obviously showing PHP use could be affected, and attacks began circulating within days of the disclosure.
The nature of the vulnerability, which allows attackers to execute code remotely, means compromised systems can be taken over—leading to data theft, ransomware, or as a launch pad for further attacks into private networks.
How the Industry Responded – and What Broke Down
Coordinating a patch for a vulnerability affecting most of the web presented enormous logistical and ethical challenges. Security firms and AI groups, having discovered the flaw as early as August, kept the secret for over two months to buy time for the PHP Foundation and partners to develop and distribute fixes safely.
Efforts included "Patch the Planet" coalitions, new rapid-response frameworks, and urgent communications with government agencies and infrastructure providers. Despite rigorous secrecy, leaks occurred before the official patch, causing panic updates and some organizations—including major European institutions—to temporarily "pull the plug" on PHP-powered services as a precaution.
This incident exposed gaps in global cyber defense: open source projects lack mechanisms for mass, simultaneous remediation, and the inevitable lag between disclosure and patching creates a rush for both defenders and attackers.
The Implications for Cybersecurity Going Forward
On Security Now, Steve Gibson emphasized this is not a one-off event. AI is now capable of unearthing critical, latent vulnerabilities at scale, ushering in a period where major incidents like the PHP crisis could become routine.
- Adapting patch management processes and updating legacy systems is now mission-critical—especially in environments using unmaintained software.
- Cloud and security providers able to implement blanket protections (like Cloudflare's web application firewall) mitigated some immediate risk, but that's not an option for everyone.
- The "strategic plug pull"—disabling exposed services until patching is possible—emerged as a valid, if painful, defense tactic.
- End users should be aware that while direct personal risk is low, the breach of business or enterprise systems can still leak private data (making practices like credit freezes more essential).
Key Takeaways
- AI is now uncovering vulnerabilities that went unexploited for years, drastically accelerating both defense and attack cycles.
- A critical PHP flaw left most of the internet's websites and applications open to attack for 14 years—now patched, but with long-term consequences.
- More than 2.6 million systems were exposed, and many cannot be easily fixed due to unsupported PHP versions.
- Mass, coordinated response to internet-wide issues is difficult, especially for open-source infrastructure dependent on volunteers and diverse stakeholders.
- The era of AI-discovered vulnerabilities means organizations must prioritize patch management, minimize unnecessary software exposure, and accept that services may need to go offline briefly for security.
- Individuals can best protect themselves by freezing their credit and staying wary of where and how their data is stored online.
The Bottom Line
According to Security Now's in-depth analysis, the discovery and rapid exploitation of the PHP vulnerability are a warning for everyone responsible for IT security. The capabilities of AI are reshaping discovery and remediation—and organizations must be prepared to act quickly, including pulling critical services offline, when new threats emerge. Future large-scale vulnerabilities are inevitable, making preparation, prudent system design, and proactive response planning essential.
Stay prepared for future internet security updates and analysis by subscribing to Security Now:
https://twit.tv/shows/security-now/episodes/1102