AI found two holes in PHP. Governments switched their websites off

On Wednesday night the Prime Minister of Japan went on X and asked the country to patch a programming language. "We have an urgent request for everyone to take action tonight," Sanae Takaichi wrote. That is not a sentence heads of government usually spend on server software.

By then the panic was general. Finland had pulled its government's public web services offline. Belgium, the Netherlands and the Czech Republic took sites down to apply a fix, according to Al Jazeera. Germany's digital ministry switched some pages off as a precaution, and France's interior ministry shut the websites of its local administrative offices. The National reported that Australia did the same with several government services. In the UK, the BBC reported that Edinburgh council and some of the broadcaster's own pages went dark.

The cause was two bugs in PHP, the language that quietly runs a huge share of the web. Al Jazeera puts it at more than 70 percent of websites. And the bugs were found by AI.

Two holes, decades deep

The PHP project published its advisory on October 21. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and the US Cybersecurity and Infrastructure Security Agency has given them a nickname, "php2shell," which tells you roughly what an attacker gets: a shell on your server, no password required.

The technical details are almost boring, which is part of what makes them scary. In the first, PHP's advisory says, "out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid." In the second, "request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it." In plain terms, one visitor's leftovers can be turned into a weapon against the next, and the attacker never has to log in.

The advisory is blunt about the fix. "There are no complete mitigations, updating is the only safe choice," it says. Patched releases are out for PHP 8.5, 8.4, 8.3 and 8.2. Anyone on 8.1 or older is in a worse spot: those versions no longer get updates from the PHP project, so the security team pushed minimal source backports for 7.4, 8.0 and 8.1 onto separate branches and told everyone else to talk to their vendor or upgrade.

That sounds manageable until you remember how much of the world runs on PHP nobody has touched in years. Content management systems, shared hosting panels, intranet tools that one contractor set up in 2017 and nobody has logged into since. The US National Security Agency's advice was to be ready to update, and if that was not possible, to take systems offline. Several governments read that literally.

The machines got there first

The discovery story is the part worth sitting with. According to Al Jazeera, the security firm Calif, working with OpenAI, reported the first flaw on August 11. Wiz, the cloud security company owned by Alphabet, reported the second on August 24. AI models were used to find the bugs and, according to researchers, to build working exploits and test fixes.

Wiz did not undersell it. The firm said the findings "rank among the most severe vulnerabilities discovered in PHP, and arguably in software history," and said proving the bugs could be exploited took steps "at the edge of what human researchers could practically achieve." The flaws had sat in the code for decades. People looked. People missed them.

OpenAI, whose "Patch the Planet" program gave Calif and the PHP Foundation access to its tools, framed the episode as a win. The company said "frontier AI was able to find this vulnerability ahead of attackers," as quoted by The National. That is true, as far as anyone knows. It is also the most uncomfortable phrase in the whole saga, because "ahead of" implies a race, and the other side is using the same tools.

The PHP Foundation, which helps maintain the language, said as much. "Tools now find bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing," it said, and called for a coordinated response from tech companies so that the next one does not knock government services offline again.

Moshe Siman Tov Bustan, a lead researcher at Ox Security, gave the most practical advice of the week to The National. If you have not patched, "start from the assumption that you're exposed." His summary of the scale: "This is about as broad as a critical vulnerability gets."

There is a version of this story where everything worked. Bugs found in August, disclosed in October, patches shipped, governments cautious. But the shape of it is new. For years the bottleneck in software security was human attention: there were only so many skilled people reading old C code at 2 a.m. That bottleneck is gone. The bugs that hid for twenty years because nobody had time to look are now being found in weeks, and the queue of software that needs patching did not get any shorter. It got longer, and it is moving faster.

The next advisory is probably already sitting in somebody's inbox, flagged by a machine.

Sources: PHP.net security advisory, Al Jazeera, The National, BBC News.