Although PHP is not a household name for most users, it is part of the infrastructure that allows a huge number of web pages to function. This programming language is behind widespread platforms such as WordPress and numerous systems that manage content, digital stores, and internet services. For this reason, the discovery of two critical vulnerabilities in its core has activated cybersecurity alerts and has forced administrators and organizations to urgently review their systems.
The case has acquired special relevance due to the participation of artificial intelligence in the investigation. OpenAI has explained that its GPT-5.6 Sol model helped identify one of the flaws within the cybersecurity initiative Patch the Planet. The specialized company Wiz also independently discovered and reported the vulnerabilities. After coordinating the response with PHP officials and other collaborators, the development team published the security updates on October 21.
What is PHP and why is it so important for the internet
PHP is a programming language that runs mainly on servers. When a person enters a web page, this software can be responsible for processing a request, querying a database, managing a session, or preparing the content that finally appears in the browser. The user usually does not see it, but it may be working behind the page they have open.
Its popularity explains the dimension of the problem. PHP is used in a proportion close to 70% of websites, according to estimates released by security researchers. One of the best-known examples is WordPress, the content management system with which countless media, blogs, and corporate pages operate. There are also other platforms and applications developed with this language.
That does not mean that seven out of ten websites have been attacked or that all are necessarily exposed. The risk depends on the installed version, the server configuration, and the specific application. However, when a flaw is discovered in such a widespread component, the number of systems that must check if they are protected can be enormous.
Two vulnerabilities that can give access to the server
The identified flaws affect PHP's internal memory management and have received a score of 9.2 out of 10 on the CVSS 4.0 scale, which measures the severity of computer vulnerabilities. The main danger is that they can allow remote code execution without the attacker having to log in beforehand.
What does this mean in practice? A vulnerable server could end up executing instructions sent from outside by a malicious person. Depending on the circumstances and available permissions, this could facilitate access to confidential information, manipulation of a web page, or a broader system compromise.
The two problems have been registered with the identifiers CVE-2026-109618 and CVE-2026-109619. This is not a WordPress-exclusive flaw or a vulnerability that only affects page design: the problem lies in the PHP engine itself. Therefore, correcting it may require an update of the environment in which the website operates, not simply installing a plugin or changing a password.
How artificial intelligence helped detect the problem
The intervention of AI is one of the most notable aspects of the case. According to OpenAI, the GPT-5.6 Sol model allowed researchers to identify a critical vulnerability during a security analysis job. Wiz, for its part, independently reported both flaws. The subsequent response involved language maintainers, researchers, and infrastructure providers, who prepared the fixes before publicly disclosing the technical details.
This process is important because finding a vulnerability is not just about detecting a suspicious line of code. Researchers must understand how the software behaves, check if the error can be exploited, determine its possible consequences, and collaborate with developers to fix it without causing new problems.
Artificial intelligence can accelerate part of that work, helping to examine code and locate anomalous behaviors that might go unnoticed. But it does not replace the entire process: in this case, research, coordination with PHP maintainers, and the publication of patches were fundamental to reducing the risk.
Why some websites temporarily stopped working
Given a flaw that could allow taking control of a server, keeping a website connected without having applied the necessary protections can pose a risk. For this reason, some organizations and public services chose to temporarily disconnect their pages while they evaluated the exposure and prepared the updates. The measure seeks to prevent a vulnerable system from remaining accessible from the internet during a situation of uncertainty.
Not all organizations have the same capacity to react. Large companies may have specialized security teams, while a small website may depend on a hosting provider that manages updates. Furthermore, checking which version is installed and applying a patch may require prior testing to avoid interruptions or incompatibilities.
The alert also reflects a common difficulty in cybersecurity: publishing a fix does not guarantee that all systems will install it immediately. The risk persists in those servers that continue to use vulnerable versions, especially if they are exposed to requests from the internet.
What affected websites should do
The PHP team has published corrected versions for branches 8.5, 8.4, 8.3, and 8.2. Specifically, the security updates are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Administrators should check which version they are using and apply the corresponding update following official guidelines and those of their hosting provider.
For those who have a website without directly managing the server, it is advisable to consult with the hosting company or the technical manager to confirm if the installation is affected and if the necessary measures have already been applied. Changing the access password, by itself, does not correct a vulnerability of this type.
The episode leaves a conclusion that goes beyond PHP. Artificial intelligence is expanding the possibilities of those looking for security flaws, but detecting the problem is only part of the answer. Protection also depends on developers publishing solutions and system administrators installing them on time. In a network as interconnected as the internet, the speed with which a vulnerability is corrected can make a difference.