AI helped discover the PHP vulnerability that could take down 70% of the internet. Now, the race is on to patch it before AI-powered hackers attack
Increasingly powerful AI tools are at the center of a new war between those who want to use them to supercharge cyberattacks, and the defenders who are harnessing the same tools to fend them off. Today, the defenders are hoping they got a leg up in identifying a critical issue that stands to take down 70% of the internet if left unaddressed.While the software flaws have now been found and patches issued, the question remains whether enough of the internet will deploy the patches in time, before hackers start exploiting the vulnerability to attack websites and steal vital data.
TL;DR
- Critical software vulnerabilities (CVE-2026-109618, CVE-2026-109619, "php2shell") were discovered in PHP, a widely used open-source programming language.
- AI tools, including OpenAI's GPT-5.6 Sol, were instrumental in identifying these flaws, which had been present for years.
- Tens of thousands to millions of exploit attempts were detected shortly after news of the vulnerability broke.
- Amazon Web Services confirmed the vulnerability is being "broadly exploited in the wild," with prior exploitation attempts noted.
- Multiple governments and agencies, including those in the Netherlands, Finland, the FBI, and NSA, have urged immediate patching or website takedowns.
- The vulnerabilities allow remote code execution, creating an entry point for attackers to steal data and cause significant damage.
- PHP powers a large portion of the internet, including WordPress (approx. 40% of all websites), and was used by sites like Facebook, Microsoft.com, and Wikipedia.org.
- Several organizations, including OpenAI, Calif, and Wiz, independently discovered the vulnerabilities around the same time using AI and collaborated on fixes.
- The incident highlights AI's potential to uncover significant security flaws but also to accelerate attack development.