Critical PHP Flaws Threaten Millions of Websites in New AI Security Test
Some organizations have temporarily taken websites and online services offline rather than leave vulnerable systems exposed.
Two critical security flaws have been discovered in PHP, a technology powering a significant portion of the internet, potentially putting millions of websites and the data they store at risk. These vulnerabilities, CVE-2026-109618 and CVE-2026-109619, carry a critical severity rating and have been dubbed "PHP2Shell". According to the United States National Security Agency Cybersecurity Division, PHP is used in roughly 70 percent of websites worldwide, though not all are vulnerable to these specific attacks.
Wiz Research, which discovered the flaws with the help of AI models, recommends updating PHP to versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35. AI, particularly Google Cloud's Gemini 4 Argon, played a significant role in identifying and addressing these vulnerabilities. The flaws could allow attackers to execute code or access sensitive information, affecting major platforms like WordPress, Drupal, Joomla, Magento, MediaWiki, Roundcube, phpMyAdmin, Nextcloud, Laravel, Symfony, and WHMCS.
Some organizations have taken their websites offline while they install security updates. While the vulnerabilities primarily affect websites and servers, they are not directly patchable by ordinary internet users. However, site owners are advised to update to a PHP release containing the patch to mitigate the risk.
Written by urgent.news from Newsweek's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
