Breaking

AI Models Uncover Critical PHP Flaws Threatening 70% of Websites; NSA Issues Urgent Patch Advisory

October 21, 2026 at 12:47 EDT

Foundation Models
Security

Two critical memory-safety vulnerabilities in PHP have been uncovered through artificial intelligence-powered code auditing, prompting urgent security warnings from the NSA and triggering emergency patch releases on October 21, 2026. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619, each carry a CVSS severity score of 9.2 and enable unauthenticated remote code execution on servers worldwide.

October 21, 2026 · Security Alert

AI Uncovers Critical PHP Flaws Threatening 70% of Websites

Two memory-safety bugs in PHP enable unauthenticated remote code execution across millions of servers running WordPress, Drupal, and Joomla.

70%

Of websites worldwide use PHP

9.2

CVSS Critical severity score

Critical CVEs: 109618 & 109619

Days from discovery to patch

Discovery Timeline

August 19–21, 2026

AI models (GPT-5.6 Sol, Gemini 4 Argon) identify vulnerabilities; Calif and Wiz confirm RCE against WordPress & Drupal

August 24, 2026

Researchers report findings to PHP security team for coordinated disclosure

October 21, 2026

PHP releases emergency patches for versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35

Key Finding

OpenAI's Patch the Planet initiative demonstrates AI's capability to identify critical internet-scale vulnerabilities during a coordinated two-month "Defender's Window" before public disclosure—closing a critical gap where the security community can patch before malicious actors weaponize the flaws.

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.