The flaw under 70% of the web was spotted in 2024. It took AI to make anyone believe it

Every so often the internet discovers that its foundations are made of the same material as its sandcastles. On Wednesday it was PHP's turn.

PHP is the thirty-year-old language that quietly runs WordPress, Drupal, Joomla and MediaWiki, the software behind Wikipedia. By W3Techs' count it sits under roughly 70 percent of the websites whose server language is known. On October 21 its maintainers shipped emergency releases, PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, to close two flaws now called PHP2Shell: CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS version 4. The advisory uses the words nobody wants to read: unauthenticated remote code execution. A stranger sends a request; the server runs the stranger's code.

A crash that leaves the room dirty

The mechanism is almost domestic. When a request ends badly, typically because it hits PHP's memory limit, PHP is interrupted halfway through its housekeeping. In the first flaw, cleanup then treats half-built request data as if it were finished. In the second, a piece of a dead request survives in memory, and the next request handled by the same worker trusts it. Picture a hotel that never quite cleans the room after a guest is thrown out, and hands the next guest a key that still opens the previous one's safe.

Wiz Research, which worked on the disclosure with Calif, OpenAI and the PHP team, says every PHP version going back to 5.4, more than a decade old, is affected by at least one of the bugs. It demonstrated takeovers of WordPress, Drupal and Joomla without any login, and the reading of passwords and API keys straight out of server memory.

Seen, filed, shelved

Here is the part that interests me more than the exploit.

This was not an unknown unknown. In 2020, a bug report noted that very long form variables could push PHP out of memory and leave temporary files behind; it was treated as a nuisance. In 2024, PHP went through its first external security audit in years, carried out by Quarkslab, organized by OSTIF and paid for by Germany's Sovereign Tech Agency. While fixing one of the audit's findings, a developer working for the PHP Foundation saw, in the Foundation's words, "the first signs of the OOM problem." A possible exploit was theorized. No concrete path was found. Problems with clearer impact took priority, and competing fixes stalled and restarted for months.

The Foundation does not dodge it: "the delay was a structural failure." That sentence is rarer in the software business than the bug itself.

So the weakness had been seen. What was missing was proof. And in security, as in science, a hypothesis nobody can demonstrate is a hypothesis nobody prioritizes.

What the machines actually did

On July 30, as part of OpenAI's Patch the Planet program, the security firm Calif began auditing PHP. On August 11, Calif and OpenAI independently reported a remote code execution with the same root cause the Foundation had glimpsed in 2024. Wiz added attack paths on August 24. Wiz says it worked with its own tools and frontier models from Google and OpenAI, and that "a single researcher completed in a week what previously would have taken a world-class team months of work."

Wiz also calls these findings among the most severe "arguably in software history," the kind of line one writes on a blog that sells security products. Discount it; what remains is still remarkable.

Calif's account is the most instructive. Its researcher did not ask a chatbot to find all the bugs. He knew PHP's history, remembered a memory-limit vulnerability Stefan Esser had found back in 2004, and went looking for its "long-lost siblings," with a model doing the tedious tracing. "Know your target," Calif writes, "is still as applicable as ever."

That is the honest picture of artificial intelligence in research today: not an oracle, but a tireless assistant that turns an expert's hunch into a demonstration in days instead of months. It lowers the price of proof. And when proof gets cheap, a lot of old suspicions become emergencies at once. The PHP security team says it has published 15 CVEs since July 1 and sifted more than a hundred invalid, duplicate or unreproducible reports.

The same proof, for everyone

The uncomfortable symmetry is that cheap proof is available to attackers too. The CVE numbers leaked on October 20, forcing the release forward by a day. A demonstration video went out by mistake. Chainguard published fixed images more than six hours before the coordinated release, letting anyone study the patch early. Cloudflare says its firewall rules have protected free and paid customers by default since 3:02 a.m. UTC on October 21, and that it saw attack traffic before the release. Hadrian reported exploitation "at scale"; watchTowr said none of the attempts hitting its sensors had succeeded yet. All agree: a firewall rule buys time; the patch is the fix.

Then come the servers nobody will patch. PHP 8.1 and everything older no longer get official updates. The project published minimal source backports for 7.4, 8.0 and 8.1 but somewhere a forgotten shop, a small-town portal, a plugin-encrusted blog will keep running an end-of-life PHP for years. Abandoned servers are the quiet legacy of every software boom.

Who pays for the floor

The Foundation's closing plea is the real story. PHP runs "government services, online stores, banks, media sites," yet its security still depends on "a small group of foundation-funded developers and a little volunteer help." Tools can find bugs faster than ever, it writes; what they cannot do is "decide on the right fix for a long-standing design decision in the engine."

I am a liberal in the old sense, and I do not think the answer is to nationalize the commons. But I notice that the 2024 audit happened because a public agency with "sovereign" in its name paid for it, while most of the companies earning fortunes on top of PHP did not. Digital sovereignty is not a flag on a data center. It is whether someone maintains the code your hospitals and tax offices run on. The firms that live off that floor should pay for its upkeep before governments decide to do it for them.

Artificial intelligence has just made it cheap to prove that old code is fragile. It has not made it cheap to repair. That still takes a few people who understand the engine, working, in the Foundation's words, "through weekends and around the clock." Their names deserve more attention than the bug's.