Artificial intelligence has uncovered critical vulnerabilities in PHP, a programming language powering approximately 70% of websites worldwide, triggering an unprecedented cybersecurity alert. The discovery highlights how AI is transforming vulnerability research while creating new opportunities for cybercriminals.
According to The Wall Street Journal, researcher Ryan Austin of cybersecurity firm Calif identified the weaknesses using OpenAI's GPT-5.6 Sol during a source-code audit. The vulnerabilities had remained hidden for years, demonstrating AI's growing ability to detect complex security flaws overlooked by traditional methods.
Identified as PHP2Shell, the vulnerabilities carry the identifiers CVE-2026-109618 and CVE-2026-109619. Attackers exploiting affected systems could execute malicious code without authentication, steal sensitive information or compromise websites running popular platforms including WordPress, Drupal and Joomla.
The discovery triggered emergency coordination among PHP developers, cybersecurity researchers and technology companies. Government and commercial websites were temporarily taken offline as administrators rushed to deploy security updates and prevent potential exploitation.
The most alarming development is AI's dual-use capability. While advanced models accelerate vulnerability discovery and remediation, attackers can potentially use similar technology to analyse patches, develop exploits and launch automated attacks faster than conventional security teams can respond.
For businesses, especially banks, healthcare providers and e-commerce platforms, the consequences could include data breaches, financial fraud, operational disruption and reputational damage. Organisations must immediately identify vulnerable PHP installations, deploy verified security patches and strengthen continuous monitoring.
The larger warning is that cybersecurity has entered a machine-speed era. AI is compressing the time between vulnerability discovery and potential exploitation, fundamentally challenging traditional defensive strategies. Enterprises must embrace AI-powered threat intelligence, automated remediation, continuous identity verification and proactive vulnerability management. The future of digital trust will depend on how quickly organisations can secure their infrastructure against increasingly intelligent threats.
