AI news · PHP · security
AI helped find the PHP flaws that pushed websites offline
Researchers using GPT-5.6 Sol and Gemini 4 Argon found two bugs that let a stranger run code on PHP servers; agencies told unpatched sites to go offline.
PHP, the programming language behind a big slice of the world’s websites, released emergency fixes on Wednesday 21 October 2026. Under the right conditions, both holes let a stranger take over a PHP server without logging in, the PHP Foundation says. Updates 8.2.35, 8.3.36, 8.4.27 and 8.5.12 close them.
AI did much of the finding. Security firm Calif reached the first bug in August with OpenAI’s GPT-5.6 Sol, Fortune reports. Wiz, owned by Google, got there independently later that month, combining its in-house Wiz Atlas with GPT-5.6 Sol and Google’s Gemini 4 Argon. OpenAI calls the pair “one of the most impactful security issues in recent memory”. The foundation says the root of one bug had surfaced in a 2024 audit, but its fix kept stalling.
The release came a day early. The bugs’ ID numbers leaked online on 20 October, and the foundation says Chainguard published patched software more than six hours before the agreed time.
The Verge cites W3Techs, a web survey firm, which puts PHP behind 69.3 per cent of sites whose server language it can identify. Government bodies in Finland and the Netherlands pulled their own sites as a precaution. Where patching cannot happen straight away, the NSA and the UK’s National Cyber Security Centre say to take the site offline. PHP 8.1 and older get no fix.
If your shop or blog runs on WordPress or another PHP host, its PHP version now decides how exposed it is.
Sources
- The PHP Foundation: Today’s PHP Security Release, and How We’re Strengthening PHP Security. Checked
- Fortune: AI tools discovered the PHP vulnerability that could take down 70% of the internet. Checked
- The Verge: PHP: The three letters that shut down sites all over the internet today. Checked
Alexandre S.
Alexandre S. is a creative ad strategist and copywriter with ten years' experience in digital marketing across multiple channels.
More AI news from
- Meta creates non-voting shares to pay for its AI build-out
- Anthropic’s Claude Duet works in your apps while you are away
- ChatGPT ads reach 89 countries, with AI rewrites on by default
- OpenAI’s GPT-6 models arrive on Google Cloud
- Legal AI firm Legora raises $550 million at $8.8 billion
- Nvidia packs AI data centres into containers and fences in agents
- Recursive says AI built most of its new laptop coding model
- Flapping Airplanes raises $1 billion to train AI on less data
- Blacksmith hits $1 billion as AI-written code swamps checks