Two serious vulnerabilities have surfaced in PHP, the server-side language that powers roughly 70% of all websites — flaws that reportedly allow attackers to execute code remotely. The PHP development team announced on October 20 that emergency updates addressing the issue had been released the previous day.

The flaws scored 9.2 on the official CVSS v4.0 severity scale. Cybersecurity firm watchTowr, however, went further, rating the danger a full 10 out of 10. Affected version ranges and technical details have not yet been published, but millions of system administrators have been put on high alert.

AI did the discovering

php1

Logic errors that could evade manual code audits for years were this time caught with the help of artificial intelligence. The research team at Calif uncovered the vulnerabilities using OpenAI's GPT-5.6 Sol model, while Wiz — a firm owned by Google — independently confirmed the finding with its own AI tooling.

According to Wiz's report, turning these flaws into working attacks used to be an extremely laborious process. AI models have dramatically accelerated code review and attack-scenario development, making it far easier for long-dormant bugs to become practical attack tools.

PHP2Shell and the affected platforms

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, are said to enable remote code execution. A screenshot of an exploitation tool dubbed "PHP2Shell", included in leaked materials, claims code execution is possible on leading PHP-based platforms. The software in question: WordPress 7.1.3, MediaWiki 1.46.2, phpBB 3.3.17, Magento 2.4.9, Joomla 6.2.0, Laravel 13.36.0, Symfony 8.1.9, Drupal 11.4.10 and WHMCS 9.0.9.

watchTowr confirmed the vulnerabilities are real and said it managed to reproduce at least one of them in a lab environment. Security firm Sansec, meanwhile, warned that the first major wave of attacks could begin within as little as 15 minutes of patches being released, urging administrators to act quickly.

Why PHP matters so much

p2

PHP is a programming language that handles the server-side operations of a large share of the websites people visit every day. It manages heavy data traffic and computation, running complex processes on remote servers rather than on the user's device.

The language is estimated to be used across 70% of the internet. Considering that hugely widespread systems like WordPress are also built on PHP, the potential scope of the newly discovered flaw is clear.