The two vulnerabilities disclosed this week in PHP — the language behind roughly three-quarters of the world's websites — were not new. They date back to PHP 5.4, released in 2012, and sat undetected for more than a decade while the entire security industry, thousands of auditors and the open-source community looked at the same code.
What finally found them was artificial intelligence. Security firms Wiz and Calif used OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon to locate and verify the flaws, coordinating with the PHP team before going public. The bugs — CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 — allow unauthenticated remote code execution, the kind of flaw that hands an attacker the keys to the server.
Emergency patches landed on Wednesday, October 21, for PHP 8.2 and newer. Older versions, which make up a large share of the world's WordPress sites, are still waiting on backported fixes.
Like your satire sourced?
Get the Dispatch — the week's sharpest offenses, with receipts attached.
Fourteen years of human reviewers missed it. The robots found it on what appears to have been their first real look. Humanity's remaining job in cybersecurity is now mostly limited to unplugging things, per the official guidance.
The underlying reporting is filed in the Evidence Locker: Computer Weekly (Oct. 21, 2026).
