When AI Found a Decade Old Bug in 70% of the Web?

Last week, governments took their own websites offline on purpose. Wikipedia pulled some systems down as a precaution. The NSA told organizations to unplug sites they could not patch right away.

The reason was a pair of bugs nicknamed PHP2Shell. They had been sitting inside PHP for over a decade. AI models helped researchers find them.

If you are a student or in your first few years as a developer, this story is worth more than a headline. The curriculum rarely spends time on how memory bugs actually hurt people, why code written long ago is still your problem and why patching is a real engineering skill. AI is changing the speed of security for everyone, attackers included.

What happened in plain words?

PHP powers the server side of roughly 70% of websites, including WordPress, a huge share of online stores, and countless college and small business sites. Two flaws in PHP  tracked as CVE-2026-109618 and CVE-2026-109619. This allows an attacker to take over a web server with a crafted web request, without a login or password. 

They are rated 9.2 out of 10 for severity.

The gap between "a fix exists" and "attackers are using it" was under an hour. 

Every PHP version since 5.4 (released in 2012) is affected, and versions older than 8.2 get no official fix at all.

The bug: 

IBM's Patrick Fussell described it well: If you check out of a hotel, but your room key still works.(https://www.cnn.com/2026/10/21/tech/php2shell-vulnerability-ai-intl)

That is a use-after-free bug. A program borrows a piece of memory, gives it back ("frees" it), but keeps a pointer to it, like keeping the key card. Later, someone else gets that same memory. If the old pointer is used again, the program reads or writes data it no longer owns. An attacker who can control what the new guest puts in that room can make the program do almost anything.

Here is how it happened inside PHP:

1. A PHP server keeps worker processes alive and reuses them for request after request. This made the application fast.
2. PHP has a feature enabled by default since 2012 that tracks file upload progress so websites can show a progress bar.
3. The attacker sends an upload that makes PHP run out of memory in the middle of parsing it.
4. PHP bails out of that request quickly and skips its cleanup. Some internal pointers still point at memory that has just been freed.
5. The next request lands on the same worker. PHP starts up using that stale state before resetting it. "Old key, new room".
6. With the right follow-up requests, the attacker turns that confusion into running their own commands on the server.

The lesson for those who do not know PHP:  It was an error-handling path that nobody exercised, combined with a performance optimization (reusing workers). Most serious bugs show up on  "this should never happen" bucket.

What is "unauthenticated remote code execution"? Why is it a security risk?

Lets look at these terms:

Now the part that surprises new developers: your application code could be perfect, and could still be vulnerable. The flaw is in the PHP runtime, below your code. The login form, your input validation, the clean architecture do not matter here. The attack happens before the code even runs.

That is why a WordPress blog, a university portal, and an online store were all exposed at the same moment.

What changed and how did AI actually find this?

Many of skilled engineers have read PHP's source code over the years. A limited version of this issue was even spotted in 2024 and judged not significant. AI models changed the approach they can try far more attack paths than an engineer who mostly plays by the rules of their knowledge, then help turn a weird crash into a working exploit.

Who found it, and with which AI

Two teams found it independently, around the same time, and both used frontier AI models.

Calif admitted they were not expecting to find anything critical. PHP is one of the most heavily scrutinized codebases on the internet. That is exactly why this matters.

What AI actually did

• Found the weak spot. AI tried far more attack paths than a human team could, including deep error handling paths people rarely test.
• Built the exploit. In a Wiz podcast, the researchers explained that turning a memory corruption bug into a working attack used to take months of tedious lab setup and debugging. AI agents did it in a couple of weeks, often while the humans slept.
• Scaled across versions. AI adapted the exploit to many PHP versions and to real apps like WordPress, Drupal and Joomla.
• Helped defend too. Wiz used the same models for attack detection and to validate that PHP's patch actually worked.

Wiz compared this moment to Heartbleed (2014) and Log4Shell (2021), and said AI changes the economics of both finding and exploiting bugs.

The good news is that defenders found it first and shipped a fix before mass attacks. The bad news, which the PHP Foundation itself pointed out, is that the same tools make these weaknesses easier for anyone to find. The industry has started calling this moment "Black October."

What does this mean to everyone in the IT industry?

• Old code is no longer safe just because it is old. "It has worked for ten years" used to be comfort. Now it may just mean nobody has looked with the right tool yet.
• Patch windows are shrinking from weeks to hours. Teams that can update and redeploy quickly will be valued. Teams that cannot will take sites offline, like the governments did.
• Using AI to review code is becoming a baseline skill, not a bonus. If attackers point AI at your stack, you should too.

Sources

• Original TechGig article
• Al Jazeera: World leaders warn of security flaws found in PHP
• CNN: Websites shut down globally after AI finds flaw
• CNBC: AI's Black October
• Fortune: The race to patch
• Symantec / security.com: PHP2Shell technical summary
• Qualys: Find, mitigate and patch
• AlmaLinux: Patched packages
• Explainer on disabling session.upload_progress

• Wiz Research: PHP2Shell write up
• Wiz podcast: Breaking down PHP2Shell
• The Next Web: PHP rushes out emergency patches
• To Vima / WSJ: AI just found a bug that puts 70% of websites at risk