A flaw discovered by artificial intelligence in the PHP programming language has triggered a wave of shutdowns of various websites and government servers across the world.
On Wednesday, cybersecurity experts discovered a pair of vulnerabilities, dubbed PHP2Shell, with the help of AI models.
Vulnerability 2 – CVE-2026-109619: The other error is CVE-2026-109619 or RCE via stale global state. Both of these vulnerabilities have a score of 9.2 on the Common Vulnerability Scoring System (CVSS). As per the non-profit group, a fatal error at the wrong point in the PHP could leave internal state pointing to memory that belonged to a previous request.
What is PHP?
Created in 1995 and initially called ‘Personal Home Page’, PHP is known as the the server-side language and is responsible for assembling content and delivering pure HTML code to the respective browsers. Researchers at security firm Calif, working with OpenAI, reported the first flaw on August 11. The PHP language powers around 70 percent of the websites in the world, according to Alphabet-owned security firm Wiz. The flaw by Wiz was first reported on August 24. Vulnerability 1 – CVE-2026-109618: As per the PHP foundation, CVE-2026-109618, or Remote Code Execution (RCE) via OOM corruption, is among the two critical remote code executive vulnerabilities found.
“Given the severity of these flaws and PHP’s widespread use, we consider this one of the most impactful security issues in recent memory,” said OpenAI in a statement. PHP, which is a recursive acronym for PHP: Hypertext Preprocessor, is a free, open-source, server-side scripting language designed specifically for web development. This programme serves as the invisible engine behind a website. PHP is commonly used for content management systems, major tech platforms such as social media websites, and e-commerce applications. It is also the programming language powering WordPress, Joomla, Drupal, Wikipedia’s MediaWiki, and many others on the internet. With world leaders shutting down websites amid the panic, here’s a look at the latest developments – Govt websites taken offline across the world: Authorities in Europe, Asia and other continents have temporarily taken certain government websites offline to protect against newly discovered security vulnerabilities. The group also called on website administrators to update their code immediately. This issue can result in the PHP leaving partially initialised internal data behind and later treating it as valid, corrupting memory.
The concerns also resulted in a rare public warning from the United States National Security Agency (NSA) , UK’s National Cyber Security Centre, and CERT-EU ‘Most severe flaws ever seen’: In a statement addressing the vulnerabilities, nonprofit group PHP Foundation said on Wednesday that the flaws were among the most severe it had encountered.
