AI Found a Critical Flaw Hiding in 70% of the Web
AI researchers disclosed this week that AI models helped find PHP2Shell, two critical flaws (CVE-2026-109618 and CVE-2026-109619) in PHP, the programming language behind roughly 70% of the world’s websites, including WordPress and Drupal. Wiz says it found the memory-safety bugs using its Wiz Atlas agent with Gemini 4 Argon and GPT-5.6 Sol, while Calif independently found one flaw with GPT-5.6 Sol through OpenAI’s Patch the Planet programme. Patches released on October 21 cover every PHP version back to 5.4, but a Censys scan showed about 1.5 million of 2.6 million examined hosts were still unpatched, and Amazon and Cloudflare reported attack attempts already climbing into the millions. ...