NederlandsAI helped find decade-old security flaws in PHP, updates are available
Researchers at Wiz and Calif used AI models to help find two serious security flaws in PHP, the technology behind an estimated 70 per cent of websites. Updates came out on 21 October. Many organisations briefly took their sites offline as a precaution.
On 21 October 2026, urgent updates were released for PHP, the programming language that an estimated 70 per cent of all websites run on, including almost all WordPress sites. The updates close two serious security flaws that had been in PHP for more than ten years. They were found with considerable help from AI models.
What is going on?
PHP is the program on a web server that builds a web page when a visitor asks for it. The flaws are not in the websites themselves, but in PHP. This means that even a site with well-built code of its own can be vulnerable.
The problem arises when PHP does not finish a visitor's request properly, for example because the memory runs full. PHP then leaves rubbish behind in the working memory. The next request can reuse that rubbish. An attacker can take advantage of this: read data from the memory, such as passwords, or even make the server carry out their own commands. The attacker does not need to log in to do this. Security experts named the two flaws together PHP2Shell. A "shell" is the command line used to control a server.
According to Wiz, at least one of the bugs is in almost every PHP version of the past ten years, going back to PHP 5.4.
How AI helped
The security company Wiz found the first bug on 19 August 2026 and reported it to the makers of PHP on 24 August. Wiz says it had a lot of help from AI, mainly from Google's Gemini 4 Argon, alongside OpenAI's GPT-5.6 Sol and a system of its own. According to Wiz, AI helped to find the bug, to build a working attack to prove it and to check the repair. One researcher did the work in a week. Wiz says a top team without AI would have needed months.
In the same period, the security company Calif came across one of the bugs using GPT-5.6 Sol. Calif takes part in Patch the Planet, an OpenAI programme that uses AI to find and fix bugs in open software that a lot depends on. PHP credits Wiz, Calif and OpenAI with the discovery.
Leaked, then quickly repaired
The makers of PHP worked quietly on a fix. On 20 October, the identification numbers of the flaws already appeared on the forum Hacker News, before the updates were ready. A day later the updates came out: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For the older versions 7.4, 8.0 and 8.1, small fixes were made available for people who build PHP themselves. According to PHP, updating is the only real solution.
Cloudflare, which protects many websites, saw the first attempted attacks that morning, before the updates were out. Amazon Web Services also reported attempts at misuse. The Dutch National Cyber Security Centre (NCSC) saw no signs of active misuse at that point.
Sites offline as a precaution
Security agencies, including the US NSA and the British and Dutch NCSC, called on everyone to update quickly. Those who could not do so straight away were advised to take their site offline for a while. Many organisations did so as a precaution. In the Netherlands, government websites such as Overheid.nl, MijnOverheid and DigiD (the Dutch government login service) were temporarily down, as were the sites of the Dutch parliament, the Port of Rotterdam and the Dutch football association KNVB. Government sites in Finland, Germany, France and Belgium also went offline briefly, and Wikipedia temporarily switched off some of its systems. It was a precaution: these organisations reported no break-ins.
What can be done?
Ordinary internet users have nothing to do: PHP runs on servers, not on phones or laptops. Owners of a website, for example one built with WordPress, can ask their hosting company whether it already runs the new PHP version. Anyone who manages a server themselves should install the update. According to the makers of PHP, that is the only way to be fully safe.
What does this mean for the road to the singularity?
This is one of the clearest examples so far of AI finding serious bugs in software that the whole internet relies on. Bugs that people overlooked for ten years came to light within weeks. The same power can also be used by attackers. That is why AI companies, security experts and the makers of open software are now working together to find and fix such bugs sooner. The better AI gets at reading and checking code, the faster the digital foundations of our society can become strong and secure.
What is the technological singularity? Read the explanation →
