Two critical vulnerabilities in PHP — the language behind roughly 70% of websites, including WordPress sites — were publicly disclosed on Wednesday, with emergency patches issued by the PHP Foundation. The flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively nicknamed PHP2Shell, are rated 9.2 in severity, allow unauthenticated remote code execution, and have sat in PHP versions since version 5 in 2004.

AI found them first. Security firm Calif, working in OpenAI's new Patch the Planet initiative, used GPT-5.6 Sol to find one flaw in August, while Wiz independently found both using its Wiz Atlas agent together with Google's Gemini 4 Argon and GPT-5.6 Sol. OpenAI says it led a two-month coalition of maintainers, researchers and providers to prepare fixes, and is putting $1 billion in subsidized model access behind defender work of this kind.

The US National Security Agency warned that sites that cannot patch immediately should be pulled offline until they can. Patched releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35; versions 8.1 and older are unsupported. Wiz notes the same AI capability that found the bugs also lowers the barrier to exploiting them, which is why the patch race is urgent.