AI-Assisted Research Helps Expose Critical PHP Flaws: What Website Owners Should Know

Two critical vulnerabilities in PHP have triggered urgent patching warnings for website operators. AI-assisted research helped expose the flaws, but the story is also about human researchers, software maintainers and coordinated fixes. For publishers and businesses, the practical question is simple: has the PHP runtime behind the website been updated?

PHP is the server-side language used by WordPress and many other web platforms. On October 21, the PHP project released security updates for two flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively described in advisories as “php2shell.” Under certain conditions, the vulnerabilities can let an unauthenticated attacker execute code on a server running PHP. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) says they affect PHP installations serving web requests. As of its October 23 alert, CISA had not observed successful exploitation in the wild, but urged operators to patch immediately.

AI helped with discovery; people handled the response

OpenAI says a researcher at security firm Calif used its GPT-5.6 Sol model in the Patch the Planet initiative to identify a critical PHP flaw. OpenAI also says Wiz independently discovered and reported both vulnerabilities. That is the company’s account, and it does not mean one AI system found and fixed the entire problem.

The PHP Foundation’s account describes a wider process. Earlier audits and maintainer research had surfaced warning signs; reports from Calif, OpenAI and Wiz helped clarify the vulnerabilities’ impact. PHP’s maintainers led the technical response, testing fixes across supported releases. The Foundation says AI tools are increasing the volume of vulnerability reports, but people assess them and make the decisions on patches. It reported that more than 100 submissions since July 1 had proved invalid, duplicated or unreproducible—an illustration of why expert review remains essential.

The episode shows both the promise and the risk of stronger AI security tools. They may help defenders examine mature software faster, but flaws in widely used components can affect countless sites. A discovery creates protection only when maintainers can validate it, prepare a fix, and give operators a clear path to install that fix.

What PHP and CISA advise

The PHP project lists patched releases as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Its security advisory says PHP 8.1 and older no longer receive upstream updates, although some Linux distributions and long-term-support vendors may provide backported fixes. CISA urges organizations to identify every system running PHP and prioritize internet-facing services. It advises taking systems running unsupported PHP 8.1 or earlier offline if they cannot be patched or updated.

For a WordPress site, updating WordPress, themes and plugins is not the same as updating PHP. The runtime is normally managed through the web host or server configuration. WordPress.org currently recommends hosting that supports PHP 8.3 or newer, but site owners should still confirm the actual version and patch level with their provider. Ask whether a fixed release or vendor security backport is installed and whether the live web-serving processes have been restarted. If you manage the server yourself, follow your operating system or hosting vendor’s supported update procedure and test compatibility before changing production settings.

A practical check for publishers and small businesses

For a newsroom, school, shop or community organization in Chitral, the first step may be a short message to the hosting company: “Which PHP version is serving my website, and is it patched for CVE-2026-109618 and CVE-2026-109619?” Request a clear confirmation rather than assuming that a general WordPress update covered the server software. If the host cannot identify the runtime, ask for escalation to its technical team.

This reporting has not confirmed the PHP version running the Chitral Express portal, so it makes no claim that the site is affected. PHP also posted an additional advisory on October 23 concerning a rare configuration related to session upload progress; administrators should check the project’s current advisory for any updates rather than copy configuration changes from social media.

AI-assisted security research is advancing, but keeping websites safe still depends on careful human review and timely maintenance. The most useful result of finding a flaw is a verified patch—and making sure it reaches the systems people rely on.

Sources

• OpenAI — Patch the Planet and coordinated vulnerability response, October 21, 2026
• The PHP Foundation — PHP security release and maintainer response, October 21, 2026
• PHP.net — Critical remote-code-execution security advisory and patched releases
• CISA — Critical vulnerabilities in PHP require immediate patching, updated October 23, 2026
• WordPress.org — Hosting requirements and recommended PHP version