PHP Developers Roll Out Patches for Flaws Found With AI
PHP's developers have rolled out patches for security flaws that had existed in the software for years, and governments and cyber-security agencies around the world are working to contain the risk. The flaws were found using technology from OpenAI, according to the BBC.
PHP is a programming language and platform used to run websites. The BBC reports that it powers more than 70% of websites, including Wikipedia and digital shopping sites, which is why a flaw in it can reach so many people.
On October 21, Reuters reported that an EU agency had warned that websites may need to be taken offline while PHP prepared patches for critical vulnerabilities. A vulnerability is a weakness that attackers can exploit, and a patch is an update that repairs it.
The UK's National Cyber Security Centre (NCSC) published a notice on the same day titled "Critical security issue affecting PHP". It identifies the flaw as CVE-2026-109618, a standard label for publicly listed security flaws, and describes it as out-of-memory handling interrupting PHP while internal request data is only partially initialised. NCSC In May, the agency had also published a blog post titled "Preparing for a 'vulnerability patch wave'", which said that AI speeds up the discovery of vulnerabilities.
The cyber-security firm Wiz described the issue as the "most severe" it had detected. OpenAI called the discovery "one of the most impactful security issues in recent memory." Fortune reported on October 21 that a race was under way to patch the flaw before AI-powered hackers could attack.
Joe Tidy, the BBC's cyber correspondent, compared the PHP flaw to a cyber-security issue from 2021, in which cyber criminals took 15 days to begin exploiting the weakness. The BBC has also reported that the PHP problem dates back to 2024.
Developers have now released fixes, but many website operators must install them before the risk is reduced. Governments and agencies are continuing to respond.
