Hands on a laptop in a dim office

On October 21, the PHP project shipped emergency security fixes for two critical memory-safety vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — rated up to CVSS 9.2 and capable of allowing remote code execution on vulnerable servers. Releases going back to PHP 5.4 are affected, which puts a large share of the world’s websites inside the patch window.

How AI found them

Wiz Research says it discovered both flaws using its Wiz Atlas agent working alongside Gemini 4 Argon and GPT-5.6 Sol. Separately, OpenAI says Calif, a partner in its Patch the Planet program, found one of the flaws with GPT-5.6 Sol. The US National Security Agency advised organizations to take servers that cannot be patched offline.

The leak changed the timeline

Details of the vulnerabilities leaked before the planned coordinated disclosure, and security firms reported exploitation attempts — some of them before the fixes even landed. Government services felt it directly: Dutch government websites were temporarily taken offline as a precaution.

Why it matters

This is the clearest case yet of AI finding serious bugs faster than defenders can ship fixes. The discovery side of the race is accelerating; the deployment side — actually patching millions of production servers — is not. Anyone running a PHP server should update now.

Sources: AI News Today briefing (Oct 22, 2026), citing Wiz Research, TechCrunch, and SecurityWeek. CVE details and CVSS ratings are as reported; exploit claims await fuller independent verification.