How AI Found PHP's Worst Flaw in a Decade, Then Wikipedia Went Dark

Wikipedia went dark in places this week. Not because of an outage or a funding crisis, but because the Wikimedia Foundation decided the safer move was to pull its own systems offline rather than risk them. Finland's government did the same to its public web services. So did a council in Edinburgh, a government ministry in the Netherlands, and — briefly — pages belonging to the BBC itself. The reason behind all of it was two bugs sitting inside PHP, the programming language running a huge share of the internet, that had gone unnoticed for more than ten years.

The bug itself, briefly

The flaws — tracked as CVE-2026-109618 and CVE-2026-109619 — are both unauthenticated remote code execution (RCE) bugs, security-speak for "an attacker can run their own code on your server without ever needing a password or a login." Code24 already covered the technical details and the exact patch checklist in a separate piece — this one is about a different question: how two bugs that survived a decade of normal code review got found now, and why the response looked more like a geopolitical event than a routine software patch.

An AI found what a decade of humans missed

The flaws were surfaced by security researchers at Wiz and a firm called Calif, working through a program OpenAI set up called "Patch the Planet" — giving security teams early access to its most capable AI models specifically to hunt for flaws in widely-used software. Wiz didn't hedge about what they'd found, calling it the "most severe vulnerabilities ever discovered" by AI tooling. OpenAI described the discovery as "one of the most impactful security issues in recent memory."

What changed wasn't the bug. The underlying flaw in PHP's code had been sitting there since the language's early versions. What changed was the tool doing the looking. Cyber-security researcher Salil Kanhere of UNSW Sydney put it plainly: the bugs "weren't new; what changed was our ability to find them." Wiz's own researchers went further, noting that frontier AI models let them "develop and adapt working exploits across multiple applications in hours" — the same speed advantage that makes AI useful for defense also makes it useful for attack.

"Frontier models were critical to making this process practical, enabling us to develop and adapt working exploits across multiple applications in hours." — Wiz

Why governments reacted like it was a five-alarm fire

Under normal circumstances, a software patch doesn't involve a sitting prime minister. This one did. Japan's Prime Minister Sanae Takaichi posted directly on X urging citizens to check whether their websites ran on PHP, adding that temporarily taking a site down was a reasonable option if patching wasn't immediately possible. The scale of the response, in the span of about a day:

• The US National Security Agency told organizations unable to patch immediately to take their systems offline, warning the flaw could provide "a direct path" to a server's file system or database.
• The UK's National Cyber Security Centre, along with counterparts in the EU, Singapore, and Australia, issued near-identical guidance.
• Finland temporarily shut down its government's public web services entirely.
• The Netherlands' national cyber-security agency, along with its public health agency and the lower house of its parliament, took their own sites offline.
• Amazon said it had already been targeted with exploitation attempts in the days before the vulnerability was made public — before most of the world even knew the bug existed.

That last detail matters most. The disclosure wasn't supposed to happen on this timeline at all; PHP's maintainers had planned a coordinated release alongside the fix, but details leaked on social media a day early, forcing an emergency announcement. Attackers who'd seen the leak had a head start measured in hours, not days.

What this means beyond the patch itself

For India specifically, this lands somewhere less obvious than "patch your website." India's IT services industry maintains enormous volumes of legacy code for clients worldwide — codebases written and barely touched in a decade, exactly the conditions this flaw thrived in. The same AI tools that found this bug are becoming standard-issue for security audits, which means the old assumption that untouched legacy code is "probably fine because nothing's gone wrong yet" no longer holds. A flaw doesn't need a human to stumble onto it anymore; it just needs someone, anywhere, to point a capable enough model at the right codebase.

The uncomfortable part

Nobody involved in finding this bug is claiming victory. The same capability that let Wiz and OpenAI surface a decade-old flaw before most attackers could exploit it at scale is, by their own description, the same capability that will let the next attacker find the next one faster too. For now, the fix is simple: update PHP. The harder, ongoing problem is that the gap between "a flaw exists" and "someone automated enough to find and weaponize it" just got a lot shorter, for defenders and attackers alike.