AI Helped Find Serious PHP Security Flaws. What Should Website Owners Do?

PHP is a programming language used by many websites and web applications. Like any widely used software, it needs security updates when researchers find weaknesses. In October 2026, two critical PHP vulnerabilities were disclosed after coordinated work between researchers, PHP maintainers and security organisations.

OpenAI reported that a model helped identify one of the flaws through its Patch the Planet initiative. The company also said security firm Wiz independently discovered and reported both. PHP’s maintainers led the fixes and release. That is a useful example of AI supporting security research, but the repair still depended on people validating the findings, coordinating disclosure and publishing an update.

What was the risk?

The PHP project listed CVE-2026-109618 and CVE-2026-109619 as critical remote-code-execution vulnerabilities. In plain English, a security weakness of this kind can allow an attacker to make a vulnerable server run commands it should not. The risk depends on the PHP version, how the server is configured and whether the relevant software has been updated.

PHP’s fixed releases for the October disclosure were 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Hosting providers and Linux vendors may package or backport the fixes differently, so ask which supported update applies to your installation rather than relying on a version number alone.

A vulnerability is not the same as a confirmed break-in. The disclosure does not establish that a particular site was attacked, that data was taken or that every PHP website is affected in the same way. It does mean site owners should find out whether their installation needs an update or a vendor-provided backport.

What should a small business check?

1. 1Ask your hosting provider which PHP version and support branch your website uses, and whether the October security fixes have been applied.
2. 2If you manage the server, follow PHP’s official security advisory and upgrade instructions. Do not guess at a version number: distributions and hosting platforms may provide their own supported fixes.
3. 3Update the website platform, themes, extensions and server components as well as PHP. A current language runtime cannot compensate for an abandoned plugin.
4. 4Keep a recent backup and make sure you know how to restore it. A backup is valuable only if it is separate from the affected system and recovery has been tested.
5. 5If the host cannot confirm the fix, ask for a clear response and a timeframe. Consider an independent web professional if the site is business-critical.

If you suspect that your website has actually been compromised, do not treat an upgrade as the whole response. Contact your host, preserve relevant logs and follow an incident-response process. A professional can help determine whether there is evidence of access and whether credentials or customer information need protection.

Does AI make websites harder to protect?

AI can help researchers examine software and find patterns, but it can also lower the effort required to study weaknesses. That makes timely patching and clear responsibility for maintenance more important. It does not make secure maintenance optional, and the PHP team—not an AI system—produced and released the fixes.

For a business owner, the practical question is straightforward: who is responsible for updating your website’s runtime, and how will you know when a security update needs attention? Get that answer before the next urgent advisory arrives.

Read OpenAI’s account of the coordinated PHP vulnerability disclosure →

Read PHP’s official security notice and update guidance →

Read IT Club’s practical guide to website backups →

Have a technology question? Ask IT Club for free.