The essentials
AI models helped find two PHP flaws, disclosed 21 October 2026, with no active exploitation observed.
AI models were used to discover two security vulnerabilities in PHP. Wiz Research used AI to identify PHP vulnerabilities in August 2026. Separately, cybersecurity firm Calif independently found the PHP flaws during an OpenAI-funded audit.
The flaws were publicly disclosed on 21 October 2026. They could allow remote command execution without a password. Reported disruptions have affected millions of websites worldwide. PHP powers approximately 70% of websites worldwide, which gives the flaws broad reach.
Security researchers observed no active exploitation of the flaws at publication. OpenAI described them as among the most notable vulnerabilities of recent years. Older PHP versions that no longer receive maintenance require migration.
Other ways to read this story.
Alternative framings generated by SigNews. These are not independent sources or attributed quotations.
From August research to October disclosure: the PHP flaw timeline
Wiz Research used AI to identify PHP vulnerabilities in August 2026. Calif independently found the flaws during an OpenAI-funded audit. The vulnerabilities were publicly disclosed on 21 October 2026, and researchers reported no active exploitation at publication. Disclosure came roughly two months after the August identification.
PHP's wide reach makes the flaws relevant to many websites
PHP powers approximately 70% of websites worldwide, so flaws in the language reach a large share of the web. Reported disruptions have affected millions of websites. The flaws could allow remote command execution without a password. Operators running older PHP versions that no longer receive maintenance will need to migrate. OpenAI described the flaws as among the most notable vulnerabilities of recent years.