PHP maintainers released an emergency patch on October 21, 2026 to address two critical vulnerabilities identified in the language. The flaws were discovered by researchers from Calif and Wiz using artificial intelligence; Calif reported its finding to PHP developers on August 11, and Wiz independently disclosed its discovery on August 24.
Scope and seriousness of the issue
The vulnerabilities triggered a broad response because PHP is widely used across the web. According to W3Techs, nearly 70 percent of websites with identifiable server-side technology run on PHP; WordPress, which itself powers about 40 percent of all websites, is built on PHP. The Drupal Association executive director stated that the vulnerabilities affect all PHP versions released over the past twenty years.
Censys data cited in reporting indicated that out of roughly 2.6 million servers running PHP, about 1.5 million did not have the patch available at the time of disclosure. That large unpatched population contributed to the precautionary shutdowns and urgent mitigations.
Government and institutional responses
CERT-EU, the European Union’s cybersecurity team, urged organizations using PHP to take affected systems offline until they could apply the official PHP fixes. Several national and public-sector sites went offline or into maintenance mode: the Dutch National Cyber Security Centre temporarily took down its website, Finland’s state IT service provider disconnected all government web services, and the French Ministry of the Interior put its sites into maintenance.
In Hungary, the National Cybersecurity Institute issued a critical alert. Tanács Zoltán, Minister of Science and Technology, announced that as a precaution the Magyarország.hu portal and several other government sites were temporarily taken offline; authorities reported no evidence of a successful cyberattack at the time.
Role of AI and the researchers’ findings
The first vulnerability was found by Calif researchers using the OpenAI GPT-5.6 Sol model, and the second was discovered independently by Wiz, a security company affiliated with Alphabet, also using AI. Wiz noted that proving exploitability required a sequence of actions approaching the limits of what human researchers can practically perform—highlighting AI’s capabilities in uncovering complex security issues.
Broader effects and follow-up measures
The incident prompted international follow-up: Japan announced plans to set up a unit that will probe systems for weaknesses using AI-simulated attacks. Numerous service providers and operators worldwide implemented emergency security measures in response to the disclosures.
Public interest — Google Trends data
Google Trends data show a sharp global spike in searches for the term “PHP” during the week the vulnerabilities became public, reaching the highest levels seen in the past five years. Although AI was instrumental in discovering the flaws, searches for the term “AI security” did not show a comparable increase.
When compared to searches for “Hugging Face,” interest in “PHP” was substantially higher in most countries, reflecting the broader population affected by PHP vulnerabilities. Some exceptions appeared—for example, China showed stronger interest in Hugging Face, which may relate to the country’s concentrated focus on AI development.
Conclusion
The AI-assisted discovery of two critical PHP vulnerabilities and the October 21 emergency update forced many operators to take websites offline as a precaution. The episode underscored how widely used web technologies can rapidly become a global risk vector and illustrated both the power of AI in vulnerability research and the urgent need for timely patch distribution and system hardening.
