AI Models Find Critical PHP Flaws in Hours, Triggering Global Website Shutdowns and German BSI Orange Warning
GPT-5.6 and Gemini 4 Argon discovered exploitable ten-year-old PHP memory errors in hours, leading to CVSS 9.2 high-risk vulnerabilities and widespread preventive disconnections.
On Wednesday afternoon, numerous websites worldwide went offline as a precaution after two security flaws collectively named “PHP2Shell” became known. Identified as CVE-2026-109618 and CVE-2026-109619, these vulnerabilities each carry a risk score of 9.2 on the ten-level CVSS scale. The German Federal Office for Information Security (BSI) issued an official cyber security warning at the second-highest level, “Orange,” advising operators to temporarily disconnect affected web servers from the internet if necessary. According to Futurezone, government agencies in Finland and the Netherlands, along with parts of the UK’s BBC, also took similar measures.
The core of this incident lies in how artificial intelligence has changed the speed of vulnerability discovery. According to technical analysis by Wiz, these are four related memory safety flaws in the PHP runtime environment, dating back to version PHP 5.4 over a decade ago. Attackers can trigger a “Use-After-Free” mechanism via manipulated requests, allowing remote execution of malicious code or theft of passwords and API keys without authentication. While Quarkslab identified signs of one flaw in 2024, it remained unfixed due to the lack of a known attack path. On August 11, 2026, Calif and OpenAI first demonstrated its exploitability using the GPT-5.6 Sol model. Subsequently, the Wiz team independently reproduced the flaw family and constructed full attack chains using GPT-5.6 Sol and a pre-release version of Google DeepMind’s Gemini 4 Argon.
This process demonstrates that complex vulnerability chaining, which previously required months of manual analysis, can now be completed by large language models within hours. This capability compresses the reaction time window for both defenders and attackers. As PHP underpins approximately 70% of all websites globally (according to Wiz estimates), flaws in its foundation directly impact mainstream systems like WordPress and Drupal. Although OpenAI coordinated disclosure through its “Patch the Planet” initiative and pledged funding for open-source security, the premature leak of technical details forced the PHP development team to release emergency patches on Wednesday. Administrators must immediately upgrade to versions such as PHP 8.5.12 and 8.4.27, or adopt temporary mitigations like disabling upload progress indicators if updates are not possible.