AI-Discovered PHP Vulnerabilities Downs Government Websites as Patches are Prepared

October 22, 2026:

AI-Discovered PHP Vulnerabilities Downs Government Websites as Patches are Prepared

GettyImages-2300746159 — Kirill KUDRYAVTSEV/AFP via Getty Images

Developers of PHP – the general-purpose scripting language that runs roughly 70% of all sites on the internet – issued a warning this Wednesday regarding security issues within their code and the necessary emergency updates to curtail the dangers they posed.

The two vulnerability classes are tracked as CVE-2026-109618 and CVE-2026-109619; out-of-memory handling and request-owned internal state that can survive across states respectively. The former leaves a corrupted internal PHP state that can treat invalid data as valid after cleanup requests are made while the latter allows for later requests and users to reuse that stale state alongside all of its currently held data.

This can lead to the corruption of process memory, execution of code without former authentication, and full disclosure of sensitive data including passwords, authentication tokens, API keys, and certificates belonging to the requests or the server itself.

A demonstration of the impact of these bugs tested on the latest container images of the CMS services WordPress, Drupal, and Joomla revealed the severity of the situation, coupled with the fact that major platforms such as WordPress host 40% of all websites online.

Affecting PHP versions dating back to PHP 5.4 and having reached a CVSS level of 9.2, the danger cannot be understated, as the same AI pinpointing the issues could just as well exploit them for malicious means.

All of the following research was carried out by a coalition of PHP, Wiz Research, Calif, and OpenAI amidst the many other sites and organizations that utilize the software. The intricate details were revealed utilizing a combination of frontier AI comprising of Wiz Atlas, GPT-5.6 Sol, and Gemini 4 Argon.

Outages particularly affected many European government sites; in the Netherlands, sites for the Port of Rotterdam, Overheid.nl, and KNVB were all made offline as a result of the ensuing crisis. Danish municipal IT company Kombit, Finnish IT service provider Valtori, and France’s Interior Ministry were also amongst the sites affected.

Source link

tags

Abkhazia Afghanistan Africa Albania Algeria Andorra Angola Antigua and Barbuda Argentina Armenia Australia Austria Azerbaijan Bahamas Bahrain Bangladesh Barbados Belarus Belgium Belize Benin Bhutan Bolivia Bosnia and Herzegovina Botswana Brazil Brunei Bulgaria Burkina Faso Burundi Cambodia Cameroon Canada Cape Verde Central African Republic Chad Chile China Colombia Comoros Costa Rica Croatia Cuba Curacao Cyprus Czech Republic Denmark Djibouti Dominica Dominican Republic East Timor Ecuador Egypt El Salvador Equatorial Guinea Eritrea Estonia Eswatini Ethiopia Fiji Finland France French Polynesia Gabon Gambia Georgia Germany Ghana Greece Grenada Guam Guatemala Guinea Guinea-Bissau Guyana Haiti Honduras Hong Kong Hungary Iceland India Indonesia Iran Iraq Ireland Israel Italy Jamaica Japan Jordan Kazakhstan Kenya Kiribati Kosovo Kuwait Kyrgyzstan Laos Latvia Lebanon Lesotho Liberia Libya Liechtenstein Lithuania Luxembourg Macau Madagascar Malawi Malaysia Maldives Mali Malta Marshall Islands Mauritania Mauritius Mexico Micronesia Moldova Monaco Mongolia Montenegro Morocco Mozambique Myanmar Namibia Nauru Nepal Netherlands New Caledonia New Zealand Nicaragua Niger Nigeria North Korea North Macedonia Northern Cyprus Norway Oman Pakistan Palau Palestine Panama Papua New Guinea Paraguay Peru Philippines Poland Portugal Puerto Rico Qatar Republic of the Congo Romania Russia Rwanda Saint Kitts and Nevis Saint Lucia Saint Vincent and the Grenadines Samoa San Marino Saudi Arabia Senegal Serbia Seychelles Sierra Leone Singapore Slovakia Slovenia Solomon Islands Somalia South Korea South Sudan Spain Sri Lanka Sudan Suriname Sweden Switzerland Syria Taiwan Tajikistan Tanzania Thailand Togo Tonga Transnistria Trinidad and Tobago Tunisia Turkey Turkmenistan Tuvalu Uganda UK Ukraine United Arab Emirates Uruguay USA Uzbekistan Vanuatu Vatican City Venezuela Vietnam Western Sahara Yemen Zambia Zimbabwe