On October 21, 2026, cybersecurity researchers publicly disclosed two critical vulnerabilities residing within the C core of the PHP scripting language. Cataloged as CVE-2026-109618 and CVE-2026-109619 with a CVSS severity rating of 9.2, the flaws grant remote attackers the ability to execute arbitrary code. The vulnerabilities span all PHP versions from 5.4 through 8.5, placing an estimated 70 percent of all web servers across the globe at immediate risk. The disclosure prompted urgent worldwide security notices and coordinated incident response measures by hosting providers and government bodies.
The underlying memory corruption bugs, specifically out-of-memory and use-after-free conditions, had remained hidden inside the codebase for 14 years. Their discovery was achieved not by conventional static analysis alone, but by security researchers from Calif and Wiz utilizing the reasoning model GPT-5.6 Sol. The research teams deployed the artificial intelligence system to systematically audit complex execution paths and legacy memory handling logic across the C implementation. The breakthrough highlights the capacity of advanced reasoning models to identify severe flaws that escaped human scrutiny for well over a decade.
The public release of vulnerability details immediately triggered an aggressive wave of automated exploitation routines across global internet traffic. Matthew Prince, the chief executive officer of Cloudflare, shared telemetry demonstrating an unprecedented escalation of hostile traffic. Cloudflare detected thousands of scanning attempts prior to the formal disclosure, which escalated to tens of thousands within 45 minutes of the announcement. By October 22, 2026, the volume had expanded into millions of automated attack routines attempting to locate vulnerable web deployments.
In response to the imminent threat of host compromise, authorities in multiple nations proactively took critical online government portals offline. Simultaneously, the PHP core development community issued emergency point releases to protect all actively maintained software branches. Security patches were rolled out for PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12 to neutralize the underlying memory flaws. System administrators worldwide were urged to deploy these updates immediately or isolate legacy installations behind stringent perimeter defenses.
The incident represents a watershed moment for internet infrastructure security, a point echoed in observations by software engineer Armin Ronacher. Autonomous AI agents and reasoning-capable models are now systematically analyzing open-source foundations, exposing legacy C flaws that lingered unnoticed across generations of software releases. For network defenders, this development shifts the cybersecurity landscape into an asymmetrical race against machine-speed exploitation. The window between an automated zero-day discovery and global internet-wide scans has effectively compressed into minutes.