A PHP vulnerability that has existed for over a decade threatens website security: how AI found it, who is affected, and how to protect against it

Wiz Research discovered two memory safety vulnerabilities, CVE-2026-109618 and CVE-2026-109619, in the PHP core engine; attackers can remotely execute code without authentication and steal passwords, authentication tokens and API keys from server memory; the vulnerabilities were disclosed on October 21, 2026, and PHP released security updates at the same time. PHP powers about 70% of websites worldwide, affected versions date back to PHP 5.4, and any site running an affected version may be exposed; researchers demonstrated attacks on WordPress, Drupal and Joomla, and the vulnerabilities are in PHP itself rather than in these platforms. Wiz said its team used Wiz Atlas, Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol to locate the vulnerabilities and turn complex memory errors into working exploits, and also used AI to test patches.