Did Artificial Intelligence save the internet? The case of PHP and Patch the Planet
It is not every day that we witness an event that changes the rules of the game in information security, but the last few weeks have provided us with a sharp reminder that the infrastructure on which most of the internet is built is much more fragile than we thought. Two critical security vulnerabilities in PHP, the programming language that powers about 70% of the world's websites, were recently exposed – and this time, the one at the forefront of the discovery was not just a human eye, but artificial intelligence models.
What actually happened?
As part of the Patch the Planet initiative by OpenAI, security researchers from the company Calif used the GPT-5.6 Sol model to scan the PHP source code. The result was dramatic: the discovery of two severe security vulnerabilities (CVE-2026-109618 and CVE-2026-109619), which were given a severity score of 9.2 out of 10. These vulnerabilities, dubbed "php2shell," allowed attackers to run code remotely on servers, granting them full control over the affected sites [1, 4, 5].
The amazing fact is that these vulnerabilities had existed in the code for about 14 years. While human researchers had encountered a similar bug in the past, they failed to understand its full destructive potential. The artificial intelligence managed to connect the dots and turn an "old" bug into an immediate and dangerous security threat [2, 5].
Why is this important to you?
If you manage a website, server, or PHP-based application, you are in the line of fire. These are vulnerabilities that allow attackers to steal sensitive information or deface websites with relative ease. The good news is that the PHP community, in collaboration with OpenAI, Google Wiz, and other entities, acted quickly to release updates [1, 10].
The updated versions that fix the vulnerabilities are:
- •PHP 8.5.12
- •PHP 8.4.27
- •PHP 8.3.36
- •PHP 8.2.35
If you are running older versions (like 8.1 and below), it is important to understand that they no longer receive official support and will not receive these fixes. Now is the time to consider an urgent upgrade [2].
How to check for exposure?
Beyond updating the version, it is important to verify that your systems are indeed protected. OpenAI and its partners currently offer tools and methodologies that allow for targeted security scans. As part of my work in the No-Code and automation field, I always recommend using CI/CD that includes automated security scans. You can use AI to analyze your PHP versions and identify if they are exposed, but remember: version checking is not a substitute for comprehensive security.
Summary and conclusions
This event marks a new era in cybersecurity. On one hand, artificial intelligence is becoming a powerful tool in the hands of researchers to find weaknesses that have escaped human eyes for a decade. On the other hand, it is also a tool that could be used by attackers in the future.
The bottom line: Do not wait. If your site is based on PHP, make sure today that you are updated to the latest versions. The open-source world is the backbone of the internet, and the responsibility to maintain it belongs to all of us.
For more information on the patches and technical guidelines, it is recommended to follow the official updates from The PHP Foundation.