Useful journalism to understand, manage and grow a business.
SearchResearchers from Wiz and Calif discovered two critical flaws in PHP, the language that powers 70% of the web, using advanced AI models. The disclosure led to service suspensions at Japanese banks and European governments, while agencies urge updating software or disconnecting affected systems.
Artificial intelligence has marked a turning point in security flaw detection by revealing two critical vulnerabilities in PHP, the programming language that supports roughly 70% of websites worldwide. These defects, dubbed PHP2Shell and identified with the codes CVE-2026-109618 and CVE-2026-109619, allowed attackers to take control of servers without passwords. The most alarming aspect is that these flaws had remained hidden in code for over a decade, a period during which human capacity to audit such complex software proved insufficient.
The discovery was made by teams from Wiz and Calif, a security company collaborating on OpenAI’s Patch the Planet program. Calif identified the first flaw on August 1 using the GPT‑5.6 Sol model, while Wiz independently found the second on August 19 employing Gemini 4 Argon and its own research agent. According to Wiz, a single researcher achieved in one week what an elite team would have taken months for, demonstrating how AI exponentially accelerates risk identification in source code.
The public disclosure on October 21, 2026 triggered an immediate global reaction. Given the severity of the threat, rated at 9.2 out of 10, cybersecurity agencies in the United States, Europe, and Asia issued critical alerts. The U.S. National Security Agency (NSA) warned that the flaw offered a "direct route" to exploit databases on affected systems, urging organizations to upgrade PHP to versions 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or otherwise disconnect network services.
The impact was tangible in the financial and governmental sectors. In Japan, banks such as MUFG and Mizuho temporarily suspended online transactions and mobile apps as a preventive measure, though the national funds‑clearing network remained unaffected. In Europe, agencies from the Netherlands, France, Denmark, and Finland shut down public websites. In the United Kingdom, the government confirmed that 32 sites had been temporarily disconnected, while in Switzerland, the University of Geneva and other institutions took similar precautions. Even Wikimedia, the organization behind Wikipedia, deactivated several of its systems.
While AI enabled the discovery of these flaws before they could be widely exploited, it also introduces new risks. OpenAI warned that the same models capable of finding vulnerabilities can help attackers develop offensive tools and exploits at unprecedented speed. Matthew Prince, CEO of Cloudflare, reported that within hours after disclosure, exploitation attempts surged from thousands to millions in a matter of hours, though no large‑scale successful attacks have been confirmed.
For businesses, the risk extends beyond their primary websites. CISA (U.S. Cybersecurity and Infrastructure Security Agency) noted that PHP is a common component in third‑party software, meaning organizations may be unaware of where it runs. A bank could have its core transaction system secure, but its customer portal or an external service provider might be exposed. This expands the security perimeter to include network device management interfaces, load balancers, and embedded devices, areas often overlooked in security audits.
For end users, the impact is indirect but requires attention. Ken Munro, a white‑hat hacker, compared applying the fixes to "running a Windows update." Web owners, especially those using WordPress or Drupal, should contact hosting providers or developers to confirm that PHP core patches have been applied, as updating plugins does not resolve the issue. Users should watch for phishing attempts exploiting the incident’s notoriety and follow security recommendations from services they use.
This incident marks a paradigm shift: modern software complexity has outpaced traditional human audit capabilities. As Salil Kanhere, researcher at UNSW Sydney, noted, "the underlying bugs were not new; what changed was our ability to find them." The speed with which AI can identify—and potentially exploit—flaws forces organizations to rethink security strategies, moving from a reactive model to one where continuous automated detection is the norm. The lesson is clear: digital security is no longer just about code but about technological adaptability in the face of tools that evolve at the same pace as threats.
Apollo Go began testing its RT6 vehicles in Brent alongside Freenow, the Lyft platform. Commercial service is targeted for 2027, but depends on regulatory approvals.
Read story
Hilton shares will stop trading on the New York Stock Exchange after the close on November 4, 2026, and begin trading on Nasdaq the following morning. The company says shareholders do not need to take any action and that the move does not change its strategy.
Read story
The IGAE rose 3.5% year over year on a seasonally adjusted basis, driven by construction, manufacturing and wholesale trade. The result improves the short-term outlook, although slower growth in services and weakness in some activities point to an uneven picture.
Read story