Wiz says AI models found two decade-old PHP flaws, patches…

Anadolu Agency's roundup of October security incidents, published 2 November, gives the PHP disclosure a line of its own. Two critical flaws in the language were disclosed on 21 October, the same day emergency updates went out. The article names them as CVE-2026-109618 and CVE-2026-109619 and says they could let an attacker run code remotely or reach sensitive information on vulnerable servers.

The part worth reading twice is how they were found. According to the article, researchers at Wiz used Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol to identify the flaws, develop working exploits and help validate the patches. Wiz told the outlet the bugs had been there for more than a decade, and that the difficulty of exploiting them is what kept conventional research off them. The company also says AI cut the time and specialist knowledge needed to build and adapt exploitation techniques.

That last point is the uncomfortable one. The same tooling that turned up a ten-year-old bug in a language running a large share of the web also lowers the bar for whoever wants to weaponise it. The article doesn't say whether anyone has.

Anadolu's framing is that AI was central to October's incidents, and it's careful to note that authorities haven't tied them into one campaign or shown AI was used in every case. For PHP, the AI role it describes is discovery and patching, not attack.

The article gives no affected version ranges, no severity score and no exploitation figures, so we're not filling those in here. Operators running PHP should check the vendor's own advisory for the versions they're on rather than take a timeline's word for it.