THE MACHINE FOUND THE HOLE — TWO PHP BUGS, 70% OF THE WEB EXPOSED

Wiz Research just disclosed two critical bugs in PHP itself — CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2 — that let an unauthenticated attacker run code on a web server before any application code even loads. The flaws live in how PHP handles memory when a request dies abnormally, and Wiz demonstrated working pre-authentication remote code execution against the latest WordPress, Drupal and Joomla containers. Even a "Hello World" app on an unpatched PHP is fair game.

The story is who found them: frontier AI did the digging. The vulnerable code sat in the open for more than a decade, and Wiz says turning these flaws into a working exploit needed a chain of steps "at the edge of what human researchers could practically achieve." Gemini 4 Argon did invaluable work finding the bugs and building the exploit; Calif and OpenAI helped with discovery and patch verification. Wiz's punchline: a single researcher with frontier models did in a week what would have taken a world-class team months.

The scale is why everyone is yelling. PHP powers roughly 70% of websites, the patch is out now, and early attacks were already spotted on October 21 — services in the Netherlands and Japan went offline as a precaution before the fix shipped. Updating PHP is the only complete fix.