AI tools discovered the PHP vulnerability that could take down 70% of the internet. Now, the race is on to patch it before AI-powered hackers attack

Most web pages run using an open-source programming language called PHP. That language is maintained by the PHP Foundation. Today, the foundation disclosed two “critical” software vulnerabilities and issued an emergency patch, urging websites to implement it immediately or take down their websites until they are able to. The vulnerabilities are named CVE-2026-109618 and CVE-2026-109619 and collectively called “php2shell.” As reports broke overnight of the vulnerabilities ahead of the patch’s official release, some opportunistic attackers tried to exploit it. Cloudflare, a global cybersecurity company that helps secure millions of websites, according to its website, began seeing “early attacks,” according to its CTO…